# Latest **URL:** https://discuss.elastic.co/latest.md?page=1524 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1525 --- ## [How does everyone feel about Amazon's prerolled ES service and how they have forked Elasticsearch?](https://discuss.elastic.co/t/how-does-everyone-feel-about-amazons-prerolled-es-service-and-how-they-have-forked-elasticsearch/281417)
**Author:** [@Jason\_Baumgartner](https://discuss.elastic.co/u/Jason_Baumgartner)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 9:02pm UTC](https://discuss.elastic.co/t/how-does-everyone-feel-about-amazons-prerolled-es-service-and-how-they-have-forked-elasticsearch/281417 "2021-08-16T21:02:49Z")
First, I wanted to get other's opinions on Amazon's Elasticsearch service. While they do provide some nice features like nightly snapshots, etc. -- I'm discovering each day more annoying issues with their service. There… --- ## [Xpack: How to clean monitoring-es-7\*?](https://discuss.elastic.co/t/xpack-how-to-clean-monitoring-es-7/281267)
**Author:** [@Ajordao](https://discuss.elastic.co/u/Ajordao)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 8:47pm UTC](https://discuss.elastic.co/t/xpack-how-to-clean-monitoring-es-7/281267 "2021-08-16T20:47:06Z")
Hi, everyone! I'm beginner in ES, but I already have some tasks to be accomplished. I have two deploys in Elastic's Cloud, one of them is to stored monitoring data (Deploy 2). I can't understand the reason why for the … --- ## [Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/281521)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 7:42pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/281521 "2021-08-16T19:42:47Z")
Third attempt to escalate this... Can someone please verify and confirm this bug? Same issue in 7.13.1.. Willem --- ## [Update a field if it does not contain any value](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565)
**Author:** [@Derya\_Sayar](https://discuss.elastic.co/u/Derya_Sayar)\ **Replies:** 5\ **Last updated:** [August 16, 2021, 7:34pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565 "2021-08-16T19:34:02Z")
I have log files generated from some applications. Some of applications produces messages in following format. So there is "logContent" in message field. {"instant":{"epochSecond":1628692763,"nanoOfSecond":792000000},"t… --- ## [Master not discovered in the bootstrap cluster](https://discuss.elastic.co/t/master-not-discovered-in-the-bootstrap-cluster/281586)
**Author:** [@kadiveti](https://discuss.elastic.co/u/kadiveti)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 7:24pm UTC](https://discuss.elastic.co/t/master-not-discovered-in-the-bootstrap-cluster/281586 "2021-08-16T19:24:40Z")
Hello All, I tried to set up a simple 3 node elastic cluster. I tried almost the same setup 10 times. Every I see a new issue will come up when setting this. Every time I create this setup from Azure and delete the set… --- ## [Saving y laptop](https://discuss.elastic.co/t/saving-y-laptop/281577)
**Author:** [@testingHackerone](https://discuss.elastic.co/u/testingHackerone)\ **Replies:** 0\ **Last updated:** [August 16, 2021, 5:16pm UTC](https://discuss.elastic.co/t/saving-y-laptop/281577 "2021-08-16T17:16:49Z")
cool --- ## [Failed to execute watch - Timeout waiting for task](https://discuss.elastic.co/t/failed-to-execute-watch-timeout-waiting-for-task/280256)
**Author:** [@Brandon\_Sollins](https://discuss.elastic.co/u/Brandon_Sollins)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 6:22pm UTC](https://discuss.elastic.co/t/failed-to-execute-watch-timeout-waiting-for-task/280256 "2021-08-16T18:22:37Z")
I am noticing random watch timeouts on my cluster that is returning the following traceback: \[2021-07-31T05:08:11,951\]\[DEBUG\]\[o.e.x.w.e.ExecutionService\] failed to execute watch \[\\] org.elasti… --- ## [Elastic Cloud Enterprise: Run deployments on specific drives](https://discuss.elastic.co/t/elastic-cloud-enterprise-run-deployments-on-specific-drives/281579)
