# Latest **URL:** https://discuss.elastic.co/latest.md?page=1610 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1611 --- ## [Canvas - Render a metric generated based in other two metrics](https://discuss.elastic.co/t/canvas-render-a-metric-generated-based-in-other-two-metrics/276558)
**Author:** [@clino](https://discuss.elastic.co/u/clino)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 11:27am UTC](https://discuss.elastic.co/t/canvas-render-a-metric-generated-based-in-other-two-metrics/276558 "2021-06-22T11:27:13Z")
I am looking to have configure a metric in Canvas to cover the following scenario: Calculate the total amount of sales all time divided by total sales in specific timeframe (i.e. first 3 months). I see within TSVB I can … --- ## [Kibana build taking forever to complete](https://discuss.elastic.co/t/kibana-build-taking-forever-to-complete/275297)
**Author:** [@niravk](https://discuss.elastic.co/u/niravk)\ **Replies:** 5\ **Last updated:** [June 22, 2021, 11:13am UTC](https://discuss.elastic.co/t/kibana-build-taking-forever-to-complete/275297 "2021-06-22T11:13:27Z")
I am trying to build the Kibana locally in my CentOS VM using the yarn build command. However, it is taking too long for the build process to complete(~13 hours). I am wondering, if I am doing something wrong or is there… --- ## [Follow-up from "Unable to avoid JSON parsing errors in logstash log-file"](https://discuss.elastic.co/t/follow-up-from-unable-to-avoid-json-parsing-errors-in-logstash-log-file/276641)
**Author:** [@es-gabriele](https://discuss.elastic.co/u/es-gabriele)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 11:02am UTC](https://discuss.elastic.co/t/follow-up-from-unable-to-avoid-json-parsing-errors-in-logstash-log-file/276641 "2021-06-22T11:02:13Z")
Hi everyone, I am using ELK 7.2. I did read from a past answer here and I found it useful, as what I need to do is to make logstash correctly parse json data, and also an array of nested json objects. However, if I ne… --- ## [Aggregate Query Results](https://discuss.elastic.co/t/aggregate-query-results/276570)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 5\ **Last updated:** [June 22, 2021, 10:39am UTC](https://discuss.elastic.co/t/aggregate-query-results/276570 "2021-06-22T10:39:15Z")
I am fetching timestamp and data against that timestamp with my search query to Elasticsearch node. The result being fetched contains multiple values against the same timeframe and I want Elasticsearch to return the aggr… --- ## [Kibana Alerts and Actions - Index and Server Log connectors disabled](https://discuss.elastic.co/t/kibana-alerts-and-actions-index-and-server-log-connectors-disabled/276545)
**Author:** [@wsnet](https://discuss.elastic.co/u/wsnet)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 1:45pm UTC](https://discuss.elastic.co/t/kibana-alerts-and-actions-index-and-server-log-connectors-disabled/276545 "2021-06-21T13:45:34Z")
Hello, I am trying to use Kibana Alerts and Actions with the built-in index connector (xpack.actions.preconfiguredAlertHistoryEsIndex), yet when I try to create a rule and an action there is no option to choose the inde… --- ## [Kibana logstash pipeline management UI fails to switch pipeline versions](https://discuss.elastic.co/t/kibana-logstash-pipeline-management-ui-fails-to-switch-pipeline-versions/274656)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 10:18am UTC](https://discuss.elastic.co/t/kibana-logstash-pipeline-management-ui-fails-to-switch-pipeline-versions/274656 "2021-06-22T10:18:40Z")
When I load the Logstash pipelines UI in Kibana 7.12.1, it auto-selects the 4th option in the versions dropdown. It then fails to load any data. Worse yet is that I cannot switch the dropdown option (clicking a differe… --- ## [Access denied error on keystore when using ECK](https://discuss.elastic.co/t/access-denied-error-on-keystore-when-using-eck/276297)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 10:03am UTC](https://discuss.elastic.co/t/access-denied-error-on-keystore-when-using-eck/276297 "2021-06-22T10:03:30Z")
We have orchestrated an elastic instance using ECK. The pods fail to start with this error Exception in thread "main" java.nio.file.AccessDeniedException: /usr/share/elasticsearch/config/elasticsearch.keystore at java… --- ## [3rd party requirements breakdown for downstream services](https://discuss.elastic.co/t/3rd-party-requirements-breakdown-for-downstream-services/276455)
