# Latest **URL:** https://discuss.elastic.co/latest.md?page=1575 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1576 --- ## [Logstash record\_last\_run updated on output issue](https://discuss.elastic.co/t/logstash-record-last-run-updated-on-output-issue/278570)
**Author:** [@spawnrider](https://discuss.elastic.co/u/spawnrider)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 5:10pm UTC](https://discuss.elastic.co/t/logstash-record-last-run-updated-on-output-issue/278570 "2021-07-13T17:10:21Z")
Hi, Why Logstash (JDBC input plugin) is recording the "Record Last Run" timestamp in the metadata file even if there is an issue on the output ? I had an connection issue (due to network) to the Elasticsearch instance … --- ## [Kibana visualization to calculate percentage](https://discuss.elastic.co/t/kibana-visualization-to-calculate-percentage/278553)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 6\ **Last updated:** [July 13, 2021, 4:44pm UTC](https://discuss.elastic.co/t/kibana-visualization-to-calculate-percentage/278553 "2021-07-13T16:44:44Z")
All, I am trying to calculate percentage based on hits with filter query for example index=test and status=disconnected - disconnected\_hits index=test total\_hits percentage = disconnected\_hits/total\_hits \* 100 f… --- ## [Incident management with ServiceNow and Elasticsearch](https://discuss.elastic.co/t/incident-management-with-servicenow-and-elasticsearch/278579)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 4:39pm UTC](https://discuss.elastic.co/t/incident-management-with-servicenow-and-elasticsearch/278579 "2021-07-13T16:39:40Z")
I have followed part 1 and part 2 Everything works great. Only minor issue is its creating duplicate incidents. If i put throttle period then if some other app has status down , it wont trigger an incident :frowning: if… --- ## [Kibana Data table with different relative dates per row](https://discuss.elastic.co/t/kibana-data-table-with-different-relative-dates-per-row/278560)
**Author:** [@Ivan\_Doronin](https://discuss.elastic.co/u/Ivan_Doronin)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 4:32pm UTC](https://discuss.elastic.co/t/kibana-data-table-with-different-relative-dates-per-row/278560 "2021-07-13T16:32:26Z")
I have logs of user logins. I need to build a table where I can see login activity of starting the first time he/she logged in, and each column would be another day( 2nd, 3rd) It would look something like this Issue… --- ## [Vega Help Infinite extent for field "FIELDNAME": \[Infinity, -Infinity\]](https://discuss.elastic.co/t/vega-help-infinite-extent-for-field-fieldname-infinity-infinity/277485)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 10\ **Last updated:** [July 13, 2021, 4:20pm UTC](https://discuss.elastic.co/t/vega-help-infinite-extent-for-field-fieldname-infinity-infinity/277485 "2021-07-13T16:20:45Z")
I'm by no means a coder and am trying to do something that I think should be relatively simple. I have an index that has the following fields (plus others): \_source.name", "\_source\['it\_debt\_applies'\]", "\_source\['it\_d… --- ## [Can I change the elastic built-in user password?](https://discuss.elastic.co/t/can-i-change-the-elastic-built-in-user-password/278573)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 4:00pm UTC](https://discuss.elastic.co/t/can-i-change-the-elastic-built-in-user-password/278573 "2021-07-13T16:00:38Z")
Hi, I was wandering if I can change the password of the elastic user. after its set trough bin/elasticsearch-setup-passwords ? Thanks. --- ## [Grokparsefailure when %{TIMESTAMP\_ISO8601} pattern is in the first position parser](https://discuss.elastic.co/t/grokparsefailure-when-timestamp-iso8601-pattern-is-in-the-first-position-parser/278308)
**Author:** [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\ **Replies:** 5\ **Last updated:** [July 13, 2021, 3:38pm UTC](https://discuss.elastic.co/t/grokparsefailure-when-timestamp-iso8601-pattern-is-in-the-first-position-parser/278308 "2021-07-13T15:38:25Z")
Hi Elastic Team, I have a issue when in my grok filter y put first the pattern %{TIMESTAMP\_ISO8601}. I share a example: With %{TIMESTAMP\_ISO8601} at first position: grok Debugger: I got \[1\] "\_grokparsefailure" … --- ## [Using CCR For Cluster Migration](https://discuss.elastic.co/t/using-ccr-for-cluster-migration/278441)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 3:13pm UTC](https://discuss.elastic.co/t/using-ccr-for-cluster-migration/278441 "2021-07-13T15:13:21Z")
