# Latest **URL:** https://discuss.elastic.co/latest.md?page=1556 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1557 --- ## [Observability Engineer Lab 4.3 - Step 5: Result image](https://discuss.elastic.co/t/observability-engineer-lab-4-3-step-5-result-image/279535)
**Author:** [@StashLogs](https://discuss.elastic.co/u/StashLogs)\ **Replies:** 1\ **Last updated:** [July 26, 2021, 1:57pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-3-step-5-result-image/279535 "2021-07-26T13:57:08Z")
Hello, I completed lab Observability Engineer Lab 4.3 and see the results only for a generated 404. The lab guide shows an image for response\_code 200 which was filtered out in a previous lab. That's not possible unless… --- ## [Multi if condition on filter aggregation](https://discuss.elastic.co/t/multi-if-condition-on-filter-aggregation/279495)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 10\ **Last updated:** [July 26, 2021, 1:56pm UTC](https://discuss.elastic.co/t/multi-if-condition-on-filter-aggregation/279495 "2021-07-26T13:56:03Z")
Hi guys. I hope somebody can help to understand this problem I am having while trying to aggregate a field based on multi if condition. I have a field named message in which I have multiple events coming to. for exampl… --- ## [Query performance- filter aggregation with the same filter improve performance drastically](https://discuss.elastic.co/t/query-performance-filter-aggregation-with-the-same-filter-improve-performance-drastically/279618)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 4\ **Last updated:** [July 26, 2021, 1:47pm UTC](https://discuss.elastic.co/t/query-performance-filter-aggregation-with-the-same-filter-improve-performance-drastically/279618 "2021-07-26T13:47:12Z")
Can anyone explain why the left (pseudo) query runs above 5s the while the right part in 30ms? The filters in the example below, are identical (aggs/ query filters). isn't the aggregation part suppose to run on filtere… --- ## [Filebeat: output to kafka checks message size before compression](https://discuss.elastic.co/t/filebeat-output-to-kafka-checks-message-size-before-compression/279629)
**Author:** [@fld](https://discuss.elastic.co/u/fld)\ **Replies:** 0\ **Last updated:** [July 26, 2021, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-checks-message-size-before-compression/279629 "2021-07-26T13:00:59Z")
According to filebeat document of kafka output for key max\_message\_bytesedit: The maximum permitted size of JSON-encoded messages. Bigger messages will be dropped. The default value is 1000000 (bytes). This value shoul… --- ## [Fleet Server not available after reboot](https://discuss.elastic.co/t/fleet-server-not-available-after-reboot/279604)
**Author:** [@sam1325](https://discuss.elastic.co/u/sam1325)\ **Replies:** 1\ **Last updated:** [July 26, 2021, 12:47pm UTC](https://discuss.elastic.co/t/fleet-server-not-available-after-reboot/279604 "2021-07-26T12:47:40Z")
Hello there, Server info: 1 - I´m running ubuntu 20.04 2 - Elk stack running on 7.13.3 version I´m trying to add a fleet server on a self managed host. This works great after installing, but after restarting the hos… --- ## [What does "OK" mean for a rule?](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 5\ **Last updated:** [July 26, 2021, 12:28pm UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536 "2021-07-26T12:28:15Z")
Dear all =) What does it mean that a rule is "ok" as seen on this screenshot? I suppose I don't want anything but "Active"? Hugs, Sandra =) --- ## [Problem create dashboard](https://discuss.elastic.co/t/problem-create-dashboard/279378)
**Author:** [@Lisouu\_13](https://discuss.elastic.co/u/Lisouu_13)\ **Replies:** 4\ **Last updated:** [July 26, 2021, 12:27pm UTC](https://discuss.elastic.co/t/problem-create-dashboard/279378 "2021-07-26T12:27:49Z")
Hello, I want to create my first dashboard on kibana 7.13, but I can't do it. I would like to make a graph against the elapsed time that I specified in the data, but the timestamp does not appear anywhere. So i really ne… --- ## [How to use Elasticsearch from a SPA?](https://discuss.elastic.co/t/how-to-use-elasticsearch-from-a-spa/279522)
