# Latest **URL:** https://discuss.elastic.co/latest.md?page=1591 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1592 --- ## [HTTP JSON input: one array one document](https://discuss.elastic.co/t/http-json-input-one-array-one-document/277327)
**Author:** [@thopic](https://discuss.elastic.co/u/thopic)\ **Replies:** 6\ **Last updated:** [July 2, 2021, 1:19pm UTC](https://discuss.elastic.co/t/http-json-input-one-array-one-document/277327 "2021-07-02T13:19:18Z")
Hello, I am using the HTTP JSON input of Filebeat to query some APIs and get some metrics. The problem is for some of them to send a JSON array instead of a JSON object. If I want to make a count of a specific metric, I… --- ## [CSV import in KIBANA without timestamp](https://discuss.elastic.co/t/csv-import-in-kibana-without-timestamp/277352)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 1\ **Last updated:** [July 2, 2021, 1:15pm UTC](https://discuss.elastic.co/t/csv-import-in-kibana-without-timestamp/277352 "2021-07-02T13:15:07Z")
Hello, I have a problem when I upload a CSV document in kibana. I have a Start time, duration, end time in csv: The cells are formatted dd/mm/yyyy hh:mm And in Discover menu, I do not see the timestamp and the gra… --- ## [Add filter to controls on drilldown](https://discuss.elastic.co/t/add-filter-to-controls-on-drilldown/277630)
**Author:** [@SvenSpudat](https://discuss.elastic.co/u/SvenSpudat)\ **Replies:** 1\ **Last updated:** [July 2, 2021, 12:52pm UTC](https://discuss.elastic.co/t/add-filter-to-controls-on-drilldown/277630 "2021-07-02T12:52:15Z")
Hi, I have one question. In a dashboard I have a drilldown on a pie chart to a dashboard that contains an options control element. The pie chart has buckets for field A (plant) and field B (topic). The controls object … --- ## [How to disable UI metric report API in Kibana?](https://discuss.elastic.co/t/how-to-disable-ui-metric-report-api-in-kibana/277533)
**Author:** [@HemaS](https://discuss.elastic.co/u/HemaS)\ **Replies:** 2\ **Last updated:** [July 2, 2021, 12:44pm UTC](https://discuss.elastic.co/t/how-to-disable-ui-metric-report-api-in-kibana/277533 "2021-07-02T12:44:24Z")
loaded Metric -\> (DashboardPanelVersionInUrl:7.8.0): reporter.js:260 Object { type: "loaded", appName: "DashboardPanelVersionInUrl", eventName: "7.8.0", count: 1 } ​ appName: "DashboardPanelVersionInUrl" ​ count: 1 ​ ev… --- ## [Filebeat has big delay to send log to Kafka](https://discuss.elastic.co/t/filebeat-has-big-delay-to-send-log-to-kafka/277589)
**Author:** [@cpotato](https://discuss.elastic.co/u/cpotato)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 6:43pm UTC](https://discuss.elastic.co/t/filebeat-has-big-delay-to-send-log-to-kafka/277589 "2021-07-01T18:43:03Z")
Hi, We have log server running filebeat to send log data to Kafka. The log file is on NFS mounted filesystem. we do logrotate hourly, the size of the file is ~18G at the peak time. we have log time and the time received… --- ## [Kibana internal Server Error](https://discuss.elastic.co/t/kibana-internal-server-error/277462)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [July 2, 2021, 12:03pm UTC](https://discuss.elastic.co/t/kibana-internal-server-error/277462 "2021-07-02T12:03:42Z")
Hello, I build ELK 8.0 from github, on Debian 10 (both elasticsearch nodes and kibana), and when I try to go to index management --\> indices I am getting an internal Error : Kibana Logs: server log \[14:51:03.4… --- ## [Painless Script throws NullPointer exception](https://discuss.elastic.co/t/painless-script-throws-nullpointer-exception/277037)
**Author:** [@pcosic](https://discuss.elastic.co/u/pcosic)\ **Replies:** 5\ **Last updated:** [July 2, 2021, 12:02pm UTC](https://discuss.elastic.co/t/painless-script-throws-nullpointer-exception/277037 "2021-07-02T12:02:00Z")
Hi there, the last days I tried to use a supervised model for DGA detection. As usual, you prepare your index with an ingest pipeline and then use the inference processor to insert a prediction into the event. So far … --- ## [How to use throttle filter to add tag to only one record](https://discuss.elastic.co/t/how-to-use-throttle-filter-to-add-tag-to-only-one-record/277640)
