# Latest **URL:** https://discuss.elastic.co/latest.md?page=1517 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1518 --- ## [Metricbeat ZFS capture volume size](https://discuss.elastic.co/t/metricbeat-zfs-capture-volume-size/282012)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 9:26pm UTC](https://discuss.elastic.co/t/metricbeat-zfs-capture-volume-size/282012 "2021-08-19T21:26:10Z")
After a few hours I've been unable to get Metricbeat to read ZFS stats. It looks like GitHub - maireanu/zfsbeat has gone stale as the last work was 2 years ago. Seeing as ZFS is nodev in /proc/filesystems the default f… --- ## [Extration query for each item that has timestamps in each of the last three days](https://discuss.elastic.co/t/extration-query-for-each-item-that-has-timestamps-in-each-of-the-last-three-days/282011)
**Author:** [@Scott\_S](https://discuss.elastic.co/u/Scott_S)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 9:20pm UTC](https://discuss.elastic.co/t/extration-query-for-each-item-that-has-timestamps-in-each-of-the-last-three-days/282011 "2021-08-19T21:20:51Z")
I'm trying to write an extraction query to get every timestamp for all items only if the item has timestamps in each of the last three days. For context, what I'm doing is tracking tests - if they've executed in each of … --- ## [How to customize Maps plugin in kibana?](https://discuss.elastic.co/t/how-to-customize-maps-plugin-in-kibana/281644)
**Author:** [@WhatsIsKibana](https://discuss.elastic.co/u/WhatsIsKibana)\ **Replies:** 6\ **Last updated:** [August 19, 2021, 8:22pm UTC](https://discuss.elastic.co/t/how-to-customize-maps-plugin-in-kibana/281644 "2021-08-19T20:22:27Z")
Hi, I want to customize Maps plugin in kibana, but I can't find where sources are located. I mean this Maps plugin Looks like it is already pre-build and combined into one file in built\_assets/dlls folder. Is there … --- ## [Timezone logstash date filter](https://discuss.elastic.co/t/timezone-logstash-date-filter/281791)
**Author:** [@Bigbad](https://discuss.elastic.co/u/Bigbad)\ **Replies:** 4\ **Last updated:** [August 19, 2021, 6:25pm UTC](https://discuss.elastic.co/t/timezone-logstash-date-filter/281791 "2021-08-19T18:25:50Z")
Hello, I want to have another date field in Europe/Paris timezone with logstash date filter. filter { mutate { add\_field =\>{ "my\_date" =\> "%{@timestamp}" } } date { match =\> \["my\_date", "yyyy-… --- ## [Use azure active directory with NEST/Elasticsearch.net](https://discuss.elastic.co/t/use-azure-active-directory-with-nest-elasticsearch-net/280893)
**Author:** [@Abhishek\_Tripathi](https://discuss.elastic.co/u/Abhishek_Tripathi)\ **Replies:** 5\ **Last updated:** [August 19, 2021, 6:23pm UTC](https://discuss.elastic.co/t/use-azure-active-directory-with-nest-elasticsearch-net/280893 "2021-08-19T18:23:52Z")
We are working on a project where we are authenticating users with Azure Active Directory. Upon the successful authentication, the user's browsers receive an Id and Access token, and then we use the same access token to … --- ## [Bool From JDBC](https://discuss.elastic.co/t/bool-from-jdbc/280850)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 6:22pm UTC](https://discuss.elastic.co/t/bool-from-jdbc/280850 "2021-08-19T18:22:02Z")
Is it possible to query a SQL database and, if the results have a column value matching a given string, return a boolean? I am wanting to query a table whose results will return multiple rows. I want to check the colum… --- ## [Is there a way to deploy a custom logstash input when using Elastic Cloud?](https://discuss.elastic.co/t/is-there-a-way-to-deploy-a-custom-logstash-input-when-using-elastic-cloud/281874)
**Author:** [@Mrc0113](https://discuss.elastic.co/u/Mrc0113)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 5:17pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-deploy-a-custom-logstash-input-when-using-elastic-cloud/281874 "2021-08-19T17:17:52Z")
Is there a way to deploy a custom logstash input when using Elastic Cloud? I would like to be able to ingest messages into Elasticsearch from a Solace Event Broker. Options would be via MQTT, JMS or a custom Solace (SMF)… --- ## [RUM agent for angular application not capturing page clicks events](https://discuss.elastic.co/t/rum-agent-for-angular-application-not-capturing-page-clicks-events/281525)