**Author:** [@Koby\_Bass](https://discuss.elastic.co/u/Koby_Bass)\ **Replies:** 4\ **Last updated:** [June 22, 2021, 9:35am UTC](https://discuss.elastic.co/t/3rd-party-requirements-breakdown-for-downstream-services/276455 "2021-06-22T09:35:51Z")
We are using APM for distributed tracing of a data processing pipeline. Before connecting the pipeline using traceparent, the requirements breakdown in the APM screen was working: After distributed tracing was conne… --- ## [Logstash 'compile\_imperative' error](https://discuss.elastic.co/t/logstash-compile-imperative-error/276625)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 9:33am UTC](https://discuss.elastic.co/t/logstash-compile-imperative-error/276625 "2021-06-22T09:33:32Z")
Hi, I have Logstash to pick up Snort Alerts, but i have had this error and i don't know why. Error: logstash | \[2021-06-22T08:55:53,809\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>Log… --- ## [How to disable auto instrumentation for APM FPM Agent?](https://discuss.elastic.co/t/how-to-disable-auto-instrumentation-for-apm-fpm-agent/276548)
**Author:** [@BatJakub](https://discuss.elastic.co/u/BatJakub)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 1:59pm UTC](https://discuss.elastic.co/t/how-to-disable-auto-instrumentation-for-apm-fpm-agent/276548 "2021-06-21T13:59:02Z")
Hello, Installed latest (1.1) php apm module. It's working as expected, sending data to apm servers and it is possible to visualize the data. But now we would like to customize our transactions and log in different way.… --- ## [Elasticsearch-py urllib3 suppress traceback logs on connection failures](https://discuss.elastic.co/t/elasticsearch-py-urllib3-suppress-traceback-logs-on-connection-failures/276561)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 3:49pm UTC](https://discuss.elastic.co/t/elasticsearch-py-urllib3-suppress-traceback-logs-on-connection-failures/276561 "2021-06-21T15:49:00Z")
client = Elasticsearch( hosts=config\['hosts'\], http\_auth=(config\['auth'\]\['user'\], config\['auth'\]\['password'\]), scheme='https', ssl\_context=context, time… --- ## [Are you aware of uncomptability between hibernate-enhance-maven-plugin and elasticsearch?](https://discuss.elastic.co/t/are-you-aware-of-uncomptability-between-hibernate-enhance-maven-plugin-and-elasticsearch/276574)
**Author:** [@guigui0824](https://discuss.elastic.co/u/guigui0824)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 7:53am UTC](https://discuss.elastic.co/t/are-you-aware-of-uncomptability-between-hibernate-enhance-maven-plugin-and-elasticsearch/276574 "2021-06-22T07:53:34Z")
Hi, i work on a spring-boot project (version 2.3.8.RELEASE) with Hibernate (version 5.4.27.Final) and elasticsearch (spring-boot-starter-data-elasticsearch). I want to enable bytecode enhancement lazy loading to increas… --- ## [PacketBeats: Record the request and response of transactions that cannot be identified by a valid protocol under tcp](https://discuss.elastic.co/t/packetbeats-record-the-request-and-response-of-transactions-that-cannot-be-identified-by-a-valid-protocol-under-tcp/276610)
**Author:** [@manning23](https://discuss.elastic.co/u/manning23)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 6:36am UTC](https://discuss.elastic.co/t/packetbeats-record-the-request-and-response-of-transactions-that-cannot-be-identified-by-a-valid-protocol-under-tcp/276610 "2021-06-22T06:36:23Z")
I hope to record the request and response of transactions that cannot be identified by a valid protocol under tcp. :slight\_smile: like this type: unknow-tcp enable: true send\_request: true send\_response: true --- ## [Buy x-pack license for Elasticsearch v5.4](https://discuss.elastic.co/t/buy-x-pack-license-for-elasticsearch-v5-4/276482)
**Author:** [@Srikanth\_Madiri](https://discuss.elastic.co/u/Srikanth_Madiri)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 5:34am UTC](https://discuss.elastic.co/t/buy-x-pack-license-for-elasticsearch-v5-4/276482 "2021-06-22T05:34:29Z")
Hello, We're using elasticsearch 5.4 version with xpack plugin installed. As we see the license usually expires after trial period, we now have to buy the x-pack license. Can you please provide more steps/insights on ho… --- ## [Removal of official Freenode IRC channels](https://discuss.elastic.co/t/removal-of-official-freenode-irc-channels/276603)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 4:44am UTC](https://discuss.elastic.co/t/removal-of-official-freenode-irc-channels/276603 "2021-06-22T04:44:26Z")
