# Latest **URL:** https://discuss.elastic.co/latest.md?page=1546 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1547 --- ## [Winlogbeat Dashbord Setup Error](https://discuss.elastic.co/t/winlogbeat-dashbord-setup-error/279720)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 10\ **Last updated:** [August 2, 2021, 3:43pm UTC](https://discuss.elastic.co/t/winlogbeat-dashbord-setup-error/279720 "2021-08-02T15:43:14Z")
I am trying to setup dashboards, below is the .yml file . # ------------------------------ Logstash Output ------------------------------- output.logstash: # The Logstash hosts hosts: \["172.16.12.18:5044"\] user: "… --- ## [Как правильно работать с полями flattened в Kibana?](https://discuss.elastic.co/t/flattened-kibana/280232)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 3:38pm UTC](https://discuss.elastic.co/t/flattened-kibana/280232 "2021-08-02T15:38:37Z")
Приветствую! Подскажите, как правильно работать с полями flattened в Kibana? Есть ли какая-то возможность подсветки при поиске - как сейчас делается для других полей? Может еще есть какие-то практики, как удобно с ними р… --- ## [APM .net response time mismatch?](https://discuss.elastic.co/t/apm-net-response-time-mismatch/279462)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 2:48pm UTC](https://discuss.elastic.co/t/apm-net-response-time-mismatch/279462 "2021-08-02T14:48:06Z")
Hi, Kibana version: 7.10.2 Elasticsearch version: 7.10.2 APM Server version: 7.10.2 APM Agent language and version: \net5.0\ \ **Author:** [@raoulvdberge](https://discuss.elastic.co/u/raoulvdberge)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 2:26pm UTC](https://discuss.elastic.co/t/elasticsearch-apply-index-templates-at-start-up/279701 "2021-08-02T14:26:24Z") Hi, I was wondering if it's possible to start up Elasticsearch with index templates applied (for example by being defined in a config). We currently have a pod that has Elastic and Logstash containers, and the Logstash… --- ## [Master\_not\_discovered\_exception](https://discuss.elastic.co/t/master-not-discovered-exception/280225)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 1:31pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception/280225 "2021-08-02T13:31:30Z")
I have an elasticsearch cluster with 2 nodes. When I stop elasticsearch instance on master node the other one is not becoming master automatically. It gives the master not discovered exception elasticsearch.yml on node-… --- ## [How to create : Stacked bar chart with negative values](https://discuss.elastic.co/t/how-to-create-stacked-bar-chart-with-negative-values/280169)
**Author:** [@HuongCV](https://discuss.elastic.co/u/HuongCV)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 1:14pm UTC](https://discuss.elastic.co/t/how-to-create-stacked-bar-chart-with-negative-values/280169 "2021-08-02T13:14:40Z")
I want to create a visualization : Stacked bar chart with negative values. Let me know if kibana supports this chart. Thanks --- ## [Standard IIS grok templates can't parse](https://discuss.elastic.co/t/standard-iis-grok-templates-cant-parse/279963)
**Author:** [@dmalchikov](https://discuss.elastic.co/u/dmalchikov)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 1:04pm UTC](https://discuss.elastic.co/t/standard-iis-grok-templates-cant-parse/279963 "2021-08-02T13:04:19Z")
Hi! Can't find a reason... ANy idea? I have errors Provided Grok expressions do not match field value. But it pass if I copy template and data to grokconstructor.appspot.com Standard module IIS template in use (7.13.3) … --- ## [Elasticsearch index not matching stdout test](https://discuss.elastic.co/t/elasticsearch-index-not-matching-stdout-test/280221)
**Author:** [@kgeil](https://discuss.elastic.co/u/kgeil)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 12:56pm UTC](https://discuss.elastic.co/t/elasticsearch-index-not-matching-stdout-test/280221 "2021-08-02T12:56:20Z")
Good morning. I'm currently vexed by a situation with my elastic stack (7.13) and how things are parsing. I am parsing some exported IIS logs, and if I test my config with stdout, things look smashing. When I change m… --- ## [Elastisearch query rule type hits contains only one document](https://discuss.elastic.co/t/elastisearch-query-rule-type-hits-contains-only-one-document/277688)
