# Latest **URL:** https://discuss.elastic.co/latest.md?page=1509 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1510 --- ## [Problem with if statement in GROK filter](https://discuss.elastic.co/t/problem-with-if-statement-in-grok-filter/282466)
**Author:** [@vp096](https://discuss.elastic.co/u/vp096)\ **Replies:** 4\ **Last updated:** [August 25, 2021, 11:27am UTC](https://discuss.elastic.co/t/problem-with-if-statement-in-grok-filter/282466 "2021-08-25T11:27:13Z")
Hello, I send syslog data from a WiFi controller to ElasticSearch. This controller sends me different types of packets and I want to keep only the packets of this type: Aug 25 11:19:50 2021 MC72-WI-AS1-06-B authmgr\[364… --- ## [Metricbeat 401 error after enabling TLS](https://discuss.elastic.co/t/metricbeat-401-error-after-enabling-tls/281986)
**Author:** [@Greg\_R](https://discuss.elastic.co/u/Greg_R)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 11:14am UTC](https://discuss.elastic.co/t/metricbeat-401-error-after-enabling-tls/281986 "2021-08-25T11:14:44Z")
Greetings I've setup ElasticSearch, Kibana and Metricbeat on http and it's working. Now I want to enable API keys, so I have to enable TLS (although I don't understand why). So I got ES and Kibana working together, bu… --- ## [Config validation of \[xpack.security\].authc.providers](https://discuss.elastic.co/t/config-validation-of-xpack-security-authc-providers/282258)
**Author:** [@etrpchevska](https://discuss.elastic.co/u/etrpchevska)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 10:54am UTC](https://discuss.elastic.co/t/config-validation-of-xpack-security-authc-providers/282258 "2021-08-25T10:54:45Z")
I am trying to setup SSO authentication with Azure AD. elasticsearch.yml: | cluster.name: dev-observability network.host: "0.0.0.0" bootstrap.memory\_lock: false discovery.zen.ping.unicast.hosts: es-clust… --- ## [Limiting the number of documents for each bucket in term aggregation](https://discuss.elastic.co/t/limiting-the-number-of-documents-for-each-bucket-in-term-aggregation/281818)
**Author:** [@menshenin](https://discuss.elastic.co/u/menshenin)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 10:37am UTC](https://discuss.elastic.co/t/limiting-the-number-of-documents-for-each-bucket-in-term-aggregation/281818 "2021-08-25T10:37:34Z")
Hi, There is a set of terms. I want to know which ones are present in the search results and I use term aggregation for this purpose. Is there some way to limit the number of documents for each bucket in term aggregati… --- ## [How can I disable or uninstall x-pack in Elasticsearch 7.14](https://discuss.elastic.co/t/how-can-i-disable-or-uninstall-x-pack-in-elasticsearch-7-14/282472)
**Author:** [@peterhajdu](https://discuss.elastic.co/u/peterhajdu)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 10:34am UTC](https://discuss.elastic.co/t/how-can-i-disable-or-uninstall-x-pack-in-elasticsearch-7-14/282472 "2021-08-25T10:34:06Z")
Hi, we are about to switch from elasticsearch-oss 7.7 to elasticsearch 7.14. Elasticsearch 7.14 contains x-pack by default but we do not intend to use any functionality that the oss version did not contain. Is it poss… --- ## [Logstash Monitoring and AWS PrivateLink (Elastic Cloud)](https://discuss.elastic.co/t/logstash-monitoring-and-aws-privatelink-elastic-cloud/282338)
**Author:** [@nick\_cgi](https://discuss.elastic.co/u/nick_cgi)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 10:16am UTC](https://discuss.elastic.co/t/logstash-monitoring-and-aws-privatelink-elastic-cloud/282338 "2021-08-25T10:16:24Z")
I have an Elastic Cloud instance, set to deploy in AWS (v7.13.x). Additionally, I have Logstash (v7.13.4) running within an AWS account, which is in the same region as the Elastic Cloud instance. In order to get Logsta… --- ## [Restful API query string has http 500 error code](https://discuss.elastic.co/t/restful-api-query-string-has-http-500-error-code/281808)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:15am UTC](https://discuss.elastic.co/t/restful-api-query-string-has-http-500-error-code/281808 "2021-08-25T10:15:17Z")
The query String in Kibana is : system:APC AND host: F12\*R2R\* AND message:"Turn to Phase \[F12P7\]", and I want to query through Restful API like below: String bodycontent="{" +" \\"\_source\\": \[\\"@timestamp\\",\\"eqp… --- ## [Routing with Java Client UpdateRequests not working](https://discuss.elastic.co/t/routing-with-java-client-updaterequests-not-working/281819)