**Author:** [@venkat\_s](https://discuss.elastic.co/u/venkat_s)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 11:13am UTC](https://discuss.elastic.co/t/how-to-use-throttle-filter-to-add-tag-to-only-one-record/277640 "2021-07-02T11:13:29Z")
Hi, I am using Logstash to process a csv file that contains more that one Lakh rows. I want to add a tag to only one record so that I can send email if any record contains this tag. I am trying to use throttle but its… --- ## [ES 1.7.6 Search within root and nested objects](https://discuss.elastic.co/t/es-1-7-6-search-within-root-and-nested-objects/277333)
**Author:** [@ValeryL](https://discuss.elastic.co/u/ValeryL)\ **Replies:** 4\ **Last updated:** [July 2, 2021, 10:18am UTC](https://discuss.elastic.co/t/es-1-7-6-search-within-root-and-nested-objects/277333 "2021-07-02T10:18:05Z")
Hi there, I'm trying to understand, why search within root and nested objects works in ES 1.7 and now it dosn't work in ES 7.13. May be I'm missing something? I use the following index mapping and search requests: ES 1.… --- ## [Kibana how sort logs](https://discuss.elastic.co/t/kibana-how-sort-logs/277595)
**Author:** [@Ilya\_21bA](https://discuss.elastic.co/u/Ilya_21bA)\ **Replies:** 1\ **Last updated:** [July 2, 2021, 9:20am UTC](https://discuss.elastic.co/t/kibana-how-sort-logs/277595 "2021-07-02T09:20:01Z")
Hello everyone Tell me how I can get a certain amount of data for a certain time range. For example, how can I get all the logs for this range. The fact is that I can't know the exact range, and therefore how can I g… --- ## [FileBeat consumes Kafka, every time a FileBeat is started as a consumer, Kafka needs to spend several hours for the rebalancing, and only the first FileBeat will not have the rebalancing](https://discuss.elastic.co/t/filebeat-consumes-kafka-every-time-a-filebeat-is-started-as-a-consumer-kafka-needs-to-spend-several-hours-for-the-rebalancing-and-only-the-first-filebeat-will-not-have-the-rebalancing/277627)
**Author:** [@hadogen](https://discuss.elastic.co/u/hadogen)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 8:56am UTC](https://discuss.elastic.co/t/filebeat-consumes-kafka-every-time-a-filebeat-is-started-as-a-consumer-kafka-needs-to-spend-several-hours-for-the-rebalancing-and-only-the-first-filebeat-will-not-have-the-rebalancing/277627 "2021-07-02T08:56:43Z")
ENV: kafka. 2.12-2.0.1 x 3 filebeat version 7.12.1. x N kafka config file: broker.id=111 listeners=PLAINTEXT://172.30.160.16:9091 advertised.listeners=PLAINTEXT://172.30.160.16:9091 num.network.threads=48 num.io.t… --- ## [Esrally loaddriver configurations](https://discuss.elastic.co/t/esrally-loaddriver-configurations/276803)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 2\ **Last updated:** [July 2, 2021, 8:59am UTC](https://discuss.elastic.co/t/esrally-loaddriver-configurations/276803 "2021-07-02T08:59:11Z")
Hi All, I am trying to setup esrally in k8s, As per the Tips and Tricks — Rally 2.2.1 documentation it is good approach or solution to distribute the load to loaddrivers. what would be the better configurations for load… --- ## [Esrally setup error](https://discuss.elastic.co/t/esrally-setup-error/276341)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 2\ **Last updated:** [July 2, 2021, 8:58am UTC](https://discuss.elastic.co/t/esrally-setup-error/276341 "2021-07-02T08:58:38Z")
Hi Team, I am setting up esrally on k8s. To do that I have created k8s deployment file with the below details. but when I am getting an error. Error logs below & deployment file used. Error: Traceback (most recent call… --- ## [Elasticsearch register backup repository with different UID and GID](https://discuss.elastic.co/t/elasticsearch-register-backup-repository-with-different-uid-and-gid/277212)
**Author:** [@KA3AXCTAH](https://discuss.elastic.co/u/KA3AXCTAH)\ **Replies:** 6\ **Last updated:** [July 2, 2021, 8:18am UTC](https://discuss.elastic.co/t/elasticsearch-register-backup-repository-with-different-uid-and-gid/277212 "2021-07-02T08:18:18Z")
I have 2 Elasticsearch clusters they are backed up to the same NFS share, but in different directories and the elasticsearch user on these VMs has different UIDs and GIDs For example, for the corn project, the elasticsea… --- ## [Canvas time filter](https://discuss.elastic.co/t/canvas-time-filter/277420)
