# Latest **URL:** https://discuss.elastic.co/latest.md?page=1569 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1570 --- ## [Verification\_exception Error during Rule Execution](https://discuss.elastic.co/t/verification-exception-error-during-rule-execution/275781)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 3\ **Last updated:** [July 16, 2021, 6:02pm UTC](https://discuss.elastic.co/t/verification-exception-error-during-rule-execution/275781 "2021-07-16T18:02:43Z")
Hi there, I am facing a particular error regarding many pre-built Elastic rules. Once they were activated, many of them start failing when executing - with the error: An error occurred during rule execution: message: "v… --- ## [Double whitespace in Exception's field's value](https://discuss.elastic.co/t/double-whitespace-in-exceptions-fields-value/277909)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 5:39pm UTC](https://discuss.elastic.co/t/double-whitespace-in-exceptions-fields-value/277909 "2021-07-16T17:39:40Z")
Hi there, I am trying to add an exception to a rule where these are the details given: Field: winlog.event\_data.ParentCommandLine Operator: is Value: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -… --- ## [Search - Request Entity Too Large](https://discuss.elastic.co/t/search-request-entity-too-large/277445)
**Author:** [@Intech\_Ops6](https://discuss.elastic.co/u/Intech_Ops6)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 5:16pm UTC](https://discuss.elastic.co/t/search-request-entity-too-large/277445 "2021-07-16T17:16:27Z")
Kibana version: Kibana 6.8.0 Elasticsearch version: AWS ES/Kibana 6.8.0 Describe the bug: SearchError: Request Entity Too Large at https://name-domain.com/\_plugin/kibana/bundles/kibana.bundle.js:2:583038 at… --- ## [Logstash mapping logfile time to @timestamp](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772)
**Author:** [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Replies:** 5\ **Last updated:** [July 16, 2021, 5:11pm UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772 "2021-07-16T17:11:18Z")
Hi Team, Im trying to map the logfile time with @timestamp in logstash. The logfile time is in IST. I would require some help in converting the logfile time to UTC and map it to @timestamp. I used the below ruby code… --- ## [I encountered three security-related issues when using elasticserrch version 7.6.1. Thank you for your help](https://discuss.elastic.co/t/i-encountered-three-security-related-issues-when-using-elasticserrch-version-7-6-1-thank-you-for-your-help/278838)
**Author:** [@yupengj](https://discuss.elastic.co/u/yupengj)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 4:52pm UTC](https://discuss.elastic.co/t/i-encountered-three-security-related-issues-when-using-elasticserrch-version-7-6-1-thank-you-for-your-help/278838 "2021-07-16T16:52:39Z")
I encountered three security-related issues when using elasticserrch version 7.6.1. Thank you for your help. How does elasticserrch configure http response headers, such as X-Content-Type-Options, X-XSS-Protection, Con… --- ## [Unable to login in Kibana after enable x-pack](https://discuss.elastic.co/t/unable-to-login-in-kibana-after-enable-x-pack/275862)
**Author:** [@Fabio1](https://discuss.elastic.co/u/Fabio1)\ **Replies:** 9\ **Last updated:** [July 16, 2021, 4:08pm UTC](https://discuss.elastic.co/t/unable-to-login-in-kibana-after-enable-x-pack/275862 "2021-07-16T16:08:57Z")
Hello, I was using elasticsearch and kibana without problem, but I need to enable some features related with users (to create some accounts and give some permissions to some users), so I need to enable x-pack option to … --- ## [Copy\_to field not searchable as I would expect](https://discuss.elastic.co/t/copy-to-field-not-searchable-as-i-would-expect/278727)
**Author:** [@tasslehawf](https://discuss.elastic.co/u/tasslehawf)\ **Replies:** 2\ **Last updated:** [July 16, 2021, 3:59pm UTC](https://discuss.elastic.co/t/copy-to-field-not-searchable-as-i-would-expect/278727 "2021-07-16T15:59:33Z")
Here is my index: { "settings": { "analysis": { "normalizer": { "keyword\_lowercase": { "type": "custom", "filter": \[ "lowercase", "asciifolding" … --- ## [Filebeat does not pickup rotated logfile from NLog](https://discuss.elastic.co/t/filebeat-does-not-pickup-rotated-logfile-from-nlog/278923)
