# Latest **URL:** https://discuss.elastic.co/latest.md?page=1615 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1616 --- ## [Transforms: do I need to filter source for time-series data?](https://discuss.elastic.co/t/transforms-do-i-need-to-filter-source-for-time-series-data/276057)
**Author:** [@rokcarl](https://discuss.elastic.co/u/rokcarl)\ **Replies:** 9\ **Last updated:** [June 18, 2021, 8:18am UTC](https://discuss.elastic.co/t/transforms-do-i-need-to-filter-source-for-time-series-data/276057 "2021-06-18T08:18:42Z")
I'm doing a transformation of time-series/events data that does not change for the past. I've talked to an Elastic engineer Ben on Slack and it seems like I might have stumbled upon a bug. I'm using this index config a… --- ## [Es7.x querystring can't boost NOT query](https://discuss.elastic.co/t/es7-x-querystring-cant-boost-not-query/275653)
**Author:** [@laigood](https://discuss.elastic.co/u/laigood)\ **Replies:** 2\ **Last updated:** [June 18, 2021, 7:45am UTC](https://discuss.elastic.co/t/es7-x-querystring-cant-boost-not-query/275653 "2021-06-18T07:45:28Z")
I found that from es7.0,querystring query can't boost NOT query,like below code,the result score is 0,not 100 as expect.I alse check in es5.x and es6.x it work as expect.someone know why? PUT test/\_doc/1 { "test": "1"… --- ## [Space isolation](https://discuss.elastic.co/t/space-isolation/276340)
**Author:** [@Dheeraj\_Bhargav](https://discuss.elastic.co/u/Dheeraj_Bhargav)\ **Replies:** 1\ **Last updated:** [June 18, 2021, 7:42am UTC](https://discuss.elastic.co/t/space-isolation/276340 "2021-06-18T07:42:07Z")
Hello guys, I want to isolate my environment in kibana space, like i want a space for dev where only dev machines are monitoring and a space for prod for prod machines only. How can i do that. --- ## [Office 365 Module , Filebeat, Logstash, and Elastic Search](https://discuss.elastic.co/t/office-365-module-filebeat-logstash-and-elastic-search/276231)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [June 18, 2021, 7:38am UTC](https://discuss.elastic.co/t/office-365-module-filebeat-logstash-and-elastic-search/276231 "2021-06-18T07:38:31Z")
Im current using the Office 365 module but Im having several issues. First, I use Logstash for processsing (mostly because I put data in daily indexes). All I do in Logstash is take the data and pass it to Elasticsearch… --- ## [How to make Logstash plugin to BCFIPS compliant?](https://discuss.elastic.co/t/how-to-make-logstash-plugin-to-bcfips-compliant/276338)
**Author:** [@sivatejaperam](https://discuss.elastic.co/u/sivatejaperam)\ **Replies:** 0\ **Last updated:** [June 18, 2021, 6:57am UTC](https://discuss.elastic.co/t/how-to-make-logstash-plugin-to-bcfips-compliant/276338 "2021-06-18T06:57:31Z")
I am trying to make my log stash input plugin to BCFIPS complaint. I have added bc-fips.jar in my plugin dependency list and also registered the fips provider using Security.addProvider(new BouncyCastleFipsProvider()); . … --- ## [Search Query with Lucene Query issue](https://discuss.elastic.co/t/search-query-with-lucene-query-issue/251727)
**Author:** [@sikeeoh](https://discuss.elastic.co/u/sikeeoh)\ **Replies:** 6\ **Last updated:** [June 18, 2021, 6:46am UTC](https://discuss.elastic.co/t/search-query-with-lucene-query-issue/251727 "2021-06-18T06:46:39Z")
Search Query with Lucene Query Syntax If there are more than 4 OR or AND conditions, it does not work properly. query : "ten" OR "teen" OR "alask" query : "ten" OR "teen" OR "alask" OR "hihi" OR "bye" --- ## [How to stop table row text truncation in Kibana?](https://discuss.elastic.co/t/how-to-stop-table-row-text-truncation-in-kibana/276327)
**Author:** [@rak](https://discuss.elastic.co/u/rak)\ **Replies:** 1\ **Last updated:** [June 18, 2021, 6:33am UTC](https://discuss.elastic.co/t/how-to-stop-table-row-text-truncation-in-kibana/276327 "2021-06-18T06:33:40Z")
I have made a data table in Kibana however long lines of text (stored as a keyword) are truncated and do not completely show (view image below). I have changed the table height setting within the advanced settings to 0 a… --- ## [Cannot make this work](https://discuss.elastic.co/t/cannot-make-this-work/276090)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 4\ **Last updated:** [June 18, 2021, 5:13am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090 "2021-06-18T05:13:28Z")