I am looking at standing up a new Elasticsearch cluster and migrating from our current single node. What's the best way for moving our existing data, about 10TB to the new cluster? Would CCR facilitate the move best? I… --- ## [Elasticsearch index life cycle name rollover](https://discuss.elastic.co/t/elasticsearch-index-life-cycle-name-rollover/278544)
**Author:** [@opentokix](https://discuss.elastic.co/u/opentokix)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 2:59pm UTC](https://discuss.elastic.co/t/elasticsearch-index-life-cycle-name-rollover/278544 "2021-07-13T14:59:16Z")
When I configure ILM it will create an index with 000001, what happens when you roll over for 999999? Will it just start over again, and no worries. Only reason it's a large number is to make sure it's not the same twice… --- ## [Can somebody tell me what is in this log?](https://discuss.elastic.co/t/can-somebody-tell-me-what-is-in-this-log/278547)
**Author:** [@Vladimir](https://discuss.elastic.co/u/Vladimir)\ **Replies:** 6\ **Last updated:** [July 13, 2021, 2:58pm UTC](https://discuss.elastic.co/t/can-somebody-tell-me-what-is-in-this-log/278547 "2021-07-13T14:58:51Z")
I can not start Elastic although I can do it few days before. root@vmi503579:~# journalctl -ex Jul 13 15:27:55 vmi503579.contaboserver.net kernel: \[ 884825\] 33 884825 59113 6477 241664 686 0… --- ## [Get metrics for pods that no longer exist](https://discuss.elastic.co/t/get-metrics-for-pods-that-no-longer-exist/278558)
**Author:** [@George\_Guliman](https://discuss.elastic.co/u/George_Guliman)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 2:56pm UTC](https://discuss.elastic.co/t/get-metrics-for-pods-that-no-longer-exist/278558 "2021-07-13T14:56:16Z")
Hello, Can someone recommend me a method to get metrics for CPU and memory for pods that no longer exist. The reason for which they no longer exist doesn't really matter, they could have been evicted, delete by someone,… --- ## [Problem with Top N in TSVB](https://discuss.elastic.co/t/problem-with-top-n-in-tsvb/278433)
**Author:** [@LL\_FED](https://discuss.elastic.co/u/LL_FED)\ **Replies:** 3\ **Last updated:** [July 13, 2021, 2:25pm UTC](https://discuss.elastic.co/t/problem-with-top-n-in-tsvb/278433 "2021-07-13T14:25:07Z")
Hi everyone, i have two problems with the top N function in the TSVB. Problem1: If I use "Group by" Terms and i set the value of Top to for example 50, but i only have 30 different terms, than the TopN function doesn't… --- ## [Filter(dropdown) at individual visualization using Vega-lite](https://discuss.elastic.co/t/filter-dropdown-at-individual-visualization-using-vega-lite/278376)
**Author:** [@soviek](https://discuss.elastic.co/u/soviek)\ **Replies:** 3\ **Last updated:** [July 13, 2021, 2:23pm UTC](https://discuss.elastic.co/t/filter-dropdown-at-individual-visualization-using-vega-lite/278376 "2021-07-13T14:23:04Z")
How to create filter or dropdown at individual visualization level using Vega-lite. Our current Elasticsearch and Kibana version is 7.9.3. We are aware of Kibana's Control-Visualization at Dashboard level. But wanted t… --- ## [How can i combine the information of two indexes with kibana lens?](https://discuss.elastic.co/t/how-can-i-combine-the-information-of-two-indexes-with-kibana-lens/278242)
**Author:** [@alprde](https://discuss.elastic.co/u/alprde)\ **Replies:** 6\ **Last updated:** [July 13, 2021, 1:57pm UTC](https://discuss.elastic.co/t/how-can-i-combine-the-information-of-two-indexes-with-kibana-lens/278242 "2021-07-13T13:57:47Z")
I have two indexes named market place and stalls. How many stalls in which market place? How can I show this with kibana lens? marketplace fields: id name stalls fields: id stall\_no marketplace\_id --- ## [Permanently retaining all snapshot segments](https://discuss.elastic.co/t/permanently-retaining-all-snapshot-segments/278475)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 1:56pm UTC](https://discuss.elastic.co/t/permanently-retaining-all-snapshot-segments/278475 "2021-07-13T13:56:09Z")