Folks, If you've been around the Elastic Stack for a few years, you likely would have come across our IRC channels that used to exist on Freenode. Unfortunately, the Freenode admins recently deleted all auth and channel… --- ## [Es\_rejected\_execution\_exception](https://discuss.elastic.co/t/es-rejected-execution-exception/276472)
**Author:** [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Replies:** 12\ **Last updated:** [June 22, 2021, 4:08am UTC](https://discuss.elastic.co/t/es-rejected-execution-exception/276472 "2021-06-22T04:08:51Z")
In Elasticsearch v7.9.3, I'm getting the below shown error while sending Kubernetes Apiserver Audit logs to Elasticsearch. Looks like Elasticsearch is not able to keep up with the number of requests being sent. Can you p… --- ## [Connecting Filebeat-Azure by proxy](https://discuss.elastic.co/t/connecting-filebeat-azure-by-proxy/276514)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 3:48am UTC](https://discuss.elastic.co/t/connecting-filebeat-azure-by-proxy/276514 "2021-06-22T03:48:49Z")
Hi everybody, we are trying to use Filebeat's Azure module to extract data from Azure but we are unable to connect to proxy. Filebeat (version 7.9) is installed on Windows Server 2008 in the internal network and to con… --- ## [How to restore index data if I remove all my master nodes accidentally!](https://discuss.elastic.co/t/how-to-restore-index-data-if-i-remove-all-my-master-nodes-accidentally/275109)
**Author:** [@Hiren\_Loong](https://discuss.elastic.co/u/Hiren_Loong)\ **Replies:** 8\ **Last updated:** [June 22, 2021, 3:42am UTC](https://discuss.elastic.co/t/how-to-restore-index-data-if-i-remove-all-my-master-nodes-accidentally/275109 "2021-06-22T03:42:15Z")
There are 3 master nodes and 6 data nodes in my ES Cluster. ES version is 6.7.x. I delete virtual machines accidentally, so 3 master nodes are disappeared forever! But my 6 data nodes are still on. Is any possible to … --- ## [ETW Events](https://discuss.elastic.co/t/etw-events/276597)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 3:20am UTC](https://discuss.elastic.co/t/etw-events/276597 "2021-06-22T03:20:32Z")
Will Elastic Agent support ETW events in the future or am I better off using Filebeat with standard log files at the moment? See Microsoft ETW (Event Tracing for Windows) Listener. Look for a Beats to deal with Service … --- ## [Logstash input plugin bad uri](https://discuss.elastic.co/t/logstash-input-plugin-bad-uri/276592)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 2:53am UTC](https://discuss.elastic.co/t/logstash-input-plugin-bad-uri/276592 "2021-06-22T02:53:03Z")
Hi, I am trying to install plugin for logstash. But whenever I execute .\\logstash-plugin list to see a list of available plugins. I keep getting bad uri error Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-14… --- ## [Spark-connector read and write es using ssl with the certificate of pem format](https://discuss.elastic.co/t/spark-connector-read-and-write-es-using-ssl-with-the-certificate-of-pem-format/276594)
**Author:** [@Min\_Zhao](https://discuss.elastic.co/u/Min_Zhao)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 1:33am UTC](https://discuss.elastic.co/t/spark-connector-read-and-write-es-using-ssl-with-the-certificate-of-pem-format/276594 "2021-06-22T01:33:19Z")
The es using ssl by PEM certificate, how to set configs to spark-connector, therer are the java client configs below. --- ## [Grouping of alerts from different sources using machine learning](https://discuss.elastic.co/t/grouping-of-alerts-from-different-sources-using-machine-learning/276565)
**Author:** [@amitsaxena0709](https://discuss.elastic.co/u/amitsaxena0709)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 4:30pm UTC](https://discuss.elastic.co/t/grouping-of-alerts-from-different-sources-using-machine-learning/276565 "2021-06-21T16:30:53Z")
Hi all, Can Elasticsearch alone or with others tools in the Elastic ecosystem intelligently group alerts from multiple sources based some criteria using machine learning? As an example, consider a scenario where if dat… --- ## [Elasticsearch Cluster Status red and Incides status red without error and reason](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-and-incides-status-red-without-error-and-reason/276513)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 12:50am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-and-incides-status-red-without-error-and-reason/276513 "2021-06-22T00:50:55Z")
