# Latest **URL:** https://discuss.elastic.co/latest.md?page=1563 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1564 --- ## [Elastic Agent 7.10.1 - Understanding/Changing Data Destination](https://discuss.elastic.co/t/elastic-agent-7-10-1-understanding-changing-data-destination/279267)
**Author:** [@cpoetzel](https://discuss.elastic.co/u/cpoetzel)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 1:05pm UTC](https://discuss.elastic.co/t/elastic-agent-7-10-1-understanding-changing-data-destination/279267 "2021-07-21T13:05:06Z")
I walked into an existing ELK stack and an learning as i go. Ihave a 7.10.1 ELK Stack with around 5K Agents depolyed at 7.10.1 using Fleet. \*\* Understanding DATA Destination \*\* Under the Global Fleet Settings it says. … --- ## [Problem with filebeat "failed to add target to root"](https://discuss.elastic.co/t/problem-with-filebeat-failed-to-add-target-to-root/278740)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 11:50am UTC](https://discuss.elastic.co/t/problem-with-filebeat-failed-to-add-target-to-root/278740 "2021-07-21T11:50:24Z")
Hello, I try to decode escaped\_json using "decode\_json\_fields" processor. I want to add my extracted json fields to root. But in log I see this error: DEBUG \[processors\] processing/processors.go:128 Fail to ap… --- ## [FileBeat to push logs](https://discuss.elastic.co/t/filebeat-to-push-logs/279256)
**Author:** [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 11:15am UTC](https://discuss.elastic.co/t/filebeat-to-push-logs/279256 "2021-07-21T11:15:58Z")
We have installed filebeat in the server where logfiles are available. In this server, we have application related logs available in individual folders split based on the associated microservice.For eg,Login related logs… --- ## [Unable to show empty buckets when using Date Histogram on @timestamp field](https://discuss.elastic.co/t/unable-to-show-empty-buckets-when-using-date-histogram-on-timestamp-field/279238)
**Author:** [@prathamesh7](https://discuss.elastic.co/u/prathamesh7)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 10:32am UTC](https://discuss.elastic.co/t/unable-to-show-empty-buckets-when-using-date-histogram-on-timestamp-field/279238 "2021-07-21T10:32:00Z")
Hi Team, I am retrieving results of a query for last 7 days in visualisation, but in the response i am not seeing results for empty buckets i.e its not showing any result for that day when there is no data. There is no … --- ## [Esrally running the same track by giving multiple laps not working](https://discuss.elastic.co/t/esrally-running-the-same-track-by-giving-multiple-laps-not-working/279035)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 7\ **Last updated:** [July 21, 2021, 10:22am UTC](https://discuss.elastic.co/t/esrally-running-the-same-track-by-giving-multiple-laps-not-working/279035 "2021-07-21T10:22:11Z")
I want to run the same track repeatedly in a loop , because I want to do the benchmark performance testing for 3 hours. When I ran without lap count, it get completed within 30 minutes. However, even when I ran with… --- ## [Logstash goes wrong after add filter](https://discuss.elastic.co/t/logstash-goes-wrong-after-add-filter/278730)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 26\ **Last updated:** [July 21, 2021, 10:20am UTC](https://discuss.elastic.co/t/logstash-goes-wrong-after-add-filter/278730 "2021-07-21T10:20:07Z")
Hello everyone, I install Logstash in Ubuntu 18 with two conf.d file input and output. Everything run normally. But when I add 10-syslog-filter.conf something went wrong. 02-beat-input.conf input { beats { host… --- ## [How to remove backslash from weird formatted json](https://discuss.elastic.co/t/how-to-remove-backslash-from-weird-formatted-json/279084)
**Author:** [@MaxenceVacheron](https://discuss.elastic.co/u/MaxenceVacheron)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 10:11am UTC](https://discuss.elastic.co/t/how-to-remove-backslash-from-weird-formatted-json/279084 "2021-07-21T10:11:19Z")
Hello :raised\_hand\_with\_fingers\_splayed:, I have the following (valid) formatted json of which I can't change the formatting : \[{ "id": "1", "sn": "00:1E:C0:8D:9A:CD", "log": "{\\"date\\":\\"16\\/04\\/2021\\",\\"t… --- ## [Set up dashboards for Logstash Output](https://discuss.elastic.co/t/set-up-dashboards-for-logstash-output/278989)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 18\ **Last updated:** [July 21, 2021, 10:07am UTC](https://discuss.elastic.co/t/set-up-dashboards-for-logstash-output/278989 "2021-07-21T10:07:46Z")