**Author:** [@Thomas\_Vaudry-Read](https://discuss.elastic.co/u/Thomas_Vaudry-Read)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 5:33pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-run-deployments-on-specific-drives/281579 "2021-08-16T17:33:56Z")
I am working on setting up Elastic Cloud Enterprise in various different configurations, and my newest question is about how to specify which drive to store data in depending on the tier of the data. I have a machine wi… --- ## [Export to CSV shows blank fields](https://discuss.elastic.co/t/export-to-csv-shows-blank-fields/280357)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 3\ **Last updated:** [August 16, 2021, 4:25pm UTC](https://discuss.elastic.co/t/export-to-csv-shows-blank-fields/280357 "2021-08-16T16:25:36Z")
Hi , I have a saved object in Kibana. When I run this object I get the results I want, it shows all the information for the columns proposed. However when I export it to CSV alot of the columns are blank? I have opened… --- ## [Add agent wrong documentation](https://discuss.elastic.co/t/add-agent-wrong-documentation/281512)
**Author:** [@Lucas\_Van\_den\_Abbeel](https://discuss.elastic.co/u/Lucas_Van_den_Abbeel)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 4:10pm UTC](https://discuss.elastic.co/t/add-agent-wrong-documentation/281512 "2021-08-16T16:10:03Z")
./elastic-agent install -f --kibana-url=xxxx --enrollment-token=xxxxx is not working unknown flag: --kibana-url --- ## [Поиск по нескольким полям с вхождением части строки или полной строки в разных полях](https://discuss.elastic.co/t/topic/281513)
**Author:** [@vitaliy\_sheverov](https://discuss.elastic.co/u/vitaliy_sheverov)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 3:37pm UTC](https://discuss.elastic.co/t/topic/281513 "2021-08-16T15:37:41Z")
Добрый день, помогите пожалуйста составить запрос Мне нужно чтобы, поиск сначала находил хотя бы по одному слову в каждом поле, если найдет все слова в одном поле, тоже подходит. В данном случае меня интересует только Т… --- ## [Create new field "Year" from a complete date](https://discuss.elastic.co/t/create-new-field-year-from-a-complete-date/281332)
**Author:** [@Raptoresse](https://discuss.elastic.co/u/Raptoresse)\ **Replies:** 3\ **Last updated:** [August 16, 2021, 3:13pm UTC](https://discuss.elastic.co/t/create-new-field-year-from-a-complete-date/281332 "2021-08-16T15:13:29Z")
Hi everybody ! I have a probleme : I have a field "date". I want to select juste the year, and create a vizualisation "controls" type (Add dropdown menus and range sliders to your dashboard) with the new field. For thi… --- ## [Logstash ip protocol enriching](https://discuss.elastic.co/t/logstash-ip-protocol-enriching/281496)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 3:07pm UTC](https://discuss.elastic.co/t/logstash-ip-protocol-enriching/281496 "2021-08-16T15:07:42Z")
Hello community. I was busy with the task of collecting netflow using logstash. So I noticed that the netflow data after the "netflow" codec contains the "protocol" field, which is actually the protocol number. But there… --- ## [Simple Central log monitoring with ELK](https://discuss.elastic.co/t/simple-central-log-monitoring-with-elk/280488)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 20\ **Last updated:** [August 16, 2021, 2:32pm UTC](https://discuss.elastic.co/t/simple-central-log-monitoring-with-elk/280488 "2021-08-16T14:32:49Z")
Need to ship my servers logs (Linux system logs " /var/logs/\*" and windows server logs) to logstash to ELK and display in KIbana dash board. Please guide to perform this task. --- ## [Where is the object mapping for \[host\] defined?](https://discuss.elastic.co/t/where-is-the-object-mapping-for-host-defined/281541)
**Author:** [@antoineco](https://discuss.elastic.co/u/antoineco)\ **Replies:** 14\ **Last updated:** [August 16, 2021, 2:26pm UTC](https://discuss.elastic.co/t/where-is-the-object-mapping-for-host-defined/281541 "2021-08-16T14:26:42Z")
Context Since the release of Elastic v8.0.0 (alpha), the elasticsearch output of Logstash started throwing the following error, even on a fresh installation: object mapping for \[host\] tried to parse field \[host\] as obj… --- ## [Logstash extract additional fields from message field of Json](https://discuss.elastic.co/t/logstash-extract-additional-fields-from-message-field-of-json/281373)