**Author:** [@redbow](https://discuss.elastic.co/u/redbow)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:09am UTC](https://discuss.elastic.co/t/routing-with-java-client-updaterequests-not-working/281819 "2021-08-25T10:09:10Z")
Hey dear Elasticsearch community, I would like to send an UpdateRequest with the Java REST Client (7.13) to Elasticsearch using the .routing() request parameter, because I am updating a join field. It seems, using this … --- ## [Elasticsearch.Net, search gets really slow when one of three nodes are shut down](https://discuss.elastic.co/t/elasticsearch-net-search-gets-really-slow-when-one-of-three-nodes-are-shut-down/281855)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-net-search-gets-really-slow-when-one-of-three-nodes-are-shut-down/281855 "2021-08-18T15:52:09Z")
Hi! I have a three node cluster on a 7.11.1 Elastic and then I have a .net website doing searches against the index. Everything works just fine but when I shut down one node the search takes about 60 seconds. It feels l… --- ## [Date Histogram Aggregation with predefined number of buckets possible?](https://discuss.elastic.co/t/date-histogram-aggregation-with-predefined-number-of-buckets-possible/281880)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:03am UTC](https://discuss.elastic.co/t/date-histogram-aggregation-with-predefined-number-of-buckets-possible/281880 "2021-08-25T10:03:22Z")
I would like to get an aggregation to build a histogram off of a date field, but I would like to predefine the EXACT number of buckets to use. So for example if I have data indexed for June 1st and I ask for 10 buckets … --- ## [Wordpress installation with elasticsearch](https://discuss.elastic.co/t/wordpress-installation-with-elasticsearch/281907)
**Author:** [@Arman\_Ali\_Fokir](https://discuss.elastic.co/u/Arman_Ali_Fokir)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:02am UTC](https://discuss.elastic.co/t/wordpress-installation-with-elasticsearch/281907 "2021-08-25T10:02:20Z")
Sir, I create an elastic search cluster using three nodes. There I set up a master node. Now my question is where do I install the WordPress website? Should I install websites on master nodes or data nodes or all nodes… --- ## [Create an index if not exist and add a document to it](https://discuss.elastic.co/t/create-an-index-if-not-exist-and-add-a-document-to-it/281945)
**Author:** [@ChenChuang](https://discuss.elastic.co/u/ChenChuang)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:00am UTC](https://discuss.elastic.co/t/create-an-index-if-not-exist-and-add-a-document-to-it/281945 "2021-08-25T10:00:15Z")
I tried to dynamically create an index (if not exist) with static mapping, then added a document to it immediately. After that, I checked mapping of the index and found that the mapping is not what I described in request… --- ## [Isochrone visualization in kibana](https://discuss.elastic.co/t/isochrone-visualization-in-kibana/282455)
**Author:** [@marrel](https://discuss.elastic.co/u/marrel)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 9:55am UTC](https://discuss.elastic.co/t/isochrone-visualization-in-kibana/282455 "2021-08-25T09:55:10Z")
Hi! I am wondering if there is any way to create isochrone visualization in Kibana as the following screenshot: I want to use traveltime data and plot them like the above visualization. Any advice would be valuable.… --- ## [Filter on 2 indices](https://discuss.elastic.co/t/filter-on-2-indices/282098)
**Author:** [@dgastudio](https://discuss.elastic.co/u/dgastudio)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 9:51am UTC](https://discuss.elastic.co/t/filter-on-2-indices/282098 "2021-08-25T09:51:48Z")
Hello! i have 2 indices, users and employee\_shift users "created": "1618153891", "changed": null, "uuid": "", "uid:uuid": "1629cbdf-e7fa-41e6-b3a2-ab29a1a77401", "acc": 57, "name": "spashogolut", "role": "Genera… --- ## [Search by datetime range query](https://discuss.elastic.co/t/search-by-datetime-range-query/282463)