I'm a little confused on the behavior of the snapshotting process, and how to configure it to support our use case. In our use case, we are collecting time-based log events from a variety of different servers that we ho… --- ## [Aggregate filter plugin session duration](https://discuss.elastic.co/t/aggregate-filter-plugin-session-duration/278099)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 13\ **Last updated:** [July 13, 2021, 1:51pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-session-duration/278099 "2021-07-13T13:51:28Z")
Hello, Reviewing ways to calculate session duration and using transforms I was able to calculate session duration by finding the min and max time between timestamps. This is fine except in cases where there is no uniqu… --- ## [Filter for parsing Forticlient, Fortiweb, Fortisandbox, Fortimail](https://discuss.elastic.co/t/filter-for-parsing-forticlient-fortiweb-fortisandbox-fortimail/278549)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 1:47pm UTC](https://discuss.elastic.co/t/filter-for-parsing-forticlient-fortiweb-fortisandbox-fortimail/278549 "2021-07-13T13:47:34Z")
Hello everyone. Who ever integration to Elastic Fortinet production - Forticlient AV, FortiWeb, Fortisandbox, Fortimail ? --- ## [Cases as Metrics](https://discuss.elastic.co/t/cases-as-metrics/278545)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 1:20pm UTC](https://discuss.elastic.co/t/cases-as-metrics/278545 "2021-07-13T13:20:07Z")
Hi All, I was wondering if anyone has any ideas for how to use cases within Elastic security for gathering/reporting metrics? I'm looking for collecting metrics like, mean time to detection, mean time to mitigation, me… --- ## [Using Metricbeat to monitor multiple machines at once](https://discuss.elastic.co/t/using-metricbeat-to-monitor-multiple-machines-at-once/278543)
**Author:** [@Farah](https://discuss.elastic.co/u/Farah)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 1:12pm UTC](https://discuss.elastic.co/t/using-metricbeat-to-monitor-multiple-machines-at-once/278543 "2021-07-13T13:12:18Z")
I am using the elastic stack to monitor an IT infrastructure, I'm new to the elk and I want to know what are the best practices. Let's say this solution would be deployed on a NOC would it be better to use Ansible or D… --- ## [Multiple kubernetes cluster in kibana](https://discuss.elastic.co/t/multiple-kubernetes-cluster-in-kibana/277973)
**Author:** [@milena\_uehara](https://discuss.elastic.co/u/milena_uehara)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 1:05pm UTC](https://discuss.elastic.co/t/multiple-kubernetes-cluster-in-kibana/277973 "2021-07-13T13:05:56Z")
Is it possible to have multiple k8s cluster in kibana? For example, dev cluster, stg cluster and prod cluster? The cluster is in AWS EKS. --- ## [Different cluster ID for nodes](https://discuss.elastic.co/t/different-cluster-id-for-nodes/277440)
**Author:** [@Rojal\_Paul](https://discuss.elastic.co/u/Rojal_Paul)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 1:05pm UTC](https://discuss.elastic.co/t/different-cluster-id-for-nodes/277440 "2021-07-13T13:05:50Z")
I tried to join the cluster, when i am see the status the cluster names are correct but cluster ID is different for each nodes. I have 3 nodes ELKN1,ELKN2,ELKN3. I also added the cluster status image it showing … --- ## [SQL query cannot extract SQL indices](https://discuss.elastic.co/t/sql-query-cannot-extract-sql-indices/278192)
**Author:** [@olliegator](https://discuss.elastic.co/u/olliegator)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 1:03pm UTC](https://discuss.elastic.co/t/sql-query-cannot-extract-sql-indices/278192 "2021-07-13T13:03:50Z")
Hi, I am trying to perform a simple query using the Elasticsearch query API in Elasticsearch 7.7.0: POST /\_sql?format=txt { "query": "SELECT my\_field FROM my\_index" } I am getting the following error: { "err… --- ## [Are Beats designed to be used with ILM?](https://discuss.elastic.co/t/are-beats-designed-to-be-used-with-ilm/278168)
**Author:** [@kodka](https://discuss.elastic.co/u/kodka)\ **Replies:** 4\ **Last updated:** [July 13, 2021, 1:02pm UTC](https://discuss.elastic.co/t/are-beats-designed-to-be-used-with-ilm/278168 "2021-07-13T13:02:08Z")
I'm trying to implement ILM to Filebeat indices, but this popped up in the process: We have different Filebeat versions and multiple modules like docker, access, and many others, but for simplicity, let's take a look at… --- ## [Filebeat: Configuring input from URL](https://discuss.elastic.co/t/filebeat-configuring-input-from-url/278195)
