# Latest **URL:** https://discuss.elastic.co/latest.md?page=1489 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1490 --- ## [How to seed a dashboard png via webhook weekly?](https://discuss.elastic.co/t/how-to-seed-a-dashboard-png-via-webhook-weekly/283557)
**Author:** [@Liangliang\_Qiu](https://discuss.elastic.co/u/Liangliang_Qiu)\ **Replies:** 2\ **Last updated:** [September 8, 2021, 1:27am UTC](https://discuss.elastic.co/t/how-to-seed-a-dashboard-png-via-webhook-weekly/283557 "2021-09-08T01:27:21Z")
Here we want to use watcher to send a weekly png report into a group such Wechat etc, which is produced from dashboard periodically. Email report is able to use attachment, while webhook doesn't have this parameter. I u… --- ## [Log kernel messages](https://discuss.elastic.co/t/log-kernel-messages/283593)
**Author:** [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Replies:** 0\ **Last updated:** [September 8, 2021, 1:21am UTC](https://discuss.elastic.co/t/log-kernel-messages/283593 "2021-09-08T01:21:17Z")
In my journalbeat.yml file I'm using include\_matches under journalbeat.inputs to restrict the logs shipped to elasticsearch by systemd.units. But... how do I also include the output I get via journalctl -k (kernel messag… --- ## [Best way to index human names?](https://discuss.elastic.co/t/best-way-to-index-human-names/283591)
**Author:** [@rdate](https://discuss.elastic.co/u/rdate)\ **Replies:** 0\ **Last updated:** [September 8, 2021, 12:30am UTC](https://discuss.elastic.co/t/best-way-to-index-human-names/283591 "2021-09-08T00:30:07Z")
Hello! I am building an index that includes personal names and after a bunch of searching around I haven't been able to find the best way to index these names to allow for the large amount of variation in name constructi… --- ## [JSON形式のドキュメントを分割する方法](https://discuss.elastic.co/t/json/283391)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 12:03am UTC](https://discuss.elastic.co/t/json/283391 "2021-09-08T00:03:44Z")
以下のようなJSONファイルをlogstashのJSONフィルターを用いてElasticsearchに取り込みます { "imageScanFindings": { "findings": \[ { "name": "CVE-2019-3462", "description": "Incorrect sanitation of… --- ## [Validation\_exception: Validation Failed: 1: this action would add \[2\] total shards, but this cluster currently has \[2000\]/\[2000\] maximum shards open;](https://discuss.elastic.co/t/validation-exception-validation-failed-1-this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/283462)
**Author:** [@Danilo\_Camargo](https://discuss.elastic.co/u/Danilo_Camargo)\ **Replies:** 7\ **Last updated:** [September 7, 2021, 11:53pm UTC](https://discuss.elastic.co/t/validation-exception-validation-failed-1-this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/283462 "2021-09-07T23:53:23Z")
Hi everyone. I know this is a similar topic to others, but so far it seems odd to me still. I have the message above on my instance, however when I query for \_cluster/stats I have this: "cluster\_name" : "docker-cluster"… --- ## [If condtion not working in ingest pipeline](https://discuss.elastic.co/t/if-condtion-not-working-in-ingest-pipeline/283589)
**Author:** [@venkat\_swaminathan](https://discuss.elastic.co/u/venkat_swaminathan)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 11:12pm UTC](https://discuss.elastic.co/t/if-condtion-not-working-in-ingest-pipeline/283589 "2021-09-07T23:12:11Z")
I am trying to set up a ingest pipelines for my Kubernetes cluster logs, but when I try to evaluate a field in the pipeline processor, fields with no dot works ( "if": "ctx.tags == 'audit'") & field with dot characters … --- ## [Filebeat logs not displaying to Kibana](https://discuss.elastic.co/t/filebeat-logs-not-displaying-to-kibana/283385)
**Author:** [@Codedestiny1](https://discuss.elastic.co/u/Codedestiny1)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 10:27pm UTC](https://discuss.elastic.co/t/filebeat-logs-not-displaying-to-kibana/283385 "2021-09-07T22:27:22Z")
Filebeat YAML configuration files automated by Ansible playbook have been installed on two virtual machines (Web1 & Web2). I can SSH into them and find filebeat systemctl service is running (active). But no log data is d… --- ## [How to filter data while migrating from SQL to Elasticsearch using Logstash to obtain a nested strings array in a JSON object](https://discuss.elastic.co/t/how-to-filter-data-while-migrating-from-sql-to-elasticsearch-using-logstash-to-obtain-a-nested-strings-array-in-a-json-object/283585)