**Author:** [@kazza](https://discuss.elastic.co/u/kazza)\ **Replies:** 3\ **Last updated:** [July 26, 2021, 12:23pm UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-from-a-spa/279522 "2021-07-26T12:23:19Z")
I have been wondering what is the best practice when wanting to query Elasticsearch directly from browser javascript. E.g. such as a React/VueJS/Angular application. I hoped that it would be possible to use a standard o… --- ## [Rufus-scheduler error: TZInfo::PeriodNotFound](https://discuss.elastic.co/t/rufus-scheduler-error-tzinfo-periodnotfound/278811)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 3\ **Last updated:** [July 26, 2021, 12:12pm UTC](https://discuss.elastic.co/t/rufus-scheduler-error-tzinfo-periodnotfound/278811 "2021-07-26T12:12:58Z")
Hi all, I recently posted a question about my logstash pipeline at some point (seemingly) randomly not updating the jdbc metadata for sql\_last\_value substitution. For completeness, I'll include the input plugin of my co… --- ## [NoShardAvailableActionException Error on ElasticSearch on Docker](https://discuss.elastic.co/t/noshardavailableactionexception-error-on-elasticsearch-on-docker/279555)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [July 26, 2021, 11:52am UTC](https://discuss.elastic.co/t/noshardavailableactionexception-error-on-elasticsearch-on-docker/279555 "2021-07-26T11:52:49Z")
I set up basic security for the Elastic Stack plus secured HTTPS traffic recently and i encrypted all communication between the elastic nodes even though i use only one node. The thins is now kibana will have this error… --- ## [ES is getting killed :(](https://discuss.elastic.co/t/es-is-getting-killed/279354)
**Author:** [@kamal\_khushi](https://discuss.elastic.co/u/kamal_khushi)\ **Replies:** 13\ **Last updated:** [July 26, 2021, 11:39am UTC](https://discuss.elastic.co/t/es-is-getting-killed/279354 "2021-07-26T11:39:12Z")
OS:-ubuntu ram:-16gb Storage:-500GB CPU:-i5 10th gen i have Cloned ES in two different directory : Es1 Es2 Then first i launched Es1/bin/elastisearch And next i launched Es2/bin/elastisearch while Es2 is launchi… --- ## [MISP data in elasticsearch (filebeat)](https://discuss.elastic.co/t/misp-data-in-elasticsearch-filebeat/279489)
**Author:** [@zuzusa](https://discuss.elastic.co/u/zuzusa)\ **Replies:** 1\ **Last updated:** [July 26, 2021, 11:23am UTC](https://discuss.elastic.co/t/misp-data-in-elasticsearch-filebeat/279489 "2021-07-26T11:23:25Z")
Hi together, I am currently using a MISP in combination with elasticsearch. My goal is to have all events from the MISP also within elasticsearch. Currently the import of the MISP events to the elasticsearch is done vi… --- ## [Env variable on metricbeat.yml](https://discuss.elastic.co/t/env-variable-on-metricbeat-yml/279394)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [July 26, 2021, 11:08am UTC](https://discuss.elastic.co/t/env-variable-on-metricbeat-yml/279394 "2021-07-26T11:08:53Z")
In metricbeat I am trying to use env variable to seperate out log file this is how I understood from few post here that I read. created /etc/metricbeat/env file and added HOST=myelkhost1 then edited /lib/systemd/syst… --- ## [Auditd exclude filters are adding a significant delay](https://discuss.elastic.co/t/auditd-exclude-filters-are-adding-a-significant-delay/279608)
**Author:** [@vincent509](https://discuss.elastic.co/u/vincent509)\ **Replies:** 0\ **Last updated:** [July 26, 2021, 9:55am UTC](https://discuss.elastic.co/t/auditd-exclude-filters-are-adding-a-significant-delay/279608 "2021-07-26T09:55:11Z")
I am running AuditBeat with the auditd module, and I have noticed that some filter rules are adding a significant delay between the event being created, and AuditBeat publishing the event. For example: Consider the foll… --- ## [How to connect keyclock with elasticsearch and kibana](https://discuss.elastic.co/t/how-to-connect-keyclock-with-elasticsearch-and-kibana/277965)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 5\ **Last updated:** [July 26, 2021, 9:44am UTC](https://discuss.elastic.co/t/how-to-connect-keyclock-with-elasticsearch-and-kibana/277965 "2021-07-26T09:44:25Z")