**Author:** [@Mik\_a](https://discuss.elastic.co/u/Mik_a)\ **Replies:** 12\ **Last updated:** [July 2, 2021, 7:48am UTC](https://discuss.elastic.co/t/canvas-time-filter/277420 "2021-07-02T07:48:36Z")
I made a Canvas workpad showing one metric. I need dynamic filters and if I import a filter from the dashboard they seem to have no effect. When I add a time filter from canvas "add element" my metric says "Error canno… --- ## [Converting Date-String into Date with Ingest-pipeline not working](https://discuss.elastic.co/t/converting-date-string-into-date-with-ingest-pipeline-not-working/277613)
**Author:** [@adamio](https://discuss.elastic.co/u/adamio)\ **Replies:** 1\ **Last updated:** [July 2, 2021, 6:54am UTC](https://discuss.elastic.co/t/converting-date-string-into-date-with-ingest-pipeline-not-working/277613 "2021-07-02T06:54:18Z")
We have this pipeline: PUT \_ingest/pipeline/j2-e2a-test { "processors": \[ { "grok": { "field": "message", "patterns": \[ "(?m)(?\%{DATE\_EU}\\\\s+%{TIME})\\\\s+(%{WORD:loglevel… --- ## [What are the specifications of your shard configuration or equipment?](https://discuss.elastic.co/t/what-are-the-specifications-of-your-shard-configuration-or-equipment/276155)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 12\ **Last updated:** [July 2, 2021, 6:46am UTC](https://discuss.elastic.co/t/what-are-the-specifications-of-your-shard-configuration-or-equipment/276155 "2021-07-02T06:46:45Z")
I'm using Filebeat, Logstash and ElasticSearch to collect logs. Today, I encountered the following error. # tail /var/log/logstash/logstash-plain.log \[2021-06-16T10:10:48,509\]\[WARN \]\[logstash.outputs.elasticsearch\]\[mai… --- ## [Mapping file \_settings.json does not exist for elasticsearch version 7](https://discuss.elastic.co/t/mapping-file-settings-json-does-not-exist-for-elasticsearch-version-7/277603)
**Author:** [@dotel](https://discuss.elastic.co/u/dotel)\ **Replies:** 1\ **Last updated:** [July 2, 2021, 5:12am UTC](https://discuss.elastic.co/t/mapping-file-settings-json-does-not-exist-for-elasticsearch-version-7/277603 "2021-07-02T05:12:50Z")
I'm using elastic search 7.13.2 and fscrawler-2.5. When I try to create a new job in fscrawler using bin/fscrawler testjob2 it prompts me to create a new job and creates a new job with config file here /root/.fscrawler/t… --- ## [Logstash when started using nohup, it is logging too much resulting in huge size](https://discuss.elastic.co/t/logstash-when-started-using-nohup-it-is-logging-too-much-resulting-in-huge-size/276560)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 8\ **Last updated:** [July 2, 2021, 4:50am UTC](https://discuss.elastic.co/t/logstash-when-started-using-nohup-it-is-logging-too-much-resulting-in-huge-size/276560 "2021-07-02T04:50:02Z")
we are running logstash and its output has file and elasticsearch for every opening and closing the file plugin is logging in... resulting the nohup.out file being very huge... How do i avoid so much of logging, or is t… --- ## [Count specific entries in some field](https://discuss.elastic.co/t/count-specific-entries-in-some-field/277610)
**Author:** [@denisnovac](https://discuss.elastic.co/u/denisnovac)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 4:04am UTC](https://discuss.elastic.co/t/count-specific-entries-in-some-field/277610 "2021-07-02T04:04:18Z")
Hi everyone. I have this aggregation to count the inputs in some field: "aggs": { "prodt": { "filter": { "bool": {} }, "aggs": { "prodt": { … --- ## [LogStash, GeoJSON and Kibana](https://discuss.elastic.co/t/logstash-geojson-and-kibana/277450)
**Author:** [@f4d0](https://discuss.elastic.co/u/f4d0)\ **Replies:** 4\ **Last updated:** [July 2, 2021, 2:24am UTC](https://discuss.elastic.co/t/logstash-geojson-and-kibana/277450 "2021-07-02T02:24:43Z")
I have successfully (I think) ingested logs using Logstash. Used the geoip filter and all the data looks good and well strucutred. When I index it in Kibana, the coordinates are set as float. This is what I can observe i… --- ## [Auditbeat not updating record/docs in index](https://discuss.elastic.co/t/auditbeat-not-updating-record-docs-in-index/277605)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 1:17am UTC](https://discuss.elastic.co/t/auditbeat-not-updating-record-docs-in-index/277605 "2021-07-02T01:17:20Z")