**Author:** [@maklil](https://discuss.elastic.co/u/maklil)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 10:25pm UTC](https://discuss.elastic.co/t/how-to-filter-data-while-migrating-from-sql-to-elasticsearch-using-logstash-to-obtain-a-nested-strings-array-in-a-json-object/283585 "2021-09-07T22:25:59Z")
Hi, I'm trying to migrate data from SQL Server to Elasticsearch using Logstash into a certain format. My data is normalized and essentially involves a central table which is linked to other tables by a foreign key, and m… --- ## [Kibana External Search Link](https://discuss.elastic.co/t/kibana-external-search-link/283579)
**Author:** [@mikemitchell](https://discuss.elastic.co/u/mikemitchell)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 9:58pm UTC](https://discuss.elastic.co/t/kibana-external-search-link/283579 "2021-09-07T21:58:46Z")
We would like to manually create a get request to Kibana. All we need from the user currently is the root URL, something like https://elastic.cyborglab.local/, and we're able to create the link that would take them direc… --- ## [Extraction valeurs champ message](https://discuss.elastic.co/t/extraction-valeurs-champ-message/281303)
**Author:** [@Christophe\_Dumont](https://discuss.elastic.co/u/Christophe_Dumont)\ **Replies:** 5\ **Last updated:** [September 7, 2021, 8:28pm UTC](https://discuss.elastic.co/t/extraction-valeurs-champ-message/281303 "2021-09-07T20:28:58Z")
Bonjour, Je souhaite indexer des paquets réseau et en extraire certaines informations mais logstash envoi tout dans un champ unique. Voici le code logstash : input { kafka { bootstrap\_servers =\> "172.16.238.204:… --- ## [ECK clusters and client sniffing](https://discuss.elastic.co/t/eck-clusters-and-client-sniffing/244972)
**Author:** [@Presence](https://discuss.elastic.co/u/Presence)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 8:00pm UTC](https://discuss.elastic.co/t/eck-clusters-and-client-sniffing/244972 "2021-09-07T20:00:31Z")
It seems difficult to set up an ECK ElasticSearch cluster where client sniffing works. Does anybody have any suggestions on best approaches here? Our clusters are currently on AWS EKS in 3 availability zones behind a sin… --- ## [Elasticsearch query](https://discuss.elastic.co/t/elasticsearch-query/283575)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 7:24pm UTC](https://discuss.elastic.co/t/elasticsearch-query/283575 "2021-09-07T19:24:19Z")
My siem only allows any querys inside query{} I need to do a sort by date like this but the sort needs to be inside the query , any ideas GET /index-\*/\_search { "sort" : \[ { "@timestamp" : {"order": "desc"}} \]… --- ## [How to get percentage of failed tests from all results](https://discuss.elastic.co/t/how-to-get-percentage-of-failed-tests-from-all-results/282818)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 5\ **Last updated:** [September 7, 2021, 6:59pm UTC](https://discuss.elastic.co/t/how-to-get-percentage-of-failed-tests-from-all-results/282818 "2021-09-07T18:59:21Z")
Hi All, I'm using v 7.11.1 I have this data structure in elastic: { "\_index" : "stamshay", "\_type" : "\_doc", "\_id" : "ub0ll3sB2oqJ9931yhZw", "\_score" : 1.0, "\_source" : { "buildVersion" : "1.1.1.1", "testcase" … --- ## [Logastash Exec plugin Cannot allocate memory](https://discuss.elastic.co/t/logastash-exec-plugin-cannot-allocate-memory/283561)
**Author:** [@vikasgurlinka](https://discuss.elastic.co/u/vikasgurlinka)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 6:28pm UTC](https://discuss.elastic.co/t/logastash-exec-plugin-cannot-allocate-memory/283561 "2021-09-07T18:28:31Z")
I am running Logstash 7.9.1 with 24 GB of maximum heap size configured in a Linux machine with 30 GB Memory and configured a pipeline to run a python program with Logstash exec plugin I see the below error message in log… --- ## [How to delete a task in Elasticsearch v7.14](https://discuss.elastic.co/t/how-to-delete-a-task-in-elasticsearch-v7-14/283321)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 7\ **Last updated:** [September 7, 2021, 5:49pm UTC](https://discuss.elastic.co/t/how-to-delete-a-task-in-elasticsearch-v7-14/283321 "2021-09-07T17:49:45Z")