**Author:** [@pathfinder225](https://discuss.elastic.co/u/pathfinder225)\ **Replies:** 5\ **Last updated:** [August 19, 2021, 5:02pm UTC](https://discuss.elastic.co/t/rum-agent-for-angular-application-not-capturing-page-clicks-events/281525 "2021-08-19T17:02:49Z")
Hi We are trying out RUM agent for our angular web application Angular 10 applicaiton configured by adding script tag in the index.html of our SPA. We are checking the metrics being recorded and noticed that total page… --- ## [Kibana Stack Managent Built-In Alerts Missing](https://discuss.elastic.co/t/kibana-stack-managent-built-in-alerts-missing/280088)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 5\ **Last updated:** [August 19, 2021, 5:02pm UTC](https://discuss.elastic.co/t/kibana-stack-managent-built-in-alerts-missing/280088 "2021-08-19T17:02:37Z")
We are in the process of migrating to a new cluster, and I noticed on the new cluster that Stack Monitoring in Kibana is missing the default alert rules in the Space I would like to configure Actions for them. I do see t… --- ## [Elastic Endpoint Windows Event Log - Security Channel](https://discuss.elastic.co/t/elastic-endpoint-windows-event-log-security-channel/281993)
**Author:** [@mikemitchell](https://discuss.elastic.co/u/mikemitchell)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 5:02pm UTC](https://discuss.elastic.co/t/elastic-endpoint-windows-event-log-security-channel/281993 "2021-08-19T17:02:14Z")
Does the Elastic Security Windows Integration or the Endpoint Integration not have the ability to pull from the Security channel of Windows Event Logs? I had to create a new Custom channel to pull in security events fro… --- ## [Show more categories Y-axis in the vega plot](https://discuss.elastic.co/t/show-more-categories-y-axis-in-the-vega-plot/279895)
**Author:** [@Nanelastic](https://discuss.elastic.co/u/Nanelastic)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 4:52pm UTC](https://discuss.elastic.co/t/show-more-categories-y-axis-in-the-vega-plot/279895 "2021-08-19T16:52:18Z")
I have the written custom code for boxplots. On Y axis I have categories of type "nominal" and on X axis I have values which are type "Quantitative" I have a total of 100 categories and I want to display all the categor… --- ## [How To Perform Certain Operations If Filter Is Not Exist in Vega Visualisation](https://discuss.elastic.co/t/how-to-perform-certain-operations-if-filter-is-not-exist-in-vega-visualisation/279866)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 4:40pm UTC](https://discuss.elastic.co/t/how-to-perform-certain-operations-if-filter-is-not-exist-in-vega-visualisation/279866 "2021-08-19T16:40:54Z")
Is it possible to code Vega in such a way as to perform certain operations if filter is not applied? objective: if the filter is applied, then perform code given below, if filter is not applied then perform sum of a dif… --- ## [Limits?](https://discuss.elastic.co/t/limits/281505)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 8\ **Last updated:** [August 19, 2021, 4:28pm UTC](https://discuss.elastic.co/t/limits/281505 "2021-08-19T16:28:58Z")
App Search has this handy page describing the limits Do these same limits apply to Workplace Search? If not, is there a document like this explaining the limits for Workplace Search? --- ## [Customization in Data table](https://discuss.elastic.co/t/customization-in-data-table/281162)
**Author:** [@Mathu](https://discuss.elastic.co/u/Mathu)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 4:28pm UTC](https://discuss.elastic.co/t/customization-in-data-table/281162 "2021-08-19T16:28:10Z")
Hi, Is it possible to achieve these dots in table based on a condition (eg:\>50 -green, \<50 -Red) through vega or any other feature? --- ## [Yarn build fails](https://discuss.elastic.co/t/yarn-build-fails/281849)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 6\ **Last updated:** [August 19, 2021, 3:59pm UTC](https://discuss.elastic.co/t/yarn-build-fails/281849 "2021-08-19T15:59:08Z")
Hello there, I am trying to build archive for my custom plugin. I am following the process in the link below. So, I generated the plugin with the generate\_plugin script but then it says that in order to use my plugin… --- ## [This site can’t provide a secure connection (URGENT)](https://discuss.elastic.co/t/this-site-can-t-provide-a-secure-connection-urgent/281988)