Hi team, I am using ELK in my local machine . And it was protected with searchguard. Now I want to integrate keyclock With ELK. I dont know how to connect keyclock with ELK . Give me a step by step process to integrate… --- ## [Lfd on Server: Suspicious File Alert](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541)
**Author:** [@NileYouth](https://discuss.elastic.co/u/NileYouth)\ **Replies:** 3\ **Last updated:** [July 26, 2021, 9:35am UTC](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541 "2021-07-26T09:35:44Z")
I have got many suspiction on CSF notfication can any one help in this or how can I exclode this files Time: Sat Jul 24 20:25:39 2021 +0200 File: /tmp/systemd-private-07b3a323be3d4e5e9196051704fa4e9b-elasticsearch.s… --- ## [Disk space issues on 7.10](https://discuss.elastic.co/t/disk-space-issues-on-7-10/279584)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 4\ **Last updated:** [July 26, 2021, 8:54am UTC](https://discuss.elastic.co/t/disk-space-issues-on-7-10/279584 "2021-07-26T08:54:51Z")
I have two more or less identical servers in my cluster that each have 3 disks in the data\_path each with 1.5TB. Recently one of the server has started running out of disk on one of the three disks (the first in the li… --- ## [Heap usage](https://discuss.elastic.co/t/heap-usage/279149)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 2\ **Last updated:** [July 26, 2021, 8:42am UTC](https://discuss.elastic.co/t/heap-usage/279149 "2021-07-26T08:42:21Z")
I'm trying to understand how Elasticsearch uses heap while performing the searches. Does it load entire shard into memory or particular segment for searching the users data? --- ## [How to add a field to the result of the aggregation](https://discuss.elastic.co/t/how-to-add-a-field-to-the-result-of-the-aggregation/279581)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [July 26, 2021, 8:24am UTC](https://discuss.elastic.co/t/how-to-add-a-field-to-the-result-of-the-aggregation/279581 "2021-07-26T08:24:26Z")
I wrote an aggregation, and it meets my requirements, but I also need to add a field (trace.id) when the results are displayed. Trace.id does not need to be aggregated. How should dsl be written in this case? Can an… --- ## [Pipelines limits](https://discuss.elastic.co/t/pipelines-limits/279563)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 2\ **Last updated:** [July 26, 2021, 8:20am UTC](https://discuss.elastic.co/t/pipelines-limits/279563 "2021-07-26T08:20:21Z")
Hi, I'm using logstash for multiple data sources(around 10-12). I'm using different configuration files for each data source, each configuration file has a dedicated pipeline in the pipelines.yml file. I wanted to und… --- ## [No information in the "Metrics" module of the "APM" screen](https://discuss.elastic.co/t/no-information-in-the-metrics-module-of-the-apm-screen/279346)
**Author:** [@tttoad](https://discuss.elastic.co/u/tttoad)\ **Replies:** 4\ **Last updated:** [July 26, 2021, 8:04am UTC](https://discuss.elastic.co/t/no-information-in-the-metrics-module-of-the-apm-screen/279346 "2021-07-26T08:04:49Z")
APM Server version 7.13.3 elasticSearch: 7.13.3 kibana: 7.13.3 No information in the "Metrics" module of the "APM" screen 1.run apm,es,kibana: docker network create -d bridge my-jaeger-net docker run --name elasticsea… --- ## [Report mail every day](https://discuss.elastic.co/t/report-mail-every-day/279601)
**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\ **Replies:** 0\ **Last updated:** [July 26, 2021, 7:54am UTC](https://discuss.elastic.co/t/report-mail-every-day/279601 "2021-07-26T07:54:37Z")
hello, i need help please I'm new in elasticsearch. I want to create (report or mail) that be generated every day at 07h. This report should contain all alert generated all the night thx --- ## [Elasticsearch will return a decreased 'hits total' value](https://discuss.elastic.co/t/elasticsearch-will-return-a-decreased-hits-total-value/279556)
**Author:** [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Replies:** 1\ **Last updated:** [July 26, 2021, 7:44am UTC](https://discuss.elastic.co/t/elasticsearch-will-return-a-decreased-hits-total-value/279556 "2021-07-26T07:44:53Z")
Hi community I have a flink job which will consume Kafka message and load into Elasticsearch. In order to monitor the number of documents loaded into Elasticsearch, I write a DSL to get the 'hits total' in Elasticsearc… --- ## [After securing elasticsearch cluster uuid not found](https://discuss.elastic.co/t/after-securing-elasticsearch-cluster-uuid-not-found/279594)