**Author:** [@rehannali](https://discuss.elastic.co/u/rehannali)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 9:51am UTC](https://discuss.elastic.co/t/search-by-datetime-range-query/282463 "2021-08-25T09:51:21Z")
Hi, I have issue related to search through datetime range query. I tried to search some data which is oldest after a certain period. I read documentation and try to make query and I'm unable to get any of the data. GET … --- ## [ElasticSearch adjacent words for nested queries](https://discuss.elastic.co/t/elasticsearch-adjacent-words-for-nested-queries/282242)
**Author:** [@Loreto\_Parisi1](https://discuss.elastic.co/u/Loreto_Parisi1)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 9:46am UTC](https://discuss.elastic.co/t/elasticsearch-adjacent-words-for-nested-queries/282242 "2021-08-25T09:46:17Z")
I'm using ES 7.14/Kibana 7.10, I have to search for adjacent words (any order), hence I'm using this query: { "query":{ "bool":{ "must":\[ { "query\_string":{ "… --- ## [Metricbeat Timeout Errors while scraping state metricset from kube-state-mertics](https://discuss.elastic.co/t/metricbeat-timeout-errors-while-scraping-state-metricset-from-kube-state-mertics/281931)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 9:37am UTC](https://discuss.elastic.co/t/metricbeat-timeout-errors-while-scraping-state-metricset-from-kube-state-mertics/281931 "2021-08-25T09:37:13Z")
I am running metricbeat deployment and daemonset using elasticsearch helm chart. In my metricbeat deployment I am collecting state metrics from the kube-state-metrics API from an openshift cluster and experience followin… --- ## [Failed to add condition to grok processor](https://discuss.elastic.co/t/failed-to-add-condition-to-grok-processor/281017)
**Author:** [@Alaxwora](https://discuss.elastic.co/u/Alaxwora)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 9:25am UTC](https://discuss.elastic.co/t/failed-to-add-condition-to-grok-processor/281017 "2021-08-25T09:25:33Z")
Hello, I was trying to add a condition to grok processor based on 'log.file.path' index if the path contains 'Message Tracking' execute the processor if not exit but it always showing Unable to create Pipeline condit… --- ## [Winlogbeat logs filtering in Logstash for storage management and relevant info to elastic](https://discuss.elastic.co/t/winlogbeat-logs-filtering-in-logstash-for-storage-management-and-relevant-info-to-elastic/282218)
**Author:** [@Rojal\_Paul](https://discuss.elastic.co/u/Rojal_Paul)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 9:25am UTC](https://discuss.elastic.co/t/winlogbeat-logs-filtering-in-logstash-for-storage-management-and-relevant-info-to-elastic/282218 "2021-08-25T09:25:14Z")
I want to know the problem with my configuration. I want to reduce the windows logs saved in Logstash by sending relevant info such as warnings, errors. For now, it's taking a huge amount of data for storing all wind… --- ## [Using aggregation in anomaly detection jobs](https://discuss.elastic.co/t/using-aggregation-in-anomaly-detection-jobs/282237)
**Author:** [@one](https://discuss.elastic.co/u/one)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 9:06am UTC](https://discuss.elastic.co/t/using-aggregation-in-anomaly-detection-jobs/282237 "2021-08-25T09:06:51Z")
I guess I did not understand the use of aggregation in anomaly detection. I was expecting that the same aggregation with different time intervals will not affect the results, however, it seems that this is not the case. … --- ## [If else in logstash throwin error](https://discuss.elastic.co/t/if-else-in-logstash-throwin-error/282436)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 9:06am UTC](https://discuss.elastic.co/t/if-else-in-logstash-throwin-error/282436 "2021-08-25T09:06:20Z")
Below is my logstash configuration file output { if "%{\[fields\]\[myvalue1\]}" == "value" and "%{\[fields\]\[myvalue2\]}" == "valu" { hosts =\> \["https://es1:9200","https://es2:9200","https://es3:9200"\] ilm\_enabled =\> … --- ## [Filebeat high CPU usage during reading a huge file](https://discuss.elastic.co/t/filebeat-high-cpu-usage-during-reading-a-huge-file/282363)
**Author:** [@arberg](https://discuss.elastic.co/u/arberg)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 2:35pm UTC](https://discuss.elastic.co/t/filebeat-high-cpu-usage-during-reading-a-huge-file/282363 "2021-08-24T14:35:01Z")
Hello fellow ELKstackers, Filebeat (6.3.1 on x64 old RedHat) runs with very high CPU when has been behind and needs to read some large log-files. It used 100% of 1/8 cpus (top said around 100%). After it was done proces… --- ## [Cant activate xpack on kibana 7.10'](https://discuss.elastic.co/t/cant-activate-xpack-on-kibana-7-10/282450)