**Author:** [@shenzam](https://discuss.elastic.co/u/shenzam)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 3:47pm UTC](https://discuss.elastic.co/t/this-site-can-t-provide-a-secure-connection-urgent/281988 "2021-08-19T15:47:08Z")
Hi firend, earlier, i am able to access elasticsearch with port 9200. However in my docker compose i change the port mappong. After change i am hitting below error 192.168.1.108 didn’t accept your login certificate, or … --- ## [Grok Pattern](https://discuss.elastic.co/t/grok-pattern/281878)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 4\ **Last updated:** [August 19, 2021, 2:54pm UTC](https://discuss.elastic.co/t/grok-pattern/281878 "2021-08-19T14:54:53Z")
What is the correct syntax to incorporate raw regex expressions in between grok patterns? Ex (Cisco device): LOG: Aug 1 22:15:10 abc-hostname tcp GROK pattern: %{CISCOTIMESTAMP:timestamp} \\b\\w+-\\w+\\b %{WORD:protocol} … --- ## [Exporting & Importing Saved objects across different kibana versions](https://discuss.elastic.co/t/exporting-importing-saved-objects-across-different-kibana-versions/281968)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 2:53pm UTC](https://discuss.elastic.co/t/exporting-importing-saved-objects-across-different-kibana-versions/281968 "2021-08-19T14:53:20Z")
Hi all, I'm trying to export saved objects from 7.10 to kibana 7.9 version. But it is giving error saying :thinking: " Sorry, there was an error The file could not be processed." Someone told that we cannot import s… --- ## [Drilldown is not working with Visualization](https://discuss.elastic.co/t/drilldown-is-not-working-with-visualization/281925)
**Author:** [@Srinivas25](https://discuss.elastic.co/u/Srinivas25)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 8:44am UTC](https://discuss.elastic.co/t/drilldown-is-not-working-with-visualization/281925 "2021-08-19T08:44:10Z")
We are using v 7.10.2, Created a visualization - line chart based on ActionName.Keyword field Made the same field as URL and linked it with URL of above visualization Created a search on that field. finally added the s… --- ## [Collapse within top hit aggregation results](https://discuss.elastic.co/t/collapse-within-top-hit-aggregation-results/281977)
**Author:** [@bhimawan](https://discuss.elastic.co/u/bhimawan)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 2:03pm UTC](https://discuss.elastic.co/t/collapse-within-top-hit-aggregation-results/281977 "2021-08-19T14:03:33Z")
I'm trying to do this (two level collapse) but with top\_hits aggregation. Essentially I want to be able to have a collapse inside of the top\_hits aggregation but it's not supported. Is there any way to make this w… --- ## [Custom transactions in checkout process](https://discuss.elastic.co/t/custom-transactions-in-checkout-process/281970)
**Author:** [@anjaneyulu\_nagineni](https://discuss.elastic.co/u/anjaneyulu_nagineni)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 1:20pm UTC](https://discuss.elastic.co/t/custom-transactions-in-checkout-process/281970 "2021-08-19T13:20:15Z")
I have a checkout with different steps, each step i want to send some custom data to apm server which we can do with transactions, spans and add additional data using add labels to the span but the question is when shoul… --- ## [Okta filebeat module ingest pipeline not running](https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917)
**Author:** [@LiamSennitt](https://discuss.elastic.co/u/LiamSennitt)\ **Replies:** 3\ **Last updated:** [August 19, 2021, 1:39pm UTC](https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917 "2021-08-19T13:39:08Z")
The Okta filebeat module doesn't appear to be executing the ingest pipeline as expected and returns events in the structure below. { "@timestamp": "", "@metadata": { "beat": "filebeat", "type": "\_doc… --- ## [Upgrading an elastic-agent behind a proxy fails](https://discuss.elastic.co/t/upgrading-an-elastic-agent-behind-a-proxy-fails/281780)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 1:30pm UTC](https://discuss.elastic.co/t/upgrading-an-elastic-agent-behind-a-proxy-fails/281780 "2021-08-19T13:30:41Z")