**Author:** [@paleocomburo](https://discuss.elastic.co/u/paleocomburo)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-does-not-pickup-rotated-logfile-from-nlog/278923 "2021-07-16T15:54:20Z")
Hello, I'm currently trying to get our structured event logging into Elastic Search. We have a .NET 5 application that is running in a Docker container and it runs on a CentOS 7 server, where it writes the log to a serv… --- ## [Showing data hourly](https://discuss.elastic.co/t/showing-data-hourly/278777)
**Author:** [@prathamesh7](https://discuss.elastic.co/u/prathamesh7)\ **Replies:** 7\ **Last updated:** [July 16, 2021, 3:38pm UTC](https://discuss.elastic.co/t/showing-data-hourly/278777 "2021-07-16T15:38:22Z")
Hi Team, I need to display results of filter i am running in visualisation to show for each hour of a day. When i run filter, i can see date for today but not each hour of day , it is showing with gap of 3 hours, so my… --- ## [Basic understating regarding index creation](https://discuss.elastic.co/t/basic-understating-regarding-index-creation/278189)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 9\ **Last updated:** [July 16, 2021, 3:34pm UTC](https://discuss.elastic.co/t/basic-understating-regarding-index-creation/278189 "2021-07-16T15:34:58Z")
Hi Team, I am facing issue where I can see index has not got created after some changes in logstash pipeline file. Can you please help me with below questions to understand. I am finding difficulty in getting it. I ha… --- ## [Hourly displaying of data](https://discuss.elastic.co/t/hourly-displaying-of-data/278695)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 10\ **Last updated:** [July 16, 2021, 3:29pm UTC](https://discuss.elastic.co/t/hourly-displaying-of-data/278695 "2021-07-16T15:29:02Z")
Hi Team, I have log file from which I am filtering specific words and I want to create curl request that will show results based on each hours of current day. In below screenshot, when I select Date histogram on @times… --- ## [Custom regexes.yml](https://discuss.elastic.co/t/custom-regexes-yml/278921)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 3:08pm UTC](https://discuss.elastic.co/t/custom-regexes-yml/278921 "2021-07-16T15:08:52Z")
Hello, Has anyone had any success/experience replacing the user agent plugin regexes.yml file with an entirely different/custom regexes.yml file? I'm curious if anyone has successfully done it and were you required to … --- ## [In Kibana Line chart graph, unable to show values](https://discuss.elastic.co/t/in-kibana-line-chart-graph-unable-to-show-values/278864)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 2:57pm UTC](https://discuss.elastic.co/t/in-kibana-line-chart-graph-unable-to-show-values/278864 "2021-07-16T14:57:06Z")
Hi all, I'm unable to show values on Kibana Line chart. I'm able to see values when i scroll on value points, but can't get them to be displayed on the chart. Any Turnaround for this? --- ## [Healthcheck based on recent log entries](https://discuss.elastic.co/t/healthcheck-based-on-recent-log-entries/278679)
**Author:** [@ag\_joeb](https://discuss.elastic.co/u/ag_joeb)\ **Replies:** 5\ **Last updated:** [July 16, 2021, 2:55pm UTC](https://discuss.elastic.co/t/healthcheck-based-on-recent-log-entries/278679 "2021-07-16T14:55:46Z")
I'm looking to visualize the following in one my my dashboards. The healthcheck of one of my services would be based on the amount of log entries in the past few seconds; i.e. if there were more than 5 new log entries (… --- ## [How to install Analysis Plugins in Azure Kubernetes version 1.91 in 3 Elasticsearch pods ver. 7.13.3 with ECK 1.6 or any other method](https://discuss.elastic.co/t/how-to-install-analysis-plugins-in-azure-kubernetes-version-1-91-in-3-elasticsearch-pods-ver-7-13-3-with-eck-1-6-or-any-other-method/278915)
**Author:** [@MarkB8](https://discuss.elastic.co/u/MarkB8)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 2:44pm UTC](https://discuss.elastic.co/t/how-to-install-analysis-plugins-in-azure-kubernetes-version-1-91-in-3-elasticsearch-pods-ver-7-13-3-with-eck-1-6-or-any-other-method/278915 "2021-07-16T14:44:29Z")
Need to install plugins for APAC languages and environment is in Azure Kubernetes ver. 1.91 with Elasticsearch ver. 7.13.3 with 3 pods. (master/ingest/client). Instructions seen so far are for VMs in Azure. Analysis Pl… --- ## [Logstash log4j2.properties configuration for logs rotation](https://discuss.elastic.co/t/logstash-log4j2-properties-configuration-for-logs-rotation/278616)