**Author:** [@bravo](https://discuss.elastic.co/u/bravo)\ **Replies:** 15\ **Last updated:** [August 2, 2021, 12:50pm UTC](https://discuss.elastic.co/t/elastisearch-query-rule-type-hits-contains-only-one-document/277688 "2021-08-02T12:50:23Z")
Rule type: Elastisearch query Connector: Index context.hits always contain only one document, evethough there are multiple documents that match the query at that point in time. Context.value is always 1. Test query (i… --- ## [How to display other \_source fields in a metric aggregation result?](https://discuss.elastic.co/t/how-to-display-other-source-fields-in-a-metric-aggregation-result/280209)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 12:43pm UTC](https://discuss.elastic.co/t/how-to-display-other-source-fields-in-a-metric-aggregation-result/280209 "2021-08-02T12:43:06Z")
Hello, I'm working on ML job documents with the following fields: { "\_index" : ".ml-anomalies-custom-job\_device1", "\_type" : "\_doc", "\_id" : "job\_device1\_model\_forecast\_Gwn4wnoB0F2uUBpmgO6… --- ## [Kibana - Parse Out / Aggregate Total Values Scripted Code](https://discuss.elastic.co/t/kibana-parse-out-aggregate-total-values-scripted-code/272945)
**Author:** [@prohit](https://discuss.elastic.co/u/prohit)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 11:49am UTC](https://discuss.elastic.co/t/kibana-parse-out-aggregate-total-values-scripted-code/272945 "2021-08-02T11:49:08Z")
Hi All, Need help in writing script painless code to parse out/aggregate the "hours worked" in below document. My Kibana Variable Document: \[{"Dateweeklycomments":"2020-04-09T00:00:00.000Z","Name":"Roger Benny","Role":… --- ## [How add custom additinal facet in search ui in frontend](https://discuss.elastic.co/t/how-add-custom-additinal-facet-in-search-ui-in-frontend/280053)
**Author:** [@pradeep14](https://discuss.elastic.co/u/pradeep14)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 11:27am UTC](https://discuss.elastic.co/t/how-add-custom-additinal-facet-in-search-ui-in-frontend/280053 "2021-08-02T11:27:18Z")
I'm trying to create a new facet but I don't know how to create a new facet. I create a component and assign it to view but I want to add an additional filter in that facet so how can I add an additional filter in facet … --- ## [Getting spammed with "No active transaction, skip creating span for outgoing HTTP request" message](https://discuss.elastic.co/t/getting-spammed-with-no-active-transaction-skip-creating-span-for-outgoing-http-request-message/278960)
**Author:** [@Martin\_Ferrari](https://discuss.elastic.co/u/Martin_Ferrari)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 11:27am UTC](https://discuss.elastic.co/t/getting-spammed-with-no-active-transaction-skip-creating-span-for-outgoing-http-request-message/278960 "2021-08-02T11:27:00Z")
Hello, - dotnet sdk 5.301 - Agent is Elastic.Apm.NetCoreAll 1.11.0 - Apm Server docker image: docker.elastic.co/apm/apm-server:7.13.2. After instrumenting my projects, I get thousands of these messages: \[06:57:48 … --- ## [Windows Server 2019 Core Compatibility](https://discuss.elastic.co/t/windows-server-2019-core-compatibility/280019)
**Author:** [@Jimbuctoo](https://discuss.elastic.co/u/Jimbuctoo)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 11:18am UTC](https://discuss.elastic.co/t/windows-server-2019-core-compatibility/280019 "2021-08-02T11:18:06Z")
I noticed on the Support Matrix, under Winlogbeat, it states Windows Server 2019 but fails to state other Windows Server types \[for 2019\] including Windows Server 2019 Core. For clarity, does Filebeats and Winlogbeats al… --- ## [How to judge whether a TCP connection is successful](https://discuss.elastic.co/t/how-to-judge-whether-a-tcp-connection-is-successful/280156)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 11:11am UTC](https://discuss.elastic.co/t/how-to-judge-whether-a-tcp-connection-is-successful/280156 "2021-08-02T11:11:10Z")
When I enabled packetbeat FLOW How to judge whether the connection to the port succeeds or fails from the data returned by packetbeat I compared the successful and unsuccessful two returned data, as if there was no dif… --- ## [Winlogbeat SSL](https://discuss.elastic.co/t/winlogbeat-ssl/280181)
