# Latest **URL:** https://discuss.elastic.co/latest.md?page=1594 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1595 --- ## [Update few Attributes in Nested Object of index using logstash](https://discuss.elastic.co/t/update-few-attributes-in-nested-object-of-index-using-logstash/277500)
**Author:** [@kamalgunda](https://discuss.elastic.co/u/kamalgunda)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 8:49pm UTC](https://discuss.elastic.co/t/update-few-attributes-in-nested-object-of-index-using-logstash/277500 "2021-06-30T20:49:35Z")
Hi All, Good Day! I have data in elastic search index and want to update the nested object two attributes values out of 20 attributes. Input table has n number of records and whatever matches with document\_id , it sho… --- ## [Need clearity of FileBeat Monitoring logs](https://discuss.elastic.co/t/need-clearity-of-filebeat-monitoring-logs/277496)
**Author:** [@Parveen\_Sharma](https://discuss.elastic.co/u/Parveen_Sharma)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 8:11pm UTC](https://discuss.elastic.co/t/need-clearity-of-filebeat-monitoring-logs/277496 "2021-06-30T20:11:50Z")
Hi, I am new user of filebeat and need to understand few information from the filebeat logs. Currently, I have deployed filebeat on windows system. In the logs metrics information are logged every 30 sec but i am unabl… --- ## [Exporting to CSV missing values in fields](https://discuss.elastic.co/t/exporting-to-csv-missing-values-in-fields/277389)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 4\ **Last updated:** [June 30, 2021, 7:49pm UTC](https://discuss.elastic.co/t/exporting-to-csv-missing-values-in-fields/277389 "2021-06-30T19:49:28Z")
Hi All, Wondering if I can get some help. Currently from Kibana I'm running some Discover Reports, I can see all the fields and information in Kibana, however when I export it to CSV, 4 columns out of 6 have no values a… --- ## [Indexing Xml subfields as a new field](https://discuss.elastic.co/t/indexing-xml-subfields-as-a-new-field/277215)
**Author:** [@anon33720113](https://discuss.elastic.co/u/anon33720113)\ **Replies:** 11\ **Last updated:** [June 30, 2021, 5:01pm UTC](https://discuss.elastic.co/t/indexing-xml-subfields-as-a-new-field/277215 "2021-06-30T17:01:18Z")
Hi all, I have a xml-File with windows eventlogs that is structured like this: \ \ \...\ ... \ \ **Author:** [@Vijaykumar\_Gundavara](https://discuss.elastic.co/u/Vijaykumar_Gundavara)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:53pm UTC](https://discuss.elastic.co/t/http-output-plugin-to-update-datastreams-entire-document/277487 "2021-06-30T16:53:24Z") Hi, MY use case is as follows. I have a document which is getting inserted into elasticsearch datastreams. The same document is getting updated multiple times in the application and I would like to use \_update\_query API… --- ## [Error building elasticsearch-hadoop from github](https://discuss.elastic.co/t/error-building-elasticsearch-hadoop-from-github/277486)
**Author:** [@Hardik\_Aggarwal](https://discuss.elastic.co/u/Hardik_Aggarwal)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:44pm UTC](https://discuss.elastic.co/t/error-building-elasticsearch-hadoop-from-github/277486 "2021-06-30T16:44:10Z")
Pardon me I am new to ElasticSearch and hadoop. I am trying to build GitHub - elastic/elasticsearch-hadoop: Elasticsearch real-time search and analytics natively integrated with Hadoop this repo locally . I did gradle d… --- ## [Create split series / aggregation based on json message](https://discuss.elastic.co/t/create-split-series-aggregation-based-on-json-message/277401)
**Author:** [@gandhz](https://discuss.elastic.co/u/gandhz)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 4:40pm UTC](https://discuss.elastic.co/t/create-split-series-aggregation-based-on-json-message/277401 "2021-06-30T16:40:18Z")
Hi, I have service logs which contains json message like example below: { "caller\_method\_name": "transferConfirmation", "caller\_line\_number": 328, "message": "Transfer via virtual : {"transferRef":"22151","… --- ## [EQL syntax error?](https://discuss.elastic.co/t/eql-syntax-error/277301)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 4:30pm UTC](https://discuss.elastic.co/t/eql-syntax-error/277301 "2021-06-30T16:30:01Z")