Hi everyone, My problem is some indices have red status without reason. ENV: Elasticsearch 7.9.0 Centos 7 Clustering 4 node (3 data-master Node + 1 Coordinator Node) Using logstash to parsing data and using elasticse… --- ## [Logstash -\> array field -\> subquery](https://discuss.elastic.co/t/logstash-array-field-subquery/276584)
**Author:** [@seboraid](https://discuss.elastic.co/u/seboraid)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 12:06am UTC](https://discuss.elastic.co/t/logstash-array-field-subquery/276584 "2021-06-22T00:06:42Z")
Hi! Im looking to add data from a subquery (i dont jnow if this is possible) to an array field in a elastic index. I have the following tables in MySQL: transactions and applied\_rules where applied\_rules has the follo… --- ## [\nter\>nginx\tity Too Large\\d\>bana response: invalid character '\<' looking for beginning of value. Response: \](https://discuss.elastic.co/t/html-nter-nginx-center-tity-too-large-h1-center-d-bana-response-invalid-character-looking-for-beginning-of-value-response-html/276550)
**Author:** [@gavinmathias](https://discuss.elastic.co/u/gavinmathias)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 10:05pm UTC](https://discuss.elastic.co/t/html-nter-nginx-center-tity-too-large-h1-center-d-bana-response-invalid-character-looking-for-beginning-of-value-response-html/276550 "2021-06-21T22:05:34Z")
Seeing this error when running filebeat -e setup. Any hints on how to troubleshoot this? Index setup finished. Loading dashboards (Kibana must be running and reachable) 2021-06-21T13:19:14.860Z INFO kibana/client.go:119… --- ## [Is there a way to do msearch operations with ESRally?](https://discuss.elastic.co/t/is-there-a-way-to-do-msearch-operations-with-esrally/276579)
**Author:** [@sanoj85](https://discuss.elastic.co/u/sanoj85)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:29pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-do-msearch-operations-with-esrally/276579 "2021-06-21T21:29:30Z")
Like the title says. I was using the regular search operations in benchmark, but was considering switching to msearch. I know it is not in the documentation spec, but is there a way to emulate it, or is it on the way in … --- ## [Whitelist processes in Uncommon Processes](https://discuss.elastic.co/t/whitelist-processes-in-uncommon-processes/276285)
**Author:** [@bmbrit](https://discuss.elastic.co/u/bmbrit)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 9:12pm UTC](https://discuss.elastic.co/t/whitelist-processes-in-uncommon-processes/276285 "2021-06-21T21:12:07Z")
Hi, I don't want to see processes that are legitimate. Is it possible to whitelist processes so that they don't appear in the uncommon processes? Thanks in advance, Brit --- ## [Using Filebeat to fetch CrowdStrike Falcon Data Replicator (FDR) logs with S3 SQS](https://discuss.elastic.co/t/using-filebeat-to-fetch-crowdstrike-falcon-data-replicator-fdr-logs-with-s3-sqs/276395)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 8:37pm UTC](https://discuss.elastic.co/t/using-filebeat-to-fetch-crowdstrike-falcon-data-replicator-fdr-logs-with-s3-sqs/276395 "2021-06-21T20:37:31Z")
I'm interested in using Filebeat to fetch CrowdStrike Falcon Data Replicator (FDR) logs with the aws-s3 plugin, and use its parallel processing functionality due to the sheer volume of data FDR produces. But I'm running… --- ## [Automatic setting of read\_only\_allow\_delete](https://discuss.elastic.co/t/automatic-setting-of-read-only-allow-delete/276525)
**Author:** [@kfehrenbach](https://discuss.elastic.co/u/kfehrenbach)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 8:09pm UTC](https://discuss.elastic.co/t/automatic-setting-of-read-only-allow-delete/276525 "2021-06-21T20:09:06Z")
We're running elasticsearch version 6.8.8 and 7.7. In both clusters we observed the bahaviour, that the cluster is setting the parameter read\_only\_allow\_delete to true as soon as the fllod stage is reached for some of th… --- ## [ECS fields for Postfix?](https://discuss.elastic.co/t/ecs-fields-for-postfix/276284)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:06pm UTC](https://discuss.elastic.co/t/ecs-fields-for-postfix/276284 "2021-06-21T20:06:58Z")
Initially in response to My Elastic Stack Observability Wishlist - #5 by weltenwort, but I think this really is it's own topic. Are there ECS fields for Postfix logs? Or, rather, how would you break out postfix log mess… [Previous page](https://discuss.elastic.co/latest.md?page=1609) [Next page](https://discuss.elastic.co/latest.md?page=1611)