**Author:** [@Derya\_Sayar](https://discuss.elastic.co/u/Derya_Sayar)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 2:18pm UTC](https://discuss.elastic.co/t/logstash-extract-additional-fields-from-message-field-of-json/281373 "2021-08-16T14:18:15Z")
I have logs files with json format.Here you can find single line of log. {"instant":{"epochSecond":1628692763,"nanoOfSecond":792000000},"thread":"AWT-EventQueue-0","level":"INFO","loggerName":"com.client.logon… --- ## [Parse Logstash message field into multiple field](https://discuss.elastic.co/t/parse-logstash-message-field-into-multiple-field/281425)
**Author:** [@buulq90](https://discuss.elastic.co/u/buulq90)\ **Replies:** 8\ **Last updated:** [August 16, 2021, 2:13pm UTC](https://discuss.elastic.co/t/parse-logstash-message-field-into-multiple-field/281425 "2021-08-16T14:13:24Z")
Hello all, I'm firstly using log stash and got some issue when parsing the JSON log on the message field into multiple field for visualizing in the Kibana dashboard. Below is my message log appear in Elasticsearch me… --- ## [IPFIX processing Setup plan & queries](https://discuss.elastic.co/t/ipfix-processing-setup-plan-queries/281558)
**Author:** [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Replies:** 0\ **Last updated:** [August 16, 2021, 2:02pm UTC](https://discuss.elastic.co/t/ipfix-processing-setup-plan-queries/281558 "2021-08-16T14:02:11Z")
Hi Everyone, I have few questions reg. processing of IPFIX logs originating from "Thunder CFW | A10 network" exporter. Would not be able to change different network exporter product or any installation in source side si… --- ## [How to sort and aggs the result in nested element](https://discuss.elastic.co/t/how-to-sort-and-aggs-the-result-in-nested-element/281549)
**Author:** [@OmarBO](https://discuss.elastic.co/u/OmarBO)\ **Replies:** 0\ **Last updated:** [August 16, 2021, 1:31pm UTC](https://discuss.elastic.co/t/how-to-sort-and-aggs-the-result-in-nested-element/281549 "2021-08-16T13:31:19Z")
Hello, I'm new to the Elasticsearch and I faced a problem while developing an ES Query. I have an index of reports of patients that every doc is like this one. So each report of one patient { "patient": { "gender… --- ## [Heap Size setting in k8s](https://discuss.elastic.co/t/heap-size-setting-in-k8s/281522)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 3\ **Last updated:** [August 16, 2021, 12:32pm UTC](https://discuss.elastic.co/t/heap-size-setting-in-k8s/281522 "2021-08-16T12:32:42Z")
Hi All, I am trying to setup up elasticsearch(version 6.8.14) on k8s using eck operator. As per the documentation HEAP SIZE should be 50% of RAM. so If set ( requests, limits as 16GB) then ES\_JAVA\_OPTS should be 8 i.… --- ## [Exceptions for Rename Ingest Processor](https://discuss.elastic.co/t/exceptions-for-rename-ingest-processor/281399)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 12:21pm UTC](https://discuss.elastic.co/t/exceptions-for-rename-ingest-processor/281399 "2021-08-16T12:21:25Z")
Hi, I'm trying to create an ingest pipeline to rename fields, if they exist. I see there is an if statement option for the Rename processor, but I'm unsure of how to implement it. I want to do "if" : "ctx.containsKey('… --- ## [Exclude Unicode symbol in Grok pattern](https://discuss.elastic.co/t/exclude-unicode-symbol-in-grok-pattern/280540)
**Author:** [@Avesalon\_Novinsky](https://discuss.elastic.co/u/Avesalon_Novinsky)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 11:59am UTC](https://discuss.elastic.co/t/exclude-unicode-symbol-in-grok-pattern/280540 "2021-08-16T11:59:55Z")
Hi, Is there any option to exclude Unicode symbol from line directly in grok pattern. I'm trying to read json data line by line thought AWS Glue "getSourceWithFormat" method which use grok pattern for string parsing. l… --- ## [Re-create Fleet System Integration Data Streams](https://discuss.elastic.co/t/re-create-fleet-system-integration-data-streams/281443)
**Author:** [@tomukasteris](https://discuss.elastic.co/u/tomukasteris)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 11:45am UTC](https://discuss.elastic.co/t/re-create-fleet-system-integration-data-streams/281443 "2021-08-16T11:45:10Z")
Hello, By mistake did delete System integration Data Streams. How reinstall/re-create missing data streams for System integration? --- ## [Logstash :Config file to parse nested json](https://discuss.elastic.co/t/logstash-config-file-to-parse-nested-json/281528)