I'm trying to inspect the results of an EQL query (based on the built-in hosts modification rule). However when I run the EQL query : file where event.type in ("change", "creation") and file.path : ("/private/… --- ## [Can't get fields with an empty date to show up in a data table](https://discuss.elastic.co/t/cant-get-fields-with-an-empty-date-to-show-up-in-a-data-table/276052)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 4:27pm UTC](https://discuss.elastic.co/t/cant-get-fields-with-an-empty-date-to-show-up-in-a-data-table/276052 "2021-06-30T16:27:48Z")
I have a data table (and I've done this before) let's say the fields are: Name Quantity End of Support Date End of Contract Date There are 30 records in the dataset right now. Of those 30 maybe 15 have the end of s… --- ## [Logstash Keystore While Running As A Service](https://discuss.elastic.co/t/logstash-keystore-while-running-as-a-service/277262)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 5\ **Last updated:** [June 30, 2021, 4:15pm UTC](https://discuss.elastic.co/t/logstash-keystore-while-running-as-a-service/277262 "2021-06-30T16:15:16Z")
Hello Team, I have created Logstash Keystore with command sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash create but while running /usr/share/logstash/bin/logstash-keystore list it is thro… --- ## [Logstash (Unable to retrieve license information from license server {:message=\>"Unsupported or unrecognized SSL message"})](https://discuss.elastic.co/t/logstash-unable-to-retrieve-license-information-from-license-server-message-unsupported-or-unrecognized-ssl-message/277484)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:02pm UTC](https://discuss.elastic.co/t/logstash-unable-to-retrieve-license-information-from-license-server-message-unsupported-or-unrecognized-ssl-message/277484 "2021-06-30T16:02:49Z")
I am getting the following error, does anyone know what is happening? localhost:/etc/logstash # tail -f /var/log/logstash/logstash-plain.log \[2021-06-30T16:44:31,287\]\[ERROR\]\[logstash.licensechecker.licensereader\] Unabl… --- ## [Creating Kibana Chart of Latest time stamps with sum](https://discuss.elastic.co/t/creating-kibana-chart-of-latest-time-stamps-with-sum/277476)
**Author:** [@kibanaNewbie23](https://discuss.elastic.co/u/kibanaNewbie23)\ **Replies:** 4\ **Last updated:** [June 30, 2021, 3:45pm UTC](https://discuss.elastic.co/t/creating-kibana-chart-of-latest-time-stamps-with-sum/277476 "2021-06-30T15:45:35Z")
Hello! I have a record like this : { server: 1, size: 10, @timestamp: "2021-6-28 09:00"} { server: 2, size: 30, @timestamp: "2021-6-28 09:00"} { server: 3, size: 40, @timestamp: "2021-6-28 09:00"} { server: 1, size: … --- ## [Kibana not filtering specific visulization](https://discuss.elastic.co/t/kibana-not-filtering-specific-visulization/277360)
**Author:** [@thibdeb](https://discuss.elastic.co/u/thibdeb)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 3:33pm UTC](https://discuss.elastic.co/t/kibana-not-filtering-specific-visulization/277360 "2021-06-30T15:33:20Z")
Hello everyone, I'm working on a project on Kibana to do a dashboard with specifics visualizations from 2 files, a .log file and a .csv file, I have two index patterns too. I use a panel to select what kind of data I w… --- ## [Labels and Annotation are not applied at the pod level](https://discuss.elastic.co/t/labels-and-annotation-are-not-applied-at-the-pod-level/262522)
**Author:** [@dg\_hivebrite](https://discuss.elastic.co/u/dg_hivebrite)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 3:30pm UTC](https://discuss.elastic.co/t/labels-and-annotation-are-not-applied-at-the-pod-level/262522 "2021-06-30T15:30:12Z")
Hi, I'm trying to do a poc with datadog to monitor elasticsearch. One of the solution is to setting annotations and labels on pods. So I tried to do that, using the podTemplate field in the CRD but it doesn't update t… --- ## [Filebeat is not using custom pipeline mentioned in the output.elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-using-custom-pipeline-mentioned-in-the-output-elasticsearch/277465)
**Author:** [@Mahesh\_Gadagi](https://discuss.elastic.co/u/Mahesh_Gadagi)\ **Replies:** 4\ **Last updated:** [June 30, 2021, 3:24pm UTC](https://discuss.elastic.co/t/filebeat-is-not-using-custom-pipeline-mentioned-in-the-output-elasticsearch/277465 "2021-06-30T15:24:42Z")
Hello all, Currently, I am using filebeat, elastic search 7.9.1 version and I have added the custom Ingest pipeline to push the logs but still, filebeat creates a new Ingest pipeline as filebeat-7.9.1-haproxy-log-pipeli… --- ## [Write thread pool queue size defaults](https://discuss.elastic.co/t/write-thread-pool-queue-size-defaults/277449)