**Author:** [@sebib](https://discuss.elastic.co/u/sebib)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 8:26am UTC](https://discuss.elastic.co/t/cant-activate-xpack-on-kibana-7-10/282450 "2021-08-25T08:26:08Z")
Hey there! Im trying to deploy kibana within google kubernetes engine. When not setting xpack.security.enabled: true, everything works fine. As I would like to have a login page and user administration, I need to set … --- ## [Logstash not parse winlogbeat new version](https://discuss.elastic.co/t/logstash-not-parse-winlogbeat-new-version/282456)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 0\ **Last updated:** [August 25, 2021, 7:49am UTC](https://discuss.elastic.co/t/logstash-not-parse-winlogbeat-new-version/282456 "2021-08-25T07:49:22Z")
There is create two fields and divided value version wies. Then i want to FileVersion field is remove --- ## [Determining 'size' in \[\_source \] \[includes\] query](https://discuss.elastic.co/t/determining-size-in-source-includes-query/282451)
**Author:** [@clawrencia](https://discuss.elastic.co/u/clawrencia)\ **Replies:** 8\ **Last updated:** [August 25, 2021, 7:41am UTC](https://discuss.elastic.co/t/determining-size-in-source-includes-query/282451 "2021-08-25T07:41:04Z")
Hi guys, I am just wondering if it possible to set the size for a particular field when we query. The following here is my query. (Apologies for the mess, the query is done in the python elasticsearch API). GET /index\_… --- ## [Reporting Kibana login/logout](https://discuss.elastic.co/t/reporting-kibana-login-logout/282334)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 4\ **Last updated:** [August 25, 2021, 7:15am UTC](https://discuss.elastic.co/t/reporting-kibana-login-logout/282334 "2021-08-25T07:15:07Z")
Hi, Today, i've to administer the Kibana activity. What is the way to generate Kibana connections report ? I don't find any data in kibana logs ! (Kibana version 6.8.3) Thanks all --- ## [Control list](https://discuss.elastic.co/t/control-list/282248)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 4\ **Last updated:** [August 25, 2021, 7:09am UTC](https://discuss.elastic.co/t/control-list/282248 "2021-08-25T07:09:32Z")
Hello, I am using control option list to search the client name. I am having approximately 2500 different clients and changes regularly, i cant able to find some of the client and by using lucene query, i can find it e… --- ## [Rename host](https://discuss.elastic.co/t/rename-host/282356)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 5\ **Last updated:** [August 25, 2021, 7:05am UTC](https://discuss.elastic.co/t/rename-host/282356 "2021-08-25T07:05:57Z")
I have a number of hostnames which are pretty generic. Is there any way to change these when displaying in Kibana? E.g. Server01 to be changed to UK\_WebSever\_01 Any ideas? --- ## [Logstash 7.9 JDBC- Oracle input - Session closing](https://discuss.elastic.co/t/logstash-7-9-jdbc-oracle-input-session-closing/282452)
**Author:** [@Prashant\_Achari](https://discuss.elastic.co/u/Prashant_Achari)\ **Replies:** 0\ **Last updated:** [August 25, 2021, 7:01am UTC](https://discuss.elastic.co/t/logstash-7-9-jdbc-oracle-input-session-closing/282452 "2021-08-25T07:01:58Z")
We have an scenario where we are connecting to oracle db for getting db stats using JDBC / Logstash. In some cases oracle db connection are not closed after query execution. These session are seen in long running sess… --- ## [Kibana Dashboards](https://discuss.elastic.co/t/kibana-dashboards/281886)
**Author:** [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 6:40am UTC](https://discuss.elastic.co/t/kibana-dashboards/281886 "2021-08-25T06:40:22Z")
Hi there I am new with these tool. I have 3 fields, fecha (@timestanp), transactions and services. I don´t know how to build a dashborboard counting by transactions and SUM the services using the HOUR of the @timesta… [Previous page](https://discuss.elastic.co/latest.md?page=1508) [Next page](https://discuss.elastic.co/latest.md?page=1510)