**Author:** [@ippo](https://discuss.elastic.co/u/ippo)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 11:26am UTC](https://discuss.elastic.co/t/logstash-config-file-to-parse-nested-json/281528 "2021-08-16T11:26:13Z")
hello i 'm new to elk and i seeking help for my mission. i want to export the data from the log of json file below so that i have visualizations related to the number of successful builds . im trying to remove the fields… --- ## [How to run Elasticsearch 7.10.2 as root user](https://discuss.elastic.co/t/how-to-run-elasticsearch-7-10-2-as-root-user/281354)
**Author:** [@mba](https://discuss.elastic.co/u/mba)\ **Replies:** 7\ **Last updated:** [August 16, 2021, 11:21am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-7-10-2-as-root-user/281354 "2021-08-16T11:21:14Z")
I know we can not run elastic search as root user but still my requirement is to run Elasticsearch 7.10.2 as root user then how to run it ?? --- ## [Match on Ngram field where the words are in order without scripting](https://discuss.elastic.co/t/match-on-ngram-field-where-the-words-are-in-order-without-scripting/281518)
**Author:** [@Ron\_lusha](https://discuss.elastic.co/u/Ron_lusha)\ **Replies:** 0\ **Last updated:** [August 16, 2021, 8:37am UTC](https://discuss.elastic.co/t/match-on-ngram-field-where-the-words-are-in-order-without-scripting/281518 "2021-08-16T08:37:37Z")
Hello, I have a question regarding auto-complete using Ngram search, Im using elasticsearch 7.3, so the new "wildcard" field type is not relevant for me This is my index: PUT ngram\_test { "mappings": { "propertie… --- ## [Trigger In elastic search](https://discuss.elastic.co/t/trigger-in-elastic-search/281458)
**Author:** [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\ **Replies:** 20\ **Last updated:** [August 16, 2021, 10:41am UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458 "2021-08-16T10:41:38Z")
I'm working in startup and I got the task of writing trigger for error logs , but not when i'm using PUT \_watcher/watch/diagnostic\_monitor { "metadata" : { "color" : "red" }, "trigger" : { "schedule" : {… --- ## [Custom logs - Newly added log path not harvested](https://discuss.elastic.co/t/custom-logs-newly-added-log-path-not-harvested/278341)
**Author:** [@bravo](https://discuss.elastic.co/u/bravo)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 9:24am UTC](https://discuss.elastic.co/t/custom-logs-newly-added-log-path-not-harvested/278341 "2021-08-16T09:24:53Z")
Fleet has been a saviour and a great tool to monitor server and logs easily. Thanks for making such an awesome product. Have an existing custom logs integration and its harvesting files from a path and are being indexed… --- ## [Trigger an alert when Logstash pipeline gets less events than defined in threshold](https://discuss.elastic.co/t/trigger-an-alert-when-logstash-pipeline-gets-less-events-than-defined-in-threshold/281519)
**Author:** [@nemanja](https://discuss.elastic.co/u/nemanja)\ **Replies:** 0\ **Last updated:** [August 16, 2021, 8:49am UTC](https://discuss.elastic.co/t/trigger-an-alert-when-logstash-pipeline-gets-less-events-than-defined-in-threshold/281519 "2021-08-16T08:49:43Z")
Hello, Can we setup Logstash pipeline monitoring, that would for example trigger an alert when the number of events per second drops bellow certain threshold? in Kibana Pipeline Viewer there is nice visual overview on c… --- ## [Nested JSON flattened in Logstash Filter](https://discuss.elastic.co/t/nested-json-flattened-in-logstash-filter/281502)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 8:11am UTC](https://discuss.elastic.co/t/nested-json-flattened-in-logstash-filter/281502 "2021-08-16T08:11:47Z")
Hi, I am able to flatten at fields present in nested JSON excluding 3 fields that are present in double nested JSON. I need to flatten these fields so that I can create viz based on that such as Fields-"quantity", "rate… [Previous page](https://discuss.elastic.co/latest.md?page=1523) [Next page](https://discuss.elastic.co/latest.md?page=1525)