**Author:** [@Alex\_Abdulin](https://discuss.elastic.co/u/Alex_Abdulin)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 3:12pm UTC](https://discuss.elastic.co/t/write-thread-pool-queue-size-defaults/277449 "2021-06-30T15:12:05Z")
Hello, everyone! I'm tuning ES 6.8 for indexing performance and noticed one interesting thing. There is a significant difference in the default value of the q size in versions 6.8 and 7.x. The documentation states: ES … --- ## [Log Stoppage alert from critical server - ELK7.12](https://discuss.elastic.co/t/log-stoppage-alert-from-critical-server-elk7-12/273915)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 3:04pm UTC](https://discuss.elastic.co/t/log-stoppage-alert-from-critical-server-elk7-12/273915 "2021-06-30T15:04:29Z")
Hello Team, Please help me to understand the best way to create the log stoppage alert for critical servers. It should be index specific. For example: Index "A" contains 3 Firewall device logs- fw1,fw2,fw3 Need to get… --- ## [Unable to find "kibana.autocompleteTimeout" in kibana.yml](https://discuss.elastic.co/t/unable-to-find-kibana-autocompletetimeout-in-kibana-yml/277472)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 2:51pm UTC](https://discuss.elastic.co/t/unable-to-find-kibana-autocompletetimeout-in-kibana-yml/277472 "2021-06-30T14:51:35Z")
I have a control visualization , where i can't seem to find a filename that was processed . i can only see one of the files (two log files were ingested) . These are very large files and contain huge lines of informatio… --- ## [Change colour of Metric Visualization for Percentile ranks aggregation](https://discuss.elastic.co/t/change-colour-of-metric-visualization-for-percentile-ranks-aggregation/277454)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 2:48pm UTC](https://discuss.elastic.co/t/change-colour-of-metric-visualization-for-percentile-ranks-aggregation/277454 "2021-06-30T14:48:57Z")
Hi Kibana: 7.9.3 We are using metric visualization to get percentile ranks. Based on the percentage, I am trying to change colour of the background from Green to Red. But the color remains the same for any Ranges I giv… --- ## [Filebeat multiline.max\_lines limit](https://discuss.elastic.co/t/filebeat-multiline-max-lines-limit/277474)
**Author:** [@adityasingh](https://discuss.elastic.co/u/adityasingh)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 2:43pm UTC](https://discuss.elastic.co/t/filebeat-multiline-max-lines-limit/277474 "2021-06-30T14:43:13Z")
Hi, I had a query regarding filebeat's multiline.max\_lines option. I know the default value for this is 500 and we can configure it to a number of our choice and the lines after the configured number will be ignored whi… --- ## [Unable to create "Maps" visualization - Getting "Selected index pattern does not contain source and destination fields."](https://discuss.elastic.co/t/unable-to-create-maps-visualization-getting-selected-index-pattern-does-not-contain-source-and-destination-fields/276683)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 11\ **Last updated:** [June 30, 2021, 2:29pm UTC](https://discuss.elastic.co/t/unable-to-create-maps-visualization-getting-selected-index-pattern-does-not-contain-source-and-destination-fields/276683 "2021-06-30T14:29:25Z")
I'm unable to create "Maps" visualization. I get the error "Selected index pattern does not contain source and destination fields." I'm on version 7.13.2 ELK I used geoip to define the source and destination IP fields … --- ## [Kibana Showing Limited UI Options](https://discuss.elastic.co/t/kibana-showing-limited-ui-options/277357)
**Author:** [@toneyalexander](https://discuss.elastic.co/u/toneyalexander)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 1:56pm UTC](https://discuss.elastic.co/t/kibana-showing-limited-ui-options/277357 "2021-06-30T13:56:26Z")
I have an Elasticsearch cluster with Kibana installed on one of the nodes. We have a beta and a prod cluster which are generally very similar, however one of them has been having a strange Kibana issue. Normally, and on … --- ## [Ship metrics to Graphite](https://discuss.elastic.co/t/ship-metrics-to-graphite/277263)