**Author:** [@Kshema](https://discuss.elastic.co/u/Kshema)\ **Replies:** 3\ **Last updated:** [July 16, 2021, 2:37pm UTC](https://discuss.elastic.co/t/logstash-log4j2-properties-configuration-for-logs-rotation/278616 "2021-07-16T14:37:54Z")
In our application, Logstash plain log file - logstas-plain.log is getting converted to a zip file logstash-plain-\.log.gz each day. The zip files are getting piled up and causing a memory issue. Any help on config… --- ## [Multi Search Query SQL API](https://discuss.elastic.co/t/multi-search-query-sql-api/277651)
**Author:** [@Eric\_Barreto](https://discuss.elastic.co/u/Eric_Barreto)\ **Replies:** 2\ **Last updated:** [July 16, 2021, 2:36pm UTC](https://discuss.elastic.co/t/multi-search-query-sql-api/277651 "2021-07-16T14:36:47Z")
Hi, I'm trying to send more than one sql query in the same request, but I'm having problems. I'm testing this request in Dev Tools: POST \_xpack/sql?format=csv {"query":"SELECT sourceIp, count(log\_message) AS Derrota F… --- ## [Aggregate filter](https://discuss.elastic.co/t/aggregate-filter/278817)
**Author:** [@sergio\_junior](https://discuss.elastic.co/u/sergio_junior)\ **Replies:** 7\ **Last updated:** [July 16, 2021, 1:27pm UTC](https://discuss.elastic.co/t/aggregate-filter/278817 "2021-07-16T13:27:18Z")
hello guys, i need help with the aggregate filter. I'm trying to merge these logs' lines into a single event. 2021-07-08 00:00:00,181 INFO \[stdout\] (default task-1876) ###HawbPesquisaInteligenteConverter | Iniciando p… --- ## [How to insert only newly added rows in csv in logstash in old index](https://discuss.elastic.co/t/how-to-insert-only-newly-added-rows-in-csv-in-logstash-in-old-index/278866)
**Author:** [@Sarthak\_Mishra](https://discuss.elastic.co/u/Sarthak_Mishra)\ **Replies:** 4\ **Last updated:** [July 16, 2021, 1:23pm UTC](https://discuss.elastic.co/t/how-to-insert-only-newly-added-rows-in-csv-in-logstash-in-old-index/278866 "2021-07-16T13:23:04Z")
Hi community, If I have a csv with 5 rows and I have shipped it in logstash. In future, the csv gets updated with 5(old) + 2(new) =7 rows. I want to ship the updated csv in the same index. Can I ship only the updated 2(… --- ## [Logstash works but put a lot of 403 errors in log](https://discuss.elastic.co/t/logstash-works-but-put-a-lot-of-403-errors-in-log/278892)
**Author:** [@SzymonZy](https://discuss.elastic.co/u/SzymonZy)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 1:16pm UTC](https://discuss.elastic.co/t/logstash-works-but-put-a-lot-of-403-errors-in-log/278892 "2021-07-16T13:16:01Z")
Hello I have setup els and it seems to work beside many errors: "Got response code '403' contacting Elasticsearch at URL 'https://localhost:9200/logstash'", : exception=\>LogStash::Outputs::ElasticSearch::HttpClient::Po… --- ## [Functionbeat 1.11 cannot process more than one message on cloud function](https://discuss.elastic.co/t/functionbeat-1-11-cannot-process-more-than-one-message-on-cloud-function/278905)
**Author:** [@yerome](https://discuss.elastic.co/u/yerome)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 1:10pm UTC](https://discuss.elastic.co/t/functionbeat-1-11-cannot-process-more-than-one-message-on-cloud-function/278905 "2021-07-16T13:10:35Z")
Hello, When I deploy functionbeat 1.11 on a GCP Cloud function, functionbeat always crashes after having to deal with the second event coming from pub/sub. Error message shows a panic crash like this : WARN\\t\[cfgwarn\]… --- ## [Rollover for an existing index](https://discuss.elastic.co/t/rollover-for-an-existing-index/278904)
**Author:** [@Anirudhan](https://discuss.elastic.co/u/Anirudhan)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 1:10pm UTC](https://discuss.elastic.co/t/rollover-for-an-existing-index/278904 "2021-07-16T13:10:06Z")
Hi I already have an index with the size 89GB. Forgot to add all the rollups in the initial stages. How do i proceed with the rollups. Now want to create an index for each date.Is it possible to do rollups for an existi… --- ## [Query with conditional logic](https://discuss.elastic.co/t/query-with-conditional-logic/278902)
**Author:** [@Sascha\_Gerloff](https://discuss.elastic.co/u/Sascha_Gerloff)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 1:00pm UTC](https://discuss.elastic.co/t/query-with-conditional-logic/278902 "2021-07-16T13:00:59Z")
Hello, I would like to build a query, whose logic depends on a specific field. For example, I have data like this: username: Name1 description: desc1 username: Name2 info: info1 I would like to build a query that m… --- ## [Functionbeat 1.12 and 1.13 cannot deploy on GCP Cloud function](https://discuss.elastic.co/t/functionbeat-1-12-and-1-13-cannot-deploy-on-gcp-cloud-function/278901)