**Author:** [@Abdullah\_Al-Mansour1](https://discuss.elastic.co/u/Abdullah_Al-Mansour1)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 10:58am UTC](https://discuss.elastic.co/t/winlogbeat-ssl/280181 "2021-08-02T10:58:38Z")
Hello - I'm performing my first secure install of elastic stack. Everything is going well. I'm at the last leg of the race, ingesting data from Winlogbeat. I created a winlogbeat\_writer role, assigned it to a winlogbeat\_… --- ## [Edit IIS Module Pipeline](https://discuss.elastic.co/t/edit-iis-module-pipeline/280083)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 9:55am UTC](https://discuss.elastic.co/t/edit-iis-module-pipeline/280083 "2021-08-02T09:55:58Z")
Hi, I'm i a company where I need to ingest data from IIS. I've enable the module but i'd like to modify a bit the pipeline. I've found that pipeline are stored in filebeat modules folder (on window : filebeat/module/ii… --- ## [Install RUM Agent on Kibana](https://discuss.elastic.co/t/install-rum-agent-on-kibana/280203)
**Author:** [@Luca\_B](https://discuss.elastic.co/u/Luca_B)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 9:51am UTC](https://discuss.elastic.co/t/install-rum-agent-on-kibana/280203 "2021-08-02T09:51:54Z")
Hello! Is there a way to install the RUM agent (client side) on Kibana itself? I'm not talking about enabling RUM, but about using the RUM agent to monitor kibana itself. Is it possible without customizing kibana source… --- ## [Lifecycle policy min\_document to not rollover empty indices](https://discuss.elastic.co/t/lifecycle-policy-min-document-to-not-rollover-empty-indices/280201)
**Author:** [@francois75](https://discuss.elastic.co/u/francois75)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 9:47am UTC](https://discuss.elastic.co/t/lifecycle-policy-min-document-to-not-rollover-empty-indices/280201 "2021-08-02T09:47:37Z")
I've set the max\_age to one day so I have one index per day. But this rollover also empty indices. Is there a way to avoid this ? Adding a min\_document to rollover could help with this. --- ## [Document level & Field level security with HighLevelRest client](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186)
**Author:** [@PraveenKumar\_KG](https://discuss.elastic.co/u/PraveenKumar_KG)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 9:32am UTC](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186 "2021-08-02T09:32:35Z")
Hi, We have built an angular and SpringBoot based application to search the data in elasticsearch and render the search details in UI. Angular frontend has sign in with access restricted with RBAC. Now I want to restr… --- ## [Ctx.payload.hits NOT working error (Good format)](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error-good-format/280071)
**Author:** [@alex14](https://discuss.elastic.co/u/alex14)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 8:14am UTC](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error-good-format/280071 "2021-08-02T08:14:58Z")
Hey there, I´m trying to create a watcher but i need to use some fields from my index to send that information via email but i always get the same error I need to use the fields hit.\_source.service.address, 'NodeName':… --- ## [Sort and limit with aggregation](https://discuss.elastic.co/t/sort-and-limit-with-aggregation/280007)
**Author:** [@raviverel](https://discuss.elastic.co/u/raviverel)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:52am UTC](https://discuss.elastic.co/t/sort-and-limit-with-aggregation/280007 "2021-08-02T07:52:57Z")
hey, i am want to do aggregation only on the first X items sort by some attributes, is it possible ? didn't find a way ( elastic 7.13 ) thanks --- ## [Query on elasticsearch.keystore file present in ES config directory](https://discuss.elastic.co/t/query-on-elasticsearch-keystore-file-present-in-es-config-directory/278652)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 7:51am UTC](https://discuss.elastic.co/t/query-on-elasticsearch-keystore-file-present-in-es-config-directory/278652 "2021-08-02T07:51:26Z")