**Author:** [@Salim\_Adnan](https://discuss.elastic.co/u/Salim_Adnan)\ **Replies:** 2\ **Last updated:** [July 26, 2021, 7:39am UTC](https://discuss.elastic.co/t/after-securing-elasticsearch-cluster-uuid-not-found/279594 "2021-07-26T07:39:43Z")
i have create 4 elastice node all are working find before securing them after securing my cluster uuid not working i detach-cluster my cluster but the problem not solve etc i do following command \> cd /usr/share/elast… --- ## [Caused by: java.net.UnknownHostException: fx-elasticsearch: Name does not resolve](https://discuss.elastic.co/t/caused-by-java-net-unknownhostexception-fx-elasticsearch-name-does-not-resolve/279596)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 5\ **Last updated:** [July 26, 2021, 7:33am UTC](https://discuss.elastic.co/t/caused-by-java-net-unknownhostexception-fx-elasticsearch-name-does-not-resolve/279596 "2021-07-26T07:33:58Z")
Hi All, I have issue of fx-elasticsearch not found and i have deploy as docker compose file one more error i got in same container Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bea… --- ## [Search/match multiple fields in Elasticsearch](https://discuss.elastic.co/t/search-match-multiple-fields-in-elasticsearch/279448)
**Author:** [@noetic](https://discuss.elastic.co/u/noetic)\ **Replies:** 1\ **Last updated:** [July 26, 2021, 7:32am UTC](https://discuss.elastic.co/t/search-match-multiple-fields-in-elasticsearch/279448 "2021-07-26T07:32:10Z")
I'm trying to build a query in Elasticsearch with PHP combining an exact match and search by keywords/text. I'm using the should for an exact match, and for text, I'm using the term match. My query is: $params = \[ '… --- ## [Google workspace moduel complais about missing nextPageToken](https://discuss.elastic.co/t/google-workspace-moduel-complais-about-missing-nextpagetoken/279597)
**Author:** [@maf](https://discuss.elastic.co/u/maf)\ **Replies:** 0\ **Last updated:** [July 26, 2021, 7:31am UTC](https://discuss.elastic.co/t/google-workspace-moduel-complais-about-missing-nextpagetoken/279597 "2021-07-26T07:31:27Z")
We are using Filebeat 13.3 and we see quite a few errors like this in our logs: 2021-07-26T06:51:44.938Z ERROR \[input.httpjson-cursor\] v2/request.go:188 error processing response: template: :1:16: executi… --- ## [Elasticsearch Bulk Insert through Python Client API](https://discuss.elastic.co/t/elasticsearch-bulk-insert-through-python-client-api/279032)
**Author:** [@Anirudhan](https://discuss.elastic.co/u/Anirudhan)\ **Replies:** 7\ **Last updated:** [July 26, 2021, 7:24am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-insert-through-python-client-api/279032 "2021-07-26T07:24:59Z")
Dear Team, I am trying to bulk insert 3000 records into an elastic search using BULK API. Whichever documents having the keyword version are not being inserted. For eg: \[{"name": "XXXX", "description": "XXXX", "\_id": … --- ## [How can I add secret to the keystore using API](https://discuss.elastic.co/t/how-can-i-add-secret-to-the-keystore-using-api/279532)
**Author:** [@idelix](https://discuss.elastic.co/u/idelix)\ **Replies:** 3\ **Last updated:** [July 26, 2021, 6:09am UTC](https://discuss.elastic.co/t/how-can-i-add-secret-to-the-keystore-using-api/279532 "2021-07-26T06:09:26Z")
I deployed elastic cloud in Azure and now I'm trying to add keystore secret but not through UI as it will have to be automated in CI/CD. Could you please advise how this can be achieved via either API or some remote co… --- ## [Keep data for X days only](https://discuss.elastic.co/t/keep-data-for-x-days-only/279214)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [July 26, 2021, 5:13am UTC](https://discuss.elastic.co/t/keep-data-for-x-days-only/279214 "2021-07-26T05:13:16Z")
I have a demo computer with limited storage. Therefore I need to delete all indexed data older than 7 days or 5 GB. How would a life cycle policy look like to fulfill that need? Thank you very much for your support! [Previous page](https://discuss.elastic.co/latest.md?page=1555) [Next page](https://discuss.elastic.co/latest.md?page=1557)