Hi , I try to upgrade an elastic-agent behind a proxy, but fail: 09:15:49.883 elastic\_agent \[elastic\_agent\]\[error\] 2021-08-18T09:15:49+02:00 - message: Application: \[e4cf95ba-8c94-417d-a25e-2afe0a1e02b6\]: State changed… --- ## [Fleet Synthetics 7.14 - pipeline with id \[synthetics-http-0.2.1\] does not exist](https://discuss.elastic.co/t/fleet-synthetics-7-14-pipeline-with-id-synthetics-http-0-2-1-does-not-exist/281036)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 6\ **Last updated:** [August 19, 2021, 1:27pm UTC](https://discuss.elastic.co/t/fleet-synthetics-7-14-pipeline-with-id-synthetics-http-0-2-1-does-not-exist/281036 "2021-08-19T13:27:36Z")
Using Fleet 7.14 and after upgrading the Integration - Elastic Synthetics, i cannot see any http Monitors and when i look at the Elastic-Agent logs, i get the following message that it cannot index the document because a… --- ## [TLS... WARN secure connection disabled talk to server... ERROR Get "http://192.168.0.101:9200": EOF](https://discuss.elastic.co/t/tls-warn-secure-connection-disabled-talk-to-server-error-get-http-192-168-0-101-9200-eof/281969)
**Author:** [@Dubey\_Ravi\_vinod](https://discuss.elastic.co/u/Dubey_Ravi_vinod)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 1:17pm UTC](https://discuss.elastic.co/t/tls-warn-secure-connection-disabled-talk-to-server-error-get-http-192-168-0-101-9200-eof/281969 "2021-08-19T13:17:18Z")
Getting this error, while configuration of winlogbeat. winlogbeat.yml winlogbeat.event\_logs: - name: Application ignore\_older: 72h - name: System - name: Security processors: - script: … --- ## [Logstash elapsed filter plugin: can't connect start and end events](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927)
**Author:** [@alexandrpaliy](https://discuss.elastic.co/u/alexandrpaliy)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 1:26pm UTC](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927 "2021-08-19T13:26:56Z")
Hi. Currently, my logstash filter looks something like this: filter { if ('text1' in \[message\]) { grok { ... add\_tag =\> \[ "connection\_established" \] } aggregate { ... } elapsed… --- ## [Remove fields with specific prefix at the end of LogStash pipeline](https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 1:23pm UTC](https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911 "2021-08-19T13:23:49Z")
Hello, how to remove children fields with specific prefix at the end of LogStash pipeline? parent.level2.level3.removewiththisprefix\_1, parent.level2.level3.removewiththisprefix\_2,... parent.level2.level3.removewiththi… --- ## [Filebeat god restart](https://discuss.elastic.co/t/filebeat-god-restart/281723)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 7\ **Last updated:** [August 19, 2021, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723 "2021-08-19T13:21:47Z")
I want to restart an old Filebeat service after modifying its output. This is the result of ps -eaf | grep filebeat: root 6405 1 0 2020 ? 00:00:00 /usr/share/filebeat/bin/filebeat-god -r / -n -p /var/… --- ## [Grok patter to remove trailing milliseconds](https://discuss.elastic.co/t/grok-patter-to-remove-trailing-milliseconds/281643)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 1:14pm UTC](https://discuss.elastic.co/t/grok-patter-to-remove-trailing-milliseconds/281643 "2021-08-19T13:14:14Z")
Two record formats that start a multiline event, what grok statement might I use to keep the milliseconds and set the time as the @timestamp field? Maybe I have to drop the milliseconds? Thank you 23:29:53.425: Sendi… --- ## [Does filebeats import MongoDB collections to ES?](https://discuss.elastic.co/t/does-filebeats-import-mongodb-collections-to-es/281965)
**Author:** [@evo](https://discuss.elastic.co/u/evo)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 1:00pm UTC](https://discuss.elastic.co/t/does-filebeats-import-mongodb-collections-to-es/281965 "2021-08-19T13:00:08Z")
Hi, Sorry for the basic question but I am finding the docs a bit confusing. I am trying to create an ES search index for a large (1TB) mongodb and I am trying to find out how to do that. I cam across filebeat and saw … [Previous page](https://discuss.elastic.co/latest.md?page=1516) [Next page](https://discuss.elastic.co/latest.md?page=1518)