**Author:** [@yerome](https://discuss.elastic.co/u/yerome)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 12:58pm UTC](https://discuss.elastic.co/t/functionbeat-1-12-and-1-13-cannot-deploy-on-gcp-cloud-function/278901 "2021-07-16T12:58:09Z")
Because cloud function uses goland 1.13 and since 1.12 version of functionbeat is using goland 1.15 the deployment doesn't work. At the end of the deployment those errors appear : DEBUG \[gcp\] gcp/cli\_manager.go:47 Depl… --- ## [Elasticsearch 7.13 crash - can not start again](https://discuss.elastic.co/t/elasticsearch-7-13-crash-can-not-start-again/277427)
**Author:** [@Vladimir](https://discuss.elastic.co/u/Vladimir)\ **Replies:** 6\ **Last updated:** [July 16, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-crash-can-not-start-again/277427 "2021-07-16T11:26:33Z")
Hi there, I have Elastic + Kiabana + Logstash + Filebeat installed on Ubuntu 20.04 server. Yesterday everything worked fine together. I happily wrote requests in Kibana console. Today morning I tried to open Kibana but… --- ## [Found in Full-text search scenario，ES 7 slow than ES 5](https://discuss.elastic.co/t/found-in-full-text-search-scenario-es-7-slow-than-es-5/278065)
**Author:** [@zfaster](https://discuss.elastic.co/u/zfaster)\ **Replies:** 4\ **Last updated:** [July 16, 2021, 11:00am UTC](https://discuss.elastic.co/t/found-in-full-text-search-scenario-es-7-slow-than-es-5/278065 "2021-07-16T11:00:53Z")
Planning to upgrade from ES 5.6.7 to ES7.X,； During the test, the index data in ES5 was migrated to ES7, and performance comparison was performed in a specific scenario. It was found that the search time of ES7 decrease… --- ## [What can I do with Kibana Alerts with BASIC - FREE AND OPEN 2 subscription?](https://discuss.elastic.co/t/what-can-i-do-with-kibana-alerts-with-basic-free-and-open-2-subscription/278785)
**Author:** [@nachoenjuto](https://discuss.elastic.co/u/nachoenjuto)\ **Replies:** 8\ **Last updated:** [July 16, 2021, 10:38am UTC](https://discuss.elastic.co/t/what-can-i-do-with-kibana-alerts-with-basic-free-and-open-2-subscription/278785 "2021-07-16T10:38:54Z")
Hi all, I am designing a solution for a customer and one of the requirements is to have alerts, but I am no sure how far I can go with the BASIC - FREE AND OPEN 2 subscription. Does anyone has experience with this? or … --- ## [Как в apm kibana увидеть запросы к базе elastic](https://discuss.elastic.co/t/apm-kibana-elastic/278881)
**Author:** [@Marina\_S](https://discuss.elastic.co/u/Marina_S)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 10:37am UTC](https://discuss.elastic.co/t/apm-kibana-elastic/278881 "2021-07-16T10:37:18Z")
Добрый день. Подскажите, как в apm kibana увидеть запросы к базе elastic как например это видно с запросами к postgres?! --- ## [How to display and play multiple audio file urls in a document field](https://discuss.elastic.co/t/how-to-display-and-play-multiple-audio-file-urls-in-a-document-field/278587)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 4\ **Last updated:** [July 16, 2021, 10:30am UTC](https://discuss.elastic.co/t/how-to-display-and-play-multiple-audio-file-urls-in-a-document-field/278587 "2021-07-16T10:30:58Z")
Hi Elastic Team, The url of the audio file for each call is storing in elastic and defined the format as url type as audio. We have a scenario like each call can have multiple audio files and the filenames will be in a… --- ## [Filebeat autodiscover for local log Docker driver](https://discuss.elastic.co/t/filebeat-autodiscover-for-local-log-docker-driver/278878)
**Author:** [@llsousa](https://discuss.elastic.co/u/llsousa)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 10:21am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-for-local-log-docker-driver/278878 "2021-07-16T10:21:01Z")
Hi, there, first post here. Suppose this Filebeat autodiscover configuration for Docker containers: filebeat.autodiscover: providers: - type: docker hints.enabled: true hints.default\_config.enabled: f… [Previous page](https://discuss.elastic.co/latest.md?page=1568) [Next page](https://discuss.elastic.co/latest.md?page=1570)