I'm currently running a delete\_by\_query job and setting the wait\_for\_completion argument to false. In the documentation, it says: Running delete by query asynchronously If the request contains wait\_for\_completion=fals… --- ## [AWS Integrations Mapping Error](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 5:17pm UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502 "2021-09-07T17:17:08Z")
Hi I'm hoping this is posted in the correct place. I believe the AWS mappings in the Fleet Integration are missing a mapping for event.created. I am ingesting Cloudtrail logs via Fleet and I'm getting errors stating t… --- ## [Use an Analyzer within a painless script and access the produced terms](https://discuss.elastic.co/t/use-an-analyzer-within-a-painless-script-and-access-the-produced-terms/283474)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 5:04pm UTC](https://discuss.elastic.co/t/use-an-analyzer-within-a-painless-script-and-access-the-produced-terms/283474 "2021-09-07T17:04:50Z")
Hi All, I'm trying to find out if something is possible or not within Painless. I'd like to use the English analyzer within a Painless script. I'd then like to use the same painless script to iterate over the created t… --- ## [Search DSL Query value with '(single quote) and space in elastic 6.8](https://discuss.elastic.co/t/search-dsl-query-value-with-single-quote-and-space-in-elastic-6-8/281091)
**Author:** [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 5:02pm UTC](https://discuss.elastic.co/t/search-dsl-query-value-with-single-quote-and-space-in-elastic-6-8/281091 "2021-09-07T17:02:10Z")
Hi, Actually, i am trying to do Search DSL Query value with '(single quote) like below query (1) and some times with single space Query (2) below, i am not getting expected results, Could you please suggest me for that.… --- ## [Strange Behaviour in alerts](https://discuss.elastic.co/t/strange-behaviour-in-alerts/283539)
**Author:** [@anyla](https://discuss.elastic.co/u/anyla)\ **Replies:** 8\ **Last updated:** [September 7, 2021, 4:34pm UTC](https://discuss.elastic.co/t/strange-behaviour-in-alerts/283539 "2021-09-07T16:34:55Z")
Hi, I'm starting to migrate our old nagios into the Elastic's Observability solution. When trying to do a simple Infrastructure alert if happens something strange. I define a CPU alert with a very low threshold (in or… --- ## [Elastic Agent 7.14 -- Strange bug during enrollment "Elastic fleet agent bug"](https://discuss.elastic.co/t/elastic-agent-7-14-strange-bug-during-enrollment-elastic-fleet-agent-bug/281594)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 15\ **Last updated:** [September 7, 2021, 4:16pm UTC](https://discuss.elastic.co/t/elastic-agent-7-14-strange-bug-during-enrollment-elastic-fleet-agent-bug/281594 "2021-09-07T16:16:32Z")
Elastic Agent 7.14 on-prim Elastic cluster. Effected OS Windows Server 2016/2019 both OS's have the same issue. Error pulled from a failed enrollment attempt of the client directly. Fleet agent in prod is running on Ce… --- ## [Умножить два поля](https://discuss.elastic.co/t/topic/283133)
**Author:** [@zhsv](https://discuss.elastic.co/u/zhsv)\ **Replies:** 7\ **Last updated:** [September 7, 2021, 3:57pm UTC](https://discuss.elastic.co/t/topic/283133 "2021-09-07T15:57:18Z")
В ELK отправляются события печати windows (код 307 и 805) в одном количество распечатанных страниц во втором количество копий. Необходимо умножить эти значения, чтобы получить сумму распечатанных страниц. winlog.user\_d… --- ## [How to copy from one nested field to another in elasticsearch?](https://discuss.elastic.co/t/how-to-copy-from-one-nested-field-to-another-in-elasticsearch/283549)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 3:56pm UTC](https://discuss.elastic.co/t/how-to-copy-from-one-nested-field-to-another-in-elasticsearch/283549 "2021-09-07T15:56:57Z")
Hi all, I'm trying to copy from one field to another. I want to copy data from fanLocation.lng to fanLocation.lon in an index. I have already mapped both geo fields with geo\_point i'm unable to use when using nested … --- ## [Logstash pipelines failing as Logstash failed to create queue](https://discuss.elastic.co/t/logstash-pipelines-failing-as-logstash-failed-to-create-queue/283461)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 0\ **Last updated:** [September 6, 2021, 3:21pm UTC](https://discuss.elastic.co/t/logstash-pipelines-failing-as-logstash-failed-to-create-queue/283461 "2021-09-06T15:21:16Z")