I have installed Auditbeat and configured it on a RHEL machine. Auditbeat status shows that it is running. However, index for Auditbeat shows zero docs count. Auditd service is disabled. I have deleted and recreated the… --- ## [Is greates store logs into one indice or store in N small indices?](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588)
**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 10:14pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588 "2021-07-01T22:14:05Z")
Hi I was wondering which is greatest way to store logs data, store into only one indice ( maybe use ILM to manager this indice ) or split in small indices (like: logs-2021.07.01, logs-2021.07.02 etc) What the greatest … --- ## [Implementing a parent-child relationship and changing parent of a child document](https://discuss.elastic.co/t/implementing-a-parent-child-relationship-and-changing-parent-of-a-child-document/277498)
**Author:** [@ViniciusSPaiva](https://discuss.elastic.co/u/ViniciusSPaiva)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 9:56pm UTC](https://discuss.elastic.co/t/implementing-a-parent-child-relationship-and-changing-parent-of-a-child-document/277498 "2021-07-01T21:56:39Z")
Hello, We need to create a solution able to search for two entities: record and file. Each one has its properties and records can have zero or more files. Appears to be very simple, but I am finding very difficult to f… --- ## [Numbers - ignore scientific notation](https://discuss.elastic.co/t/numbers-ignore-scientific-notation/277600)
**Author:** [@myronuecker](https://discuss.elastic.co/u/myronuecker)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 9:42pm UTC](https://discuss.elastic.co/t/numbers-ignore-scientific-notation/277600 "2021-07-01T21:42:01Z")
We have fields that are defined like this: "type": "text", "store": true, "fields": { "date": { "type": "date", "ignore\_malformed": true, "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd" }, "number": { "… --- ## [Elasticsearch mapper-size plugin disadvantages/cost?](https://discuss.elastic.co/t/elasticsearch-mapper-size-plugin-disadvantages-cost/277585)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 9:25pm UTC](https://discuss.elastic.co/t/elasticsearch-mapper-size-plugin-disadvantages-cost/277585 "2021-07-01T21:25:02Z")
Is there any disadvantage or significant cost to the elasticsearch cluster if I use mapper-size plugin on all indices ? Suppose our daily ingestion in 1.5 TB. --- ## [Testing ruby filter for logstash](https://discuss.elastic.co/t/testing-ruby-filter-for-logstash/277599)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 9:08pm UTC](https://discuss.elastic.co/t/testing-ruby-filter-for-logstash/277599 "2021-07-01T21:08:50Z")
How would you write a test to check if the code described in Indent any json file nested fields and make it flat (@Badger ) is working? I am having a hard time using the inline testing framework described in Ruby filter… --- ## [ILM policy for filebeats through config file](https://discuss.elastic.co/t/ilm-policy-for-filebeats-through-config-file/277597)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 8:54pm UTC](https://discuss.elastic.co/t/ilm-policy-for-filebeats-through-config-file/277597 "2021-07-01T20:54:37Z")
I want to setup ILM through filebeat.yml I have following config # ====================== Index Lifecycle Management (ILM) ====================== # Configure index lifecycle management (ILM). These settings cr… --- ## [Runtime scripts](https://discuss.elastic.co/t/runtime-scripts/277596)
**Author:** [@andremarzo](https://discuss.elastic.co/u/andremarzo)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 8:53pm UTC](https://discuss.elastic.co/t/runtime-scripts/277596 "2021-07-01T20:53:09Z")
I ran a runtime script but i want delete it. How can i do it? --- ## [Using Field Data in Output Hosts?](https://discuss.elastic.co/t/using-field-data-in-output-hosts/277594)
**Author:** [@Dan\_L](https://discuss.elastic.co/u/Dan_L)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 8:09pm UTC](https://discuss.elastic.co/t/using-field-data-in-output-hosts/277594 "2021-07-01T20:09:57Z")
Hello, I am trying to use the value of a field when I am defining hosts in logstash output. I've been able to do this in other logstash outputs like index. Is this possible? For example: output { elasticsearch { hosts … [Previous page](https://discuss.elastic.co/latest.md?page=1590) [Next page](https://discuss.elastic.co/latest.md?page=1592)