# Latest **URL:** https://discuss.elastic.co/latest.md?page=1561 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1562 --- ## [Query using ESSQL Conditional (CASE) Function missing some records](https://discuss.elastic.co/t/query-using-essql-conditional-case-function-missing-some-records/278552)
**Author:** [@girvandip](https://discuss.elastic.co/u/girvandip)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:15am UTC](https://discuss.elastic.co/t/query-using-essql-conditional-case-function-missing-some-records/278552 "2021-07-22T10:15:47Z")
Hello, I am working with Canvas in Kibana. Below is the example of the data in tabular format: | timestamp | Id | message | --------------------------------- | 08:49:10 | 1 | TE | | 08:50:20 |… --- ## [File structure cannot be determined on data visualizer](https://discuss.elastic.co/t/file-structure-cannot-be-determined-on-data-visualizer/277070)
**Author:** [@Adrienb02](https://discuss.elastic.co/u/Adrienb02)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:05am UTC](https://discuss.elastic.co/t/file-structure-cannot-be-determined-on-data-visualizer/277070 "2021-07-22T10:05:58Z")
Hello everyone ! In advance, sorry for my english. I have an issue with the Data Visualizer. In my case, I have created a json file. My problem is that the data visualizer doesn't want my file as an input. The error … --- ## [ES is getting killed :(](https://discuss.elastic.co/t/es-is-getting-killed/279362)
**Author:** [@kamal\_khushi](https://discuss.elastic.co/u/kamal_khushi)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 9:40am UTC](https://discuss.elastic.co/t/es-is-getting-killed/279362 "2021-07-22T09:40:29Z")
OS:-ubuntu ram:-16gb Storage:-500GB CPU:-i5 10th gen i have Cloned ES in two different directory : Es1 Es2 Then first i launched Es1/bin/elastisearch And next i launched Es2/bin/elastisearch while Es2 is launchi… --- ## [Filebeat multiline Issue](https://discuss.elastic.co/t/filebeat-multiline-issue/279338)
**Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 5:41am UTC](https://discuss.elastic.co/t/filebeat-multiline-issue/279338 "2021-07-22T05:41:46Z")
Hi Team, I have an issue in filebeat Multiline pattern, below are my logs and filebeat configuration. sample\_logs 21-04-01 Name Succ Fail Reject Thrput Response time (ms) … --- ## [Filtering on a property of the first element in a Nested property array](https://discuss.elastic.co/t/filtering-on-a-property-of-the-first-element-in-a-nested-property-array/279298)
**Author:** [@Sikelela\_Nkohla](https://discuss.elastic.co/u/Sikelela_Nkohla)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:54am UTC](https://discuss.elastic.co/t/filtering-on-a-property-of-the-first-element-in-a-nested-property-array/279298 "2021-07-22T07:54:52Z")
We have the following document structure : "Document" : { "arvTreatmentStarted" : "started", "followUps" : \[ { "followUpDate" : "2012-01-01", "arvDrugs" : { "dispenseDoseQuantity" : "30", "dispenseDoseDaysSupply… --- ## [Esrally giving multiple search queries in the same track.json](https://discuss.elastic.co/t/esrally-giving-multiple-search-queries-in-the-same-track-json/279184)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 4\ **Last updated:** [July 22, 2021, 7:25am UTC](https://discuss.elastic.co/t/esrally-giving-multiple-search-queries-in-the-same-track-json/279184 "2021-07-22T07:25:27Z")
Could we give multiple search queries in the same track.json I want to give 2 queries which given below/ So I added it in several places in different ways to organize it . However, when I validate the .json , I get … --- ## [RabbitMQ Input plugin: PKIX path building failed in Logstash 6.8.15](https://discuss.elastic.co/t/rabbitmq-input-plugin-pkix-path-building-failed-in-logstash-6-8-15/279349)
**Author:** [@Pragatheswar](https://discuss.elastic.co/u/Pragatheswar)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 7:23am UTC](https://discuss.elastic.co/t/rabbitmq-input-plugin-pkix-path-building-failed-in-logstash-6-8-15/279349 "2021-07-22T07:23:45Z")
Problem statement Hi guys, I ahve upgraded Logstash from 6.2.2 to 6.5.0. Post that I receive the following error when trying to configure logstash client certificates: \[2018-12-10T22:10:32,949\]\[ERROR\]\[logstash.inputs.… --- ## [Is it possible for kibana to start with blank page before selecting options in control](https://discuss.elastic.co/t/is-it-possible-for-kibana-to-start-with-blank-page-before-selecting-options-in-control/279289)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 7:12am UTC](https://discuss.elastic.co/t/is-it-possible-for-kibana-to-start-with-blank-page-before-selecting-options-in-control/279289 "2021-07-22T07:12:47Z")