Hi community, I would like to enable dashboards in kibana for metricbeat, heartbeat, filebeat and winlogbeat. On the documentation it says to pass these commands when logstash is in output. What are the settings when … --- ## [403 Forbidden when trying to send logs using Filebeat](https://discuss.elastic.co/t/403-forbidden-when-trying-to-send-logs-using-filebeat/279249)
**Author:** [@OksanaH](https://discuss.elastic.co/u/OksanaH)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 10:04am UTC](https://discuss.elastic.co/t/403-forbidden-when-trying-to-send-logs-using-filebeat/279249 "2021-07-21T10:04:13Z")
I'm using Filebeat OSS licenced version 7.10, and AWS ElasticSearch 7.10. I use a reverse logging proxy and set up auth like this:proxy\_set\_header Authorization ""; When configuring Filebeat, I use Basic Auth (username… --- ## [Mapper\_parsing\_exception when trying to append object to array](https://discuss.elastic.co/t/mapper-parsing-exception-when-trying-to-append-object-to-array/279071)
**Author:** [@sandbender](https://discuss.elastic.co/u/sandbender)\ **Replies:** 5\ **Last updated:** [July 21, 2021, 9:55am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-when-trying-to-append-object-to-array/279071 "2021-07-21T09:55:25Z")
Hello, I'm having trouble to append objects resulting from an enrich processor to a field, so that I'm ending up with an array of objects. This question seems to have been asked a lot but still I couldn't make it work s… --- ## [How to search \\t \\r \\n in elasticsearch?](https://discuss.elastic.co/t/how-to-search-t-r-n-in-elasticsearch/278984)
**Author:** [@MarvinLiu](https://discuss.elastic.co/u/MarvinLiu)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 9:14am UTC](https://discuss.elastic.co/t/how-to-search-t-r-n-in-elasticsearch/278984 "2021-07-19T09:14:23Z")
I want to search \\t \\r \\n in my doc, how to input in query string syntax. It seems "\\n" can work , "\\n","\\n" not work , Is there any other choises? POST /test6/\_doc/2 { "id": 1002, "name": "test1", "desc"… --- ## [Delay betbeen timestamp and event.created on Winlogbeat](https://discuss.elastic.co/t/delay-betbeen-timestamp-and-event-created-on-winlogbeat/279182)
**Author:** [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 3:43pm UTC](https://discuss.elastic.co/t/delay-betbeen-timestamp-and-event-created-on-winlogbeat/279182 "2021-07-20T15:43:42Z")
Hello! The problem We have unpredictable flating delay betbeen timestamp and event.created, when process logs with Winlogbeat. Background We use WEF to send logs from Windows host to Windows log collector. Then we us… --- ## [Change interval while viewing a dashboard, without editing?](https://discuss.elastic.co/t/change-interval-while-viewing-a-dashboard-without-editing/279158)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 7:50am UTC](https://discuss.elastic.co/t/change-interval-while-viewing-a-dashboard-without-editing/279158 "2021-07-21T07:50:26Z")
Background to this question Feedback from a user viewing a Kibana dashboard I've developed: can we set the interval of time-based charts to 1 hour? An excerpt of my response: Yes. However, I have deliberately set t… --- ## [CCR user permission issue. action \[cluster:admin/settings/update\] is unauthorized for user \[my-certificate-cn\]](https://discuss.elastic.co/t/ccr-user-permission-issue-action-cluster-admin-settings-update-is-unauthorized-for-user-my-certificate-cn/279055)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 7:35am UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-action-cluster-admin-settings-update-is-unauthorized-for-user-my-certificate-cn/279055 "2021-07-21T07:35:49Z")
I have deployed Elasticsearch 7.7.1. I have created certificate which includes CN=my-certificate-cn and configured transport layer with it. I have created two roles - ccr\_leader and ccr\_follower in accordance with the d… --- ## [Elastic search Data fetch](https://discuss.elastic.co/t/elastic-search-data-fetch/279231)