Hi Group I struggling like H\*\*\* t omake this work I have created an ELK server on Ubuntu 20.04LTS - and would like to monitor both Normal Linux/Windows Server - and allso our PFsense Routers. I'm using the PFELK --\> G… --- ## [Ruby Code to split key value pair in Logstash 6.8.0](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933)
**Author:** [@Santy](https://discuss.elastic.co/u/Santy)\ **Replies:** 4\ **Last updated:** [June 18, 2021, 5:13am UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933 "2021-06-18T05:13:16Z")
json { source =\> "message" } split { field =\> "data" } date { match =\> \["\[data\]\[currentDate\]", "yyyy-MM-dd HH:mm:ss"\] target =\> "@timestamp" } ruby { code =\> " event\['data'\].each {|k, v| … --- ## [Filebeat on windows 10 client not work](https://discuss.elastic.co/t/filebeat-on-windows-10-client-not-work/276332)
**Author:** [@dia](https://discuss.elastic.co/u/dia)\ **Replies:** 0\ **Last updated:** [June 18, 2021, 4:32am UTC](https://discuss.elastic.co/t/filebeat-on-windows-10-client-not-work/276332 "2021-06-18T04:32:32Z")
filebeat service is running, but I see nothing from it on elasticsearch filebeat index below is from Linux client and it is working fine.. curl -XGET "https://d4850cf616524f54b7ec7628ed283e2a.deyaa.lab:9243/\_cat/indice… --- ## [Elasticsearch build-in user changed password](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330)
**Author:** [@drewkrrb](https://discuss.elastic.co/u/drewkrrb)\ **Replies:** 5\ **Last updated:** [June 18, 2021, 3:44am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330 "2021-06-18T03:44:53Z")
Hi all Our Elasticsearch environment is deployed on our kubernetes platform using the official helm chart. We only have 2 elasticsearch pods. We are using xpack.security.enabled: true and setup the password for elastic… --- ## [Automate applying a pipeline to documents](https://discuss.elastic.co/t/automate-applying-a-pipeline-to-documents/276059)
**Author:** [@Spricer](https://discuss.elastic.co/u/Spricer)\ **Replies:** 7\ **Last updated:** [June 17, 2021, 2:41pm UTC](https://discuss.elastic.co/t/automate-applying-a-pipeline-to-documents/276059 "2021-06-17T14:41:25Z")
I created "mypipeline" pipeline with grok processor. I have syslog-ng-(xx) indexes created daily. If I apply in console: POST syslog-ng\*/\_update\_by\_query?pipeline=mypipeline I can see all my indexes get updated and s… --- ## [Connection logs in Azure from Azure Filebeat Module](https://discuss.elastic.co/t/connection-logs-in-azure-from-azure-filebeat-module/276306)
**Author:** [@Doodle](https://discuss.elastic.co/u/Doodle)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 7:31pm UTC](https://discuss.elastic.co/t/connection-logs-in-azure-from-azure-filebeat-module/276306 "2021-06-17T19:31:43Z")
Hello, I would want make a dashboard where I want to see all my connection logs from my Azure Filebeat module to Elastic. Sort of a granularity for my SaaS. Because right now I can only see the activity logs as a bulk, … --- ## [Payload content length greater than maximum allowed: 1048576](https://discuss.elastic.co/t/payload-content-length-greater-than-maximum-allowed-1048576/276303)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 1\ **Last updated:** [June 18, 2021, 2:46am UTC](https://discuss.elastic.co/t/payload-content-length-greater-than-maximum-allowed-1048576/276303 "2021-06-18T02:46:52Z")
Hi, I am working on log data(present on client machine) to monitor on Kibana server(present on differnt machine). I started with setup and installation of Filebeat on the client machine and enabled logstash elasticserac… --- ## [Elastic Observability Certification Question](https://discuss.elastic.co/t/elastic-observability-certification-question/276292)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 7\ **Last updated:** [June 18, 2021, 2:24am UTC](https://discuss.elastic.co/t/elastic-observability-certification-question/276292 "2021-06-18T02:24:05Z")
Hi all, I've just finished the Observability Course and I'll start to prepare the certification. Reviewing the exam objectives there is one it is not clear to me Metrics Configure and run Metricbeat to collect metri… --- ## [Elastic-endpoint process still running when I stop the elastic-agent service](https://discuss.elastic.co/t/elastic-endpoint-process-still-running-when-i-stop-the-elastic-agent-service/276269)