**Author:** [@raghav1](https://discuss.elastic.co/u/raghav1)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 1:27pm UTC](https://discuss.elastic.co/t/ship-metrics-to-graphite/277263 "2021-06-30T13:27:49Z")
Is there a way to ship metrics to Graphite ? If yes can you please provide an example. --- ## [Compare a collection/array of 2 numeric field values within same document](https://discuss.elastic.co/t/compare-a-collection-array-of-2-numeric-field-values-within-same-document/277461)
**Author:** [@Munazza](https://discuss.elastic.co/u/Munazza)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 12:52pm UTC](https://discuss.elastic.co/t/compare-a-collection-array-of-2-numeric-field-values-within-same-document/277461 "2021-06-30T12:52:58Z")
I am trying to load sql server data to elasticsearch using logstash and have the watcher rule to alert if one field value is greater than the other field value within the same document. I am looking for a condition in … --- ## [Filebeat isn’t shipping the last line of a file](https://discuss.elastic.co/t/filebeat-isn-t-shipping-the-last-line-of-a-file/277459)
**Author:** [@jack5](https://discuss.elastic.co/u/jack5)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 12:36pm UTC](https://discuss.elastic.co/t/filebeat-isn-t-shipping-the-last-line-of-a-file/277459 "2021-06-30T12:36:17Z")
Hi everyone, I'm new in filebeat, I'm using filebeat+ingest node pipeline to send csv properties into elasticsearch. Unfortunately filebeat doesn't send last line of my csv file. I read https://www.elastic.co/guide/en/… --- ## [\[threatintel Filebeat module\] MISP configuration errors with filebeat threatintel module](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-configuration-errors-with-filebeat-threatintel-module/277448)
**Author:** [@Balor](https://discuss.elastic.co/u/Balor)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 12:35pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-configuration-errors-with-filebeat-threatintel-module/277448 "2021-06-30T12:35:42Z")
Hello All, A question about the Filebeat module " threatintel ". On the MISP configuration . Using Filebeat 7.13.2.The below are the settings that I have tested but shows with errors in the filebeat logs. The config is … --- ## [Create a new HOME LOAN index using the file homeloan\_index.json](https://discuss.elastic.co/t/create-a-new-home-loan-index-using-the-file-homeloan-index-json/277248)
**Author:** [@BalakN](https://discuss.elastic.co/u/BalakN)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 12:35pm UTC](https://discuss.elastic.co/t/create-a-new-home-loan-index-using-the-file-homeloan-index-json/277248 "2021-06-30T12:35:35Z")
I'm completely new to ELK and how to complete the following requirement. Create a new index "TEST-LOAN-INDEX" in QA environment using the json file "loan\_index.json" . --- ## [Logstash compare field with quotedstring fails](https://discuss.elastic.co/t/logstash-compare-field-with-quotedstring-fails/277385)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 12:32pm UTC](https://discuss.elastic.co/t/logstash-compare-field-with-quotedstring-fails/277385 "2021-06-30T12:32:17Z")
Hi, I'm parsing modsecurity messages from apache error log, one of the fields i get is ruleid that is parsed with a grok filter using the pattern QUOTEDSTRING. So in the field for instance i get a string with quotes: ""… --- ## [Grok Pattern for line - custom date](https://discuss.elastic.co/t/grok-pattern-for-line-custom-date/277412)
**Author:** [@Kamikaze\_K](https://discuss.elastic.co/u/Kamikaze_K)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 12:27pm UTC](https://discuss.elastic.co/t/grok-pattern-for-line-custom-date/277412 "2021-06-30T12:27:12Z")
I am trying to use a grok pattern to get the fields from the following. any help with this especially with the custom date? 0E7 10JUN21 23:37:53.8 Track 1 EZ: 100 EX: 72 Speed: 36 mph I need to get the fields; "date" … --- ## [\[savedobjects-service\] Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/savedobjects-service-unable-to-retrieve-version-information-from-elasticsearch-nodes/277416)
**Author:** [@ibreighith](https://discuss.elastic.co/u/ibreighith)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 12:26pm UTC](https://discuss.elastic.co/t/savedobjects-service-unable-to-retrieve-version-information-from-elasticsearch-nodes/277416 "2021-06-30T12:26:31Z")
Kibana.yml # Kibana is served by a back end server. This setting specifies the port to use. #server.port: 5601 # Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid va… [Previous page](https://discuss.elastic.co/latest.md?page=1593) [Next page](https://discuss.elastic.co/latest.md?page=1595)