I am running logstash in a docker container. There are 7-8 logstash pipelines defined under pipelines.yml file. Queue type for every pipeline is "persisted". Everything was working fine but recently whenever I am startin… --- ## [Cluster stops workning when shutting down master marked with a star? \[7.11.2\]](https://discuss.elastic.co/t/cluster-stops-workning-when-shutting-down-master-marked-with-a-star-7-11-2/283545)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 9\ **Last updated:** [September 7, 2021, 3:40pm UTC](https://discuss.elastic.co/t/cluster-stops-workning-when-shutting-down-master-marked-with-a-star-7-11-2/283545 "2021-09-07T15:40:17Z")
Hi! I have a three node cluster where all nodes are maste nodes and I'm using Kibana for checking status and running queries. Running the command: GET \_cat/nodes Gives me: ip heap.percent ram.percent cpu lo… --- ## [Else if condition is not working?](https://discuss.elastic.co/t/else-if-condition-is-not-working/283544)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 2:46pm UTC](https://discuss.elastic.co/t/else-if-condition-is-not-working/283544 "2021-09-07T14:46:14Z")
I want if SubmittedOn is null then add New field with value 1 mutate{ add\_field=\>{"Queue"=\>1} } if \[SubmittedOn\]{ if \[null\] not in \[SubmittedOn\]{ date { m… --- ## [Is there documentation regarding the field names in the logs?](https://discuss.elastic.co/t/is-there-documentation-regarding-the-field-names-in-the-logs/283320)
**Author:** [@a24](https://discuss.elastic.co/u/a24)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 2:44pm UTC](https://discuss.elastic.co/t/is-there-documentation-regarding-the-field-names-in-the-logs/283320 "2021-09-07T14:44:18Z")
I am brand new to kibana. I am looking at my logs and there are some field names I am not familiar with. Is there documentation that will explain the field names to me? thank you --- ## [7.14.0 Kibana discover table layout: message field as raw xml](https://discuss.elastic.co/t/7-14-0-kibana-discover-table-layout-message-field-as-raw-xml/282819)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 2:42pm UTC](https://discuss.elastic.co/t/7-14-0-kibana-discover-table-layout-message-field-as-raw-xml/282819 "2021-09-07T14:42:34Z")
In both the classic and new table layout, message xml content is being parsed as html. Is there a way to get a table view that shows the message field content as raw xml. It is possible to see the raw xml content one by… --- ## [Rally \_bulk error 400 "type is missing"](https://discuss.elastic.co/t/rally-bulk-error-400-type-is-missing/283073)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 6\ **Last updated:** [September 2, 2021, 12:39pm UTC](https://discuss.elastic.co/t/rally-bulk-error-400-type-is-missing/283073 "2021-09-02T12:39:31Z")
Hey there, I'm trying to import a custom track exported from an old ES version (still using 'type' field) into another ES cluster (same version). This is the error I faced: \[ERROR\] Cannot race. Error in load generato… --- ## [Logstash unable to connect to elasticsearch](https://discuss.elastic.co/t/logstash-unable-to-connect-to-elasticsearch/283548)
**Author:** [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 2:39pm UTC](https://discuss.elastic.co/t/logstash-unable-to-connect-to-elasticsearch/283548 "2021-09-07T14:39:14Z")
I have SSL enabled on all my elastic nodes, using a self signed certificate. However logstash is unable to connect to elasticsearch. Gives the following error \[2021-09-07T10:34:50,283\]\[WARN \]\[logstash.outputs.elasticsea… --- ## [Does logstash support having a list/array in root (top level) of the event](https://discuss.elastic.co/t/does-logstash-support-having-a-list-array-in-root-top-level-of-the-event/283524)
**Author:** [@Renjith\_PK](https://discuss.elastic.co/u/Renjith_PK)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 2:35pm UTC](https://discuss.elastic.co/t/does-logstash-support-having-a-list-array-in-root-top-level-of-the-event/283524 "2021-09-07T14:35:29Z")
We have input data like this message:\[{key1:value1},{key2:value2}\] and we need value of message, which is a list, directly on root of event (to use as zipkin storage) without any additional field. I tried using json fi… [Previous page](https://discuss.elastic.co/latest.md?page=1488) [Next page](https://discuss.elastic.co/latest.md?page=1490)