**Author:** [@Conor\_Hennessy](https://discuss.elastic.co/u/Conor_Hennessy)\ **Replies:** 3\ **Last updated:** [July 13, 2021, 12:59pm UTC](https://discuss.elastic.co/t/filebeat-configuring-input-from-url/278195 "2021-07-13T12:59:46Z")
Hi All, I have used filebeat to parse and send an xml to elasticsearch and it has worked nicely. The xml file was downloaded from a url (something like example.com/example.xml) and I then included the path to the downlo… --- ## [Azure Filebeat issues with dashboard setup and data ingestion](https://discuss.elastic.co/t/azure-filebeat-issues-with-dashboard-setup-and-data-ingestion/274823)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 13\ **Last updated:** [July 13, 2021, 12:56pm UTC](https://discuss.elastic.co/t/azure-filebeat-issues-with-dashboard-setup-and-data-ingestion/274823 "2021-07-13T12:56:56Z")
Hi people, I am currently new to elk stack and have set up elk locally and also have an elastic cloud instance. So as part of the learning phase I am trying to use filebeat to consume data from Azure. I have followed … --- ## [CEF codec outputting multiple CEF logs into single CEF l](https://discuss.elastic.co/t/cef-codec-outputting-multiple-cef-logs-into-single-cef-l/278477)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 4\ **Last updated:** [July 13, 2021, 12:35pm UTC](https://discuss.elastic.co/t/cef-codec-outputting-multiple-cef-logs-into-single-cef-l/278477 "2021-07-13T12:35:13Z")
Hey Everyone, I am having an issue when I output to a syslog sever using the CEF codec from the logs we receive from Filbeat. The logs contain mulitple individual CEF longs into one log, so sometimes you can get 3 diff… --- ## [\[bug query\] duplication mac address in hosts metadata - concern?](https://discuss.elastic.co/t/bug-query-duplication-mac-address-in-hosts-metadata-concern/278370)
**Author:** [@kortschak](https://discuss.elastic.co/u/kortschak)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 12:51pm UTC](https://discuss.elastic.co/t/bug-query-duplication-mac-address-in-hosts-metadata-concern/278370 "2021-07-13T12:51:00Z")
Hi, While working through the creating a beat tutorial I noticed that mac addresses may be duplicated in the hosts metadata on linux. This occurs for virbr interfaces due to virtual bridges generating two interfaces, sh… --- ## [Status bar is out of an order(how to set missing value of sum)](https://discuss.elastic.co/t/status-bar-is-out-of-an-order-how-to-set-missing-value-of-sum/278396)
**Author:** [@paigekim](https://discuss.elastic.co/u/paigekim)\ **Replies:** 5\ **Last updated:** [July 13, 2021, 12:03pm UTC](https://discuss.elastic.co/t/status-bar-is-out-of-an-order-how-to-set-missing-value-of-sum/278396 "2021-07-13T12:03:27Z")
Hello, I am currently using Kibana to analayze our revenues using stacked bars each months per year. There is a minor issue that I would like to fix but had a hard time how to do. For example, the values start from Marc… --- ## [Hot shards get allocated to cold nodes](https://discuss.elastic.co/t/hot-shards-get-allocated-to-cold-nodes/278257)
**Author:** [@Matthew\_Field](https://discuss.elastic.co/u/Matthew_Field)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 11:37am UTC](https://discuss.elastic.co/t/hot-shards-get-allocated-to-cold-nodes/278257 "2021-07-13T11:37:59Z")
Hi, I setup ILM, but was surprised to find that upon index creation my index shards were allocated to both hot and cold nodes. I am on version 7.13.2 I have 3 hot nodes and 2 cold nodes 10.2.6.4 46 88 2 0.25 0.35 0.4… --- ## [Logstash line codec not visible](https://discuss.elastic.co/t/logstash-line-codec-not-visible/278529)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 11:35am UTC](https://discuss.elastic.co/t/logstash-line-codec-not-visible/278529 "2021-07-13T11:35:26Z")
Not real where to go from where. I can see the codec: C:\\logstash-7.11.0\\bin\>logstash-plugin list Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-14.0.1 WARNING, using JAVA\_HOME while Logstash distribution comes… [Previous page](https://discuss.elastic.co/latest.md?page=1574) [Next page](https://discuss.elastic.co/latest.md?page=1576)