**Author:** [@Hamendra\_Sunthwal](https://discuss.elastic.co/u/Hamendra_Sunthwal)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 7:19am UTC](https://discuss.elastic.co/t/elastic-search-data-fetch/279231 "2021-07-21T07:19:07Z")
I am using below script to fetch data from Elastic search, I want to know how the data is being fetched from Magento to ES. This script get me product details in Output, but for some product the data is incorrect i need… --- ## [Packetbeat not see some trafic](https://discuss.elastic.co/t/packetbeat-not-see-some-trafic/279229)
**Author:** [@franpom](https://discuss.elastic.co/u/franpom)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 7:05am UTC](https://discuss.elastic.co/t/packetbeat-not-see-some-trafic/279229 "2021-07-21T07:05:10Z")
Hello, I am trying to set up a sniffer with packetbeat. The sniffer receives the traffic via several mirroring of vlan at the level of a switch. It works very well except for a case identified on a vlan with which I ha… --- ## [Dissector mapping field not found in event](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179)
**Author:** [@gongon](https://discuss.elastic.co/u/gongon)\ **Replies:** 13\ **Last updated:** [July 21, 2021, 6:59am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179 "2021-07-21T06:59:16Z")
Hi, I used the dissect filter and it worked .Now it does not. The only change is the upgrate of mac Os Catalina to mac OS Big Sur v 11.4 A message is displayed : Dissector mapping field not found in event Could you … --- ## [\[ES v7.5.1\] Speed up snapshot restore from GCS Snapshot Repository](https://discuss.elastic.co/t/es-v7-5-1-speed-up-snapshot-restore-from-gcs-snapshot-repository/278974)
**Author:** [@amitsh728](https://discuss.elastic.co/u/amitsh728)\ **Replies:** 8\ **Last updated:** [July 21, 2021, 5:54am UTC](https://discuss.elastic.co/t/es-v7-5-1-speed-up-snapshot-restore-from-gcs-snapshot-repository/278974 "2021-07-21T05:54:44Z")
Hello, We are trying to speed up our snapshot restoration speed in our ES cluster hosted on GCP Compute instances. TL;DR: Current Performance: 56 MBps per data node Infra Capable of 500 MBps We want to improve our re… --- ## [Logstash POS Log Transaction (TLogs) to JSON](https://discuss.elastic.co/t/logstash-pos-log-transaction-tlogs-to-json/279213)
**Author:** [@Anil\_Khiani](https://discuss.elastic.co/u/Anil_Khiani)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:45am UTC](https://discuss.elastic.co/t/logstash-pos-log-transaction-tlogs-to-json/279213 "2021-07-21T05:45:59Z")
Hi Everyone, I have below log from IBM 4690 POS systems generating Transaction Logs (TLogs) as below "::p:�:�:�:�:U:!a" ":p::D::�::�::�::!a:U: P:�:�:#:�:�:",":�!8qg4:�:�P:�::�",":�!8qg4:�:�P:�:�F:�",":�!8qg4:�:�:�::d",… --- ## [請教如何令filebeat做到多個indexes配上不同template和ilm](https://discuss.elastic.co/t/filebeat-indexes-template-ilm/277106)
**Author:** [@cecil](https://discuss.elastic.co/u/cecil)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 3:33am UTC](https://discuss.elastic.co/t/filebeat-indexes-template-ilm/277106 "2021-07-21T03:33:45Z")
我是新手，已測試了filebeat如何取得多個不同log源，也試了單一ilm是怎樣發生，也稍為明白template的用途。 現在有一個以下問題，目標是在同一伺服器上，把/var/log/syslog和/var/log/auth.log經filebeat分別套用在不同template上，然後各自也配不同ilm 例如syslog的ilm是hot 1day, delete 30days，而auth.log的ilm是hot 30 day, … --- ## [Kibana 7.10.2 build from src code failing due to socket hang up](https://discuss.elastic.co/t/kibana-7-10-2-build-from-src-code-failing-due-to-socket-hang-up/278982)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:13am UTC](https://discuss.elastic.co/t/kibana-7-10-2-build-from-src-code-failing-due-to-socket-hang-up/278982 "2021-07-21T05:13:10Z")
Hi, Kibana version: 7.10.2 I am trying to build kibana-oss rpm from src code (for centos env) following the procedure from developer guide. The required pre-req dependencies (git,gcc etc) are installed, kibana bootstr… --- ## [Metricbeat: collects k8s pods cpu which is lower than actually used](https://discuss.elastic.co/t/metricbeat-collects-k8s-pods-cpu-which-is-lower-than-actually-used/279215)
**Author:** [@SperChung-11](https://discuss.elastic.co/u/SperChung-11)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 2:17am UTC](https://discuss.elastic.co/t/metricbeat-collects-k8s-pods-cpu-which-is-lower-than-actually-used/279215 "2021-07-21T02:17:31Z")
We are using metricbeat to collects k8s pods cpu. In the beginning, it can collects the cpu collectly. After running for serveral weeks or serveral months, we found that the pods cpu metricbeat collects is lower than act… --- ## [RUBY Filter to event.set each entity in an Array](https://discuss.elastic.co/t/ruby-filter-to-event-set-each-entity-in-an-array/277749)