**Author:** [@lotus](https://discuss.elastic.co/u/lotus)\ **Replies:** 2\ **Last updated:** [June 18, 2021, 1:35am UTC](https://discuss.elastic.co/t/elastic-endpoint-process-still-running-when-i-stop-the-elastic-agent-service/276269 "2021-06-18T01:35:56Z")
Hello, we have installed elastic-agent-7.12 on Ubuntu 18.04 to test Endpoint security recently, but we found the elastic-endpoint take a quit large CPU, we decide to sopt it temporarily. while we stop the service elas… --- ## [How to sort fields used as terms?](https://discuss.elastic.co/t/how-to-sort-fields-used-as-terms/276325)
**Author:** [@Lucas\_Boswell](https://discuss.elastic.co/u/Lucas_Boswell)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 11:42pm UTC](https://discuss.elastic.co/t/how-to-sort-fields-used-as-terms/276325 "2021-06-17T23:42:53Z")
Hello there, I am attempting to understand the sorting/bucket\_sort functionality a bit better. Below is a simple query that groups by a productId, gathers some additional info related to productId, and then calculates a… --- ## [Workaround for search query issue with Lucene multiple OR](https://discuss.elastic.co/t/workaround-for-search-query-issue-with-lucene-multiple-or/276323)
**Author:** [@zkirill](https://discuss.elastic.co/u/zkirill)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 11:24pm UTC](https://discuss.elastic.co/t/workaround-for-search-query-issue-with-lucene-multiple-or/276323 "2021-06-17T23:24:07Z")
In reference to the original post by @sikeeoh (Search Query with Lucene Query issue) We were able to find a workaround. I'm not sure if it accomplishes the same result but it seems to be working. "ten" OR ("teen" OR ("… --- ## [How to record Level:Error Logs to APM Errors](https://discuss.elastic.co/t/how-to-record-level-error-logs-to-apm-errors/275601)
**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 11:05pm UTC](https://discuss.elastic.co/t/how-to-record-level-error-logs-to-apm-errors/275601 "2021-06-17T23:05:50Z")
I have an application that will write logs to elasticsearch using serilog and is running APM on the docker-compose file. For some reason whenever I run the application and perform a task that will cause an error, it will… --- ## [Logstash is losing connection to Elastic search](https://discuss.elastic.co/t/logstash-is-losing-connection-to-elastic-search/276319)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 10:26pm UTC](https://discuss.elastic.co/t/logstash-is-losing-connection-to-elastic-search/276319 "2021-06-17T22:26:35Z")
Hi, My logstash is disconnecting to elasticsearch after 20 mins, elasticsearch is running and no error. Here is the logs I have: \[WARN \]\[logstash.outputs.elasticsearch\] Marking url as dead. Last error: \[LogStash::Outp… --- ## [OSQuery Live Queries don't go through](https://discuss.elastic.co/t/osquery-live-queries-dont-go-through/274428)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 14\ **Last updated:** [June 17, 2021, 9:31pm UTC](https://discuss.elastic.co/t/osquery-live-queries-dont-go-through/274428 "2021-06-17T21:31:07Z")
Hey, I'm using a 7.13 stack with 7.13 Elastic Agents on multiple machines. I have the OSQuery Manager Integration installed (v. 0.2.3) and applied a respective policy to three Agents (2x Ubuntu 20.04, 1x Windows Server … --- ## [termsQuery no longer uses XContentWriters](https://discuss.elastic.co/t/termsquery-no-longer-uses-xcontentwriters/276316)
**Author:** [@Lars\_Benedetto](https://discuss.elastic.co/u/Lars_Benedetto)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 9:15pm UTC](https://discuss.elastic.co/t/termsquery-no-longer-uses-xcontentwriters/276316 "2021-06-17T21:15:39Z")
Between 7.9.3 and 7.12.1 it seems the way that arguments to termsQuery() are serialized have changed. In 7.9.3 it used my XContentBuilderExtension to convert my classes to strings that could be understood by elasticsearc… --- ## [Filebeat conditional hint default config](https://discuss.elastic.co/t/filebeat-conditional-hint-default-config/275668)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 8:29pm UTC](https://discuss.elastic.co/t/filebeat-conditional-hint-default-config/275668 "2021-06-17T20:29:16Z")