I ingested a couple of log files, and it gets populated on the "maps" visualization perfectly . however i wanted to know if its possible for kibana to start with no plots on the map and have it plot only when we choo… --- ## [Upgrading the cluster using Elastic Operator](https://discuss.elastic.co/t/upgrading-the-cluster-using-elastic-operator/279067)
**Author:** [@yubarseg](https://discuss.elastic.co/u/yubarseg)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:06am UTC](https://discuss.elastic.co/t/upgrading-the-cluster-using-elastic-operator/279067 "2021-07-22T07:06:18Z")
Hello, I am testing different upgrade options of Elasticsearch using Elastic Operator on Kubernetes following this documentation Upgrading the cluster. Example described there works fine: Replace dedicated master and … --- ## [Installing specific elasticsearch version in Homebrew - Mac OS](https://discuss.elastic.co/t/installing-specific-elasticsearch-version-in-homebrew-mac-os/278586)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 6:33am UTC](https://discuss.elastic.co/t/installing-specific-elasticsearch-version-in-homebrew-mac-os/278586 "2021-07-22T06:33:12Z")
Hi all, I'm having trouble in installing specific versions of elasticsearch in mac OS using Homebrew. In Homebrew, I can only install the latest version which is available. If I want to install a version eg: 7.13.2 , … --- ## [I want to show time diff](https://discuss.elastic.co/t/i-want-to-show-time-diff/279342)
**Author:** [@byun618](https://discuss.elastic.co/u/byun618)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 6:19am UTC](https://discuss.elastic.co/t/i-want-to-show-time-diff/279342 "2021-07-22T06:19:54Z")
hello every one. this is the data. and i want to show time diff between max and min. p.s this is my first post. so feel free to comment about my post 'form', 'rule' or something --- ## [Search through encrypted data](https://discuss.elastic.co/t/search-through-encrypted-data/278922)
**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 4:41am UTC](https://discuss.elastic.co/t/search-through-encrypted-data/278922 "2021-07-22T04:41:30Z")
Hello: Apparently, in healthcare, the new stipulation evolving - to encrypt the PHI data (no, not the disk - data) - so no one would be able to get the data in cleartext. I know, I know devs can decrypt the data if the… --- ## [Issues with signals in VEGA visualization](https://discuss.elastic.co/t/issues-with-signals-in-vega-visualization/279222)
**Author:** [@elad\_sheinfeld](https://discuss.elastic.co/u/elad_sheinfeld)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 4:18am UTC](https://discuss.elastic.co/t/issues-with-signals-in-vega-visualization/279222 "2021-07-22T04:18:25Z")
Hey all, I'm using ELK version 7.13.3 Using the code below, I'm trying to draw nodes connected to networks. The default fill of the nodes is blue, but when a user is clicking a node, it will be filled with red and the… --- ## [Packetbeat FLOW and analysis results for individual protocols](https://discuss.elastic.co/t/packetbeat-flow-and-analysis-results-for-individual-protocols/279333)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 4:05am UTC](https://discuss.elastic.co/t/packetbeat-flow-and-analysis-results-for-individual-protocols/279333 "2021-07-22T04:05:50Z")
packetbeat,If HTTP protocol and FLOW analysis are enabled, and an HTTP request comes in and responds normally (whether it returns 200,404), will both HTTP and FLOW be analyzed, or will it only be analyzed and output with… --- ## ["add panel" in dashboard edit view never loads](https://discuss.elastic.co/t/add-panel-in-dashboard-edit-view-never-loads/277976)
**Author:** [@bacony0atmeal](https://discuss.elastic.co/u/bacony0atmeal)\ **Replies:** 27\ **Last updated:** [July 22, 2021, 3:46am UTC](https://discuss.elastic.co/t/add-panel-in-dashboard-edit-view-never-loads/277976 "2021-07-22T03:46:45Z")
kibana version 7.9.1. recently migrated from 6.8.x. steps taken to recreate: kibana home -\> dashboards -\> open up existing dashboard -\> click "Add" -\> "Add panels" pane never populates with any saved visualizations. … --- ## [\[Logstash\] Aggregate filter - no timeout](https://discuss.elastic.co/t/logstash-aggregate-filter-no-timeout/279318)