Hi, I am using Elasticsearch-oss 7.8.0 in k8s environment. I want to know what is elasticsearch.keystore file present in ES Config directory(/etc/elasticsearch) which comes by default when ES rpm is installed. I saw thi… --- ## [Whats difference org.elasticsearch.index.mapper.GeoPointFieldMapper and org.elasticsearch.xpack.ml.extractor.GeoPointField](https://discuss.elastic.co/t/whats-difference-org-elasticsearch-index-mapper-geopointfieldmapper-and-org-elasticsearch-xpack-ml-extractor-geopointfield/280042)
**Author:** [@drake-jin](https://discuss.elastic.co/u/drake-jin)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:50am UTC](https://discuss.elastic.co/t/whats-difference-org-elasticsearch-index-mapper-geopointfieldmapper-and-org-elasticsearch-xpack-ml-extractor-geopointfield/280042 "2021-08-02T07:50:36Z")
I wonder why same role classes are here in elasticsearch repository. What org.elasticsearch.xpack.ml.extractor.GeoPointField is for? What org.elasticsearch.index.mapper.GeoPointFieldMapper is for? Any documents? --- ## [Cannot crawl a website](https://discuss.elastic.co/t/cannot-crawl-a-website/279825)
**Author:** [@Marten](https://discuss.elastic.co/u/Marten)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 7:41am UTC](https://discuss.elastic.co/t/cannot-crawl-a-website/279825 "2021-08-02T07:41:53Z")
Hello, I'm trying to crawl a website (www.werk.nl) but the crawler gets a 599 error on robots.txt. If I use my browser, I can open robots.txt and the website without problems. What can be the issue? Marten --- ## [Can I change the system index mapping and enrich it with new fields](https://discuss.elastic.co/t/can-i-change-the-system-index-mapping-and-enrich-it-with-new-fields/280057)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:28am UTC](https://discuss.elastic.co/t/can-i-change-the-system-index-mapping-and-enrich-it-with-new-fields/280057 "2021-08-02T07:28:45Z")
Hi, Can I change the mapping of the system index and enrich it with new fields. The current mapping of an index is "dynamic":"strict" and the index is hidden by default and its name starting with "." System index --- ## [Logstash exit with code 0](https://discuss.elastic.co/t/logstash-exit-with-code-0/279891)
**Author:** [@abdo37](https://discuss.elastic.co/u/abdo37)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 7:25am UTC](https://discuss.elastic.co/t/logstash-exit-with-code-0/279891 "2021-08-02T07:25:39Z")
heey i'm trynig to use docker-compose for logstash,elasticsearch,postgresql and when i start docker-compose all containers are working except logstash container it gives me logstash exit with code 0 there is my docker… --- ## [Filebeat integration as file](https://discuss.elastic.co/t/filebeat-integration-as-file/279990)
**Author:** [@doragon](https://discuss.elastic.co/u/doragon)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 7:25am UTC](https://discuss.elastic.co/t/filebeat-integration-as-file/279990 "2021-08-02T07:25:30Z")
Good afternoon. I tried to setup a disconnected architecture between production and monitoring, as I have non-connectivity between my production servers and my ELK stack (local network). I planed to work as follow: f… --- ## [\[Visualization\]\[Treemap\] Multiple object case](https://discuss.elastic.co/t/visualization-treemap-multiple-object-case/280170)
**Author:** [@kwang\_hee\_Han](https://discuss.elastic.co/u/kwang_hee_Han)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:20am UTC](https://discuss.elastic.co/t/visualization-treemap-multiple-object-case/280170 "2021-08-02T07:20:57Z")
Hello, I have tried creating "TreeMap" visualization in Lens. I couldn't get appropriate Visual. I need help to customizing. \[Indexed Document Schema\] \[TreeMap in Lens\] Attached first imaged tells, category : ":… --- ## [Same index-pattern created with kibana UI and REST command](https://discuss.elastic.co/t/same-index-pattern-created-with-kibana-ui-and-rest-command/280079)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 7:13am UTC](https://discuss.elastic.co/t/same-index-pattern-created-with-kibana-ui-and-rest-command/280079 "2021-08-02T07:13:18Z")
Hi We have deployed kibana 7.8.0. We notice one observation if we try to create one index pattern through Kibana UI and another through REST API in that case we are able to create the same index-pattern. But if we try t… [Previous page](https://discuss.elastic.co/latest.md?page=1545) [Next page](https://discuss.elastic.co/latest.md?page=1547)