Hi, I have following use case: I am using hint based auto discover feature and I want to provide more than one default config based on for example kubernetes.namespace.name. Semantically: "If namespace = X apply defau… --- ## [Kibana - metric with top hits based on string](https://discuss.elastic.co/t/kibana-metric-with-top-hits-based-on-string/275738)
**Author:** [@kelvins](https://discuss.elastic.co/u/kelvins)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 8:08pm UTC](https://discuss.elastic.co/t/kibana-metric-with-top-hits-based-on-string/275738 "2021-06-17T20:08:01Z")
Hello - I have been hunting around, and I think I cannot actually do what it is I want to do, but am wanting to confirm my suspicions. The plan is to read the data from a log, to see the progress of users downloading fi… --- ## [Help changing y axis on kibana lenses](https://discuss.elastic.co/t/help-changing-y-axis-on-kibana-lenses/276196)
**Author:** [@Jason2073](https://discuss.elastic.co/u/Jason2073)\ **Replies:** 8\ **Last updated:** [June 17, 2021, 8:00pm UTC](https://discuss.elastic.co/t/help-changing-y-axis-on-kibana-lenses/276196 "2021-06-17T20:00:43Z")
I can't seem to use any variable other than Records, and meta fields for the Y axis of a line or area graph. I am struggling to find a guide on whats wrong or other people with a similar issue. Ideally I want the y ax… --- ## [API Endpoint to initiate crawl of single page](https://discuss.elastic.co/t/api-endpoint-to-initiate-crawl-of-single-page/276296)
**Author:** [@tchocky](https://discuss.elastic.co/u/tchocky)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 7:49pm UTC](https://discuss.elastic.co/t/api-endpoint-to-initiate-crawl-of-single-page/276296 "2021-06-17T19:49:21Z")
Hi all - I am looking for a way to initiate the crawl of a single page on demand via an API call. While looking through the docs I was lead to this page on the Swiftype site. This is exactly what I am looking for but it… --- ## [How to dispay hostname and host ip on my elastic search output?](https://discuss.elastic.co/t/how-to-dispay-hostname-and-host-ip-on-my-elastic-search-output/275928)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 7:49pm UTC](https://discuss.elastic.co/t/how-to-dispay-hostname-and-host-ip-on-my-elastic-search-output/275928 "2021-06-17T19:49:14Z")
Hi, Can help me please extract the host name from the message output (devname) in elasticsearch. In my current config on the host portion only ip is displayed. Current config: input { syslog { port =\> 5000 host =\> … --- ## [FATAL Error: \[config validation of \[xpack.security\].http\]: definition for this key is missing](https://discuss.elastic.co/t/fatal-error-config-validation-of-xpack-security-http-definition-for-this-key-is-missing/275887)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 7:37pm UTC](https://discuss.elastic.co/t/fatal-error-config-validation-of-xpack-security-http-definition-for-this-key-is-missing/275887 "2021-06-17T19:37:20Z")
Hi, I follow Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide \[7.13\] | Elastic and am stuck at Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elastic… --- ## [Azure Filebeat Module - 412 error](https://discuss.elastic.co/t/azure-filebeat-module-412-error/276305)
**Author:** [@Doodle](https://discuss.elastic.co/u/Doodle)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 7:28pm UTC](https://discuss.elastic.co/t/azure-filebeat-module-412-error/276305 "2021-06-17T19:28:03Z")
Hi, I recently used the filebeat module from Azure and it seems that I receive the logs extremely hard. They are delayed and when they finally come, they come in a bulk. Do you know why this is happening? As an analyst … --- ## [Visualizing Average with Removing Outliers](https://discuss.elastic.co/t/visualizing-average-with-removing-outliers/276184)
**Author:** [@JR42](https://discuss.elastic.co/u/JR42)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 7:09pm UTC](https://discuss.elastic.co/t/visualizing-average-with-removing-outliers/276184 "2021-06-17T19:09:24Z")
Hey all, looking to get some help on a topic that has had me stumped. I am currently charting the average compile times (which the compile time is a scripted field on the index pattern), bucketed by month using a date h… [Previous page](https://discuss.elastic.co/latest.md?page=1614) [Next page](https://discuss.elastic.co/latest.md?page=1616)