**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 12:42am UTC](https://discuss.elastic.co/t/ruby-filter-to-event-set-each-entity-in-an-array/277749 "2021-07-21T00:42:44Z")
I am stuck on how to use a Ruby script to manipulate a field with in an array. If anyone can help with this I need to take the Field "\[body\]\[entities\]\[sentiment\]\[confidence\]" and \* 100 and add that as another Field "\[bod… --- ## [Kibana dashboard multiple panels and filtering](https://discuss.elastic.co/t/kibana-dashboard-multiple-panels-and-filtering/279116)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 10:43pm UTC](https://discuss.elastic.co/t/kibana-dashboard-multiple-panels-and-filtering/279116 "2021-07-20T22:43:44Z")
Hi, I have a dashboard containing multiple panels which use different indices. But when I use a filter on one of the panels. It is applied to other panels too which use different indices. Which means filter operation f… --- ## [Date processor error](https://discuss.elastic.co/t/date-processor-error/279173)
**Author:** [@omurad](https://discuss.elastic.co/u/omurad)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 9:36pm UTC](https://discuss.elastic.co/t/date-processor-error/279173 "2021-07-20T21:36:04Z")
I'm looking to parse the following date using the "Date" ingest processor 20/Jul/2021:07:28:46 --0400 I tried doing so using these formats dd/MMM/yyyy:HH:mm:ss -ZZZZZ dd/MMM/yyyy:HH:mm:ss '-'ZZZZZ However, I get the… --- ## [Object type vs Data type in Filebeat](https://discuss.elastic.co/t/object-type-vs-data-type-in-filebeat/279185)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 8:25pm UTC](https://discuss.elastic.co/t/object-type-vs-data-type-in-filebeat/279185 "2021-07-20T20:25:57Z")
Hello, I'm circling back on this older discussion I posted about object type vs concrete types trying to push data to elasticsearch using filebeat: The error I've been running into is this: {"type":"mapper\_parsing\_e… --- ## [Difference between using (in the Field Metric) Count and Unique Count](https://discuss.elastic.co/t/difference-between-using-in-the-field-metric-count-and-unique-count/278173)
**Author:** [@rosammb](https://discuss.elastic.co/u/rosammb)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 7:55pm UTC](https://discuss.elastic.co/t/difference-between-using-in-the-field-metric-count-and-unique-count/278173 "2021-07-20T19:55:03Z")
Hi, I'm using 6.8.3 Elastic version. I'm having problems when I create visualizes and using the Field Metric. If I use Unique count the result is different than if I use count. My feeling is that Unique count is the co… --- ## [Elasticsearch: отказ работоспособности](https://discuss.elastic.co/t/elasticsearch/279181)
**Author:** [@Vladimir2](https://discuss.elastic.co/u/Vladimir2)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 7:41pm UTC](https://discuss.elastic.co/t/elasticsearch/279181 "2021-07-20T19:41:59Z")
При выполнении запросов к elasticsearch (v.2.4.6.) возрастает нагрузка на процессор, курсоры перестают возвращаться (запрос отдает ошибку), статус кластера меняется на YELLOW, в итоге эластик перестает отвечать. Как счит… --- ## [Kibana icon colorless](https://discuss.elastic.co/t/kibana-icon-colorless/279187)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 7:31pm UTC](https://discuss.elastic.co/t/kibana-icon-colorless/279187 "2021-07-20T19:31:11Z")
Hi, Updated from 7.10.2 to 7.13.3. Kibana favicon seems colorless. Any specific reason? Is this an indication to a problem? Thanks. --- ## [Watcher is not returning any hit and returns Null](https://discuss.elastic.co/t/watcher-is-not-returning-any-hit-and-returns-null/278676)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 7\ **Last updated:** [July 20, 2021, 7:25pm UTC](https://discuss.elastic.co/t/watcher-is-not-returning-any-hit-and-returns-null/278676 "2021-07-20T19:25:45Z")
Hi, I created one watcher but the condition is not getting successful and returning hit =0, and finally, it is returning a null value. When I built the dashboard using the same condition value is getting displayed there,… [Previous page](https://discuss.elastic.co/latest.md?page=1562) [Next page](https://discuss.elastic.co/latest.md?page=1564)