**Author:** [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\ **Replies:** 6\ **Last updated:** [July 22, 2021, 2:24am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-no-timeout/279318 "2021-07-22T02:24:48Z")
Hi, In my logstash 7.9.3 I would like to create filter similar to that example https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3 I want to create index w… --- ## [Packetbeat7.13.3 default BPF](https://discuss.elastic.co/t/packetbeat7-13-3-default-bpf/279009)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:07am UTC](https://discuss.elastic.co/t/packetbeat7-13-3-default-bpf/279009 "2021-07-22T02:07:59Z")
packetbeat7.13.3 default BPF Doesn't seem to work. Officially, my understanding is that when I set up a protocol for monitoring, packetbeat will create a default BPF, Contains only ports for this protocol.but however, … --- ## [SIEM Signals Index and Component Templates](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 10:35pm UTC](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313 "2021-07-21T22:35:55Z")
I have started translating and migrating all my legacy Index Templates over to the new Component Templates, but when I got to the .siem-signals-\ template, I am now getting an error: An error occurred during rule … --- ## [JDBC input is not working when added with Kafka input](https://discuss.elastic.co/t/jdbc-input-is-not-working-when-added-with-kafka-input/279221)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 3\ **Last updated:** [July 21, 2021, 9:08pm UTC](https://discuss.elastic.co/t/jdbc-input-is-not-working-when-added-with-kafka-input/279221 "2021-07-21T21:08:23Z")
Hello Team, I am trying to configure multiple inputs in a pipeline input { jdbc { } kafka { } kafka { } } but when i run the pipeline only kafka messages i am getting and jdbc input is not working. Could … --- ## [Multiple nodes of ElasticSearch](https://discuss.elastic.co/t/multiple-nodes-of-elasticsearch/279219)
**Author:** [@DwiAnugrahHendrawan](https://discuss.elastic.co/u/DwiAnugrahHendrawan)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 8:42pm UTC](https://discuss.elastic.co/t/multiple-nodes-of-elasticsearch/279219 "2021-07-21T20:42:38Z")
Hi there, I am trying to find out, what license I need to implement multiple nodes of elasticsearch and example I have 3 nodes those that means I have 1 primary nodes and 2 secondary nodes, and the secondary nodes sta… --- ## [Displaying time series in Canvas](https://discuss.elastic.co/t/displaying-time-series-in-canvas/279208)
**Author:** [@gabor](https://discuss.elastic.co/u/gabor)\ **Replies:** 3\ **Last updated:** [July 21, 2021, 8:04pm UTC](https://discuss.elastic.co/t/displaying-time-series-in-canvas/279208 "2021-07-21T20:04:28Z")
Hi, I have a data set based on some server logs containing sent- and received amount of data and client IPs. The dataset is a collection of these documents: { .. server\_ip: IP1, client\_ip: IP2, read: 2232323234, write:… --- ## [Combining two data sources into one or making a parent and child relation with two different sources](https://discuss.elastic.co/t/combining-two-data-sources-into-one-or-making-a-parent-and-child-relation-with-two-different-sources/279089)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 7:05pm UTC](https://discuss.elastic.co/t/combining-two-data-sources-into-one-or-making-a-parent-and-child-relation-with-two-different-sources/279089 "2021-07-21T19:05:54Z")
Hello, So just to set some context around this. We are trying to work around the limitation of returning only at most 10k results during a search and with filters due to having an immense amount of data and it also comi… --- ## [Having hard time matching queries with forward slash & ampersand](https://discuss.elastic.co/t/having-hard-time-matching-queries-with-forward-slash-ampersand/279303)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 7:05pm UTC](https://discuss.elastic.co/t/having-hard-time-matching-queries-with-forward-slash-ampersand/279303 "2021-07-21T19:05:10Z")
I want to identify urls like this from our elastic index http://example.com/?a=1&c=1&s1=1 where the domain name can change. So, I have to rely on matching using the query pattern. In a nutshell, something like this \*/?… --- ## [Logstash parsers for +100 technologies](https://discuss.elastic.co/t/logstash-parsers-for-100-technologies/279308)
**Author:** [@nnovaes](https://discuss.elastic.co/u/nnovaes)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 6:55pm UTC](https://discuss.elastic.co/t/logstash-parsers-for-100-technologies/279308 "2021-07-21T18:55:39Z")
The Cargill SIEM team has published this new project with a collection of logstash parser configs developed in house for multiple technologies. Logstash parsers are usually scattered around in gists and repos but this is… --- ## [Where can I add new apps for exploit protection in the on-premise product?](https://discuss.elastic.co/t/where-can-i-add-new-apps-for-exploit-protection-in-the-on-premise-product/279306)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 6:38pm UTC](https://discuss.elastic.co/t/where-can-i-add-new-apps-for-exploit-protection-in-the-on-premise-product/279306 "2021-07-21T18:38:51Z")
I'm looking for guidance on how to add additional applications to my endgame policy threat | exploit configuration. The major browsers and office apps are there along with Java and Adobe, and I have the option to add app… --- ## [Elastic Transform Error](https://discuss.elastic.co/t/elastic-transform-error/279199)
**Author:** [@IWannaDance](https://discuss.elastic.co/u/IWannaDance)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 6:35pm UTC](https://discuss.elastic.co/t/elastic-transform-error/279199 "2021-07-21T18:35:38Z")
\[ERROR\]\[o.e.x.t.t.TransformPersistentTasksExecutor\] \[node-1\] Failed to start task \[endpoint.metadata\_current-default-0.19.1\] in node operation org.elasticsearch.ElasticsearchStatusException: Unable to start transform \[en… --- ## [Filebeat memory overuse](https://discuss.elastic.co/t/filebeat-memory-overuse/279304)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 6:27pm UTC](https://discuss.elastic.co/t/filebeat-memory-overuse/279304 "2021-07-21T18:27:26Z")
Hi, I spotted that some of the Filebeat processes are using a lot of memory without any good reason. I have about 8 files read by FB and this specific environment is mostly stale. However, even after restart, it hogs up… --- ## [Query two separate indices, perform calculations on the results, graph result of calculation](https://discuss.elastic.co/t/query-two-separate-indices-perform-calculations-on-the-results-graph-result-of-calculation/279292)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 3\ **Last updated:** [July 21, 2021, 5:47pm UTC](https://discuss.elastic.co/t/query-two-separate-indices-perform-calculations-on-the-results-graph-result-of-calculation/279292 "2021-07-21T17:47:59Z")
I would like to query two separate indices. I would like to do the following: Query 1: Query metricbeat which returns a figure say for arguments sake 2,500,000. I would like to divide this by 1,000,000 which gives me a… --- ## [Getting 400 "request does not support \[aggs\]" Error](https://discuss.elastic.co/t/getting-400-request-does-not-support-aggs-error/279253)
**Author:** [@thejusjose-mindcurv](https://discuss.elastic.co/u/thejusjose-mindcurv)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:47pm UTC](https://discuss.elastic.co/t/getting-400-request-does-not-support-aggs-error/279253 "2021-07-21T17:47:25Z")
Hi all, Getting a 400 Error while trying to fetch the total count of IP connecting to our system and then sort the IP list based on the top 5. We have Kibana version 7.8 installed. Requirement :: Get the list of top … --- ## [Elastic SIEM detection rule query permissions](https://discuss.elastic.co/t/elastic-siem-detection-rule-query-permissions/279242)
**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:27pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rule-query-permissions/279242 "2021-07-21T17:27:30Z")
Hi, Just a simple question: I was wondering how does the detection engine in Kibana execute queries? I couldn't find any documentation about who (which user) runs the queries with which permissions. So is there an in… [Previous page](https://discuss.elastic.co/latest.md?page=1560) [Next page](https://discuss.elastic.co/latest.md?page=1562)