# Latest **URL:** https://discuss.elastic.co/latest.md?page=1626 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1627 --- ## [APM agent deployment for rabbitmq](https://discuss.elastic.co/t/apm-agent-deployment-for-rabbitmq/274138)
**Author:** [@chandu5565](https://discuss.elastic.co/u/chandu5565)\ **Replies:** 7\ **Last updated:** [June 14, 2021, 6:54am UTC](https://discuss.elastic.co/t/apm-agent-deployment-for-rabbitmq/274138 "2021-06-14T06:54:56Z")
Hi Team, We are trying to install apm agent for rabbitmq in kubernetes cluster to find the transactions. I have seen in the release notes that apm-agent-java versions greater than 1.20.0 supports APM for rabbitmq with j… --- ## [Loadtesting on elasticsearch](https://discuss.elastic.co/t/loadtesting-on-elasticsearch/275788)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 6:33am UTC](https://discuss.elastic.co/t/loadtesting-on-elasticsearch/275788 "2021-06-14T06:33:19Z")
Hi All, I am new to elasticsearch. usecase is to do loadtest on Elasticsearch cluster so that KPI can be monitored(for ex: documents indexed per second, repilcation etc etc). What are the available solutions for this? --- ## [Warnings shown in Rally benchmarking for bulk request](https://discuss.elastic.co/t/warnings-shown-in-rally-benchmarking-for-bulk-request/275649)
**Author:** [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 6:03am UTC](https://discuss.elastic.co/t/warnings-shown-in-rally-benchmarking-for-bulk-request/275649 "2021-06-14T06:03:04Z")
\[WARNING\] merges\_total\_time is 4362 ms indicating that the cluster is not in a defined clean state. Recorded index time metrics may be misleading. \[WARNING\] indexing\_total\_time is 423514 ms indicating that the cluster is… --- ## [Problems getting new node to join cluster](https://discuss.elastic.co/t/problems-getting-new-node-to-join-cluster/275776)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 5:58am UTC](https://discuss.elastic.co/t/problems-getting-new-node-to-join-cluster/275776 "2021-06-14T05:58:42Z")
I am trying to add a couple of nodes to an existing cluster of 3 nodes. These "new" nodes have been in the cluster in the past but were taken out for "refurbishment" and now I am having issues getting them back in. see… --- ## [ドキュメント作成時に@timestampに現在日時を埋め込む方法](https://discuss.elastic.co/t/timestamp/275513)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 5:56am UTC](https://discuss.elastic.co/t/timestamp/275513 "2021-06-14T05:56:36Z")
以下のURLを参照しています インデックス作成APIを実行する際、タイムスタンプ型のフィールドに現在時刻を設定する方法があればご教示頂けないでしょうか？ 以下の例でいうと、@timestampフィールドに現在時刻を設定したいです PUT my-index-000001/\_doc/1?timeout=5m { "@timestamp": "2099-11-15T13:12:00", "message": "GET /sea… --- ## [Not able to search user with pending invitation](https://discuss.elastic.co/t/not-able-to-search-user-with-pending-invitation/274170)
**Author:** [@Prateek\_Yadav](https://discuss.elastic.co/u/Prateek_Yadav)\ **Replies:** 5\ **Last updated:** [June 14, 2021, 5:50am UTC](https://discuss.elastic.co/t/not-able-to-search-user-with-pending-invitation/274170 "2021-06-14T05:50:02Z")
Hi, I'm on 7.12 self hosted version of Workplace Search and have realised that users who haven't accepted email invitation are not visible anymore on UI. This has happened after update to 7.12 I believe. Now, if I add t… --- ## [Search using misspelled querys?](https://discuss.elastic.co/t/search-using-misspelled-querys/275783)
**Author:** [@Sebastian\_Marroquin](https://discuss.elastic.co/u/Sebastian_Marroquin)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 4:18am UTC](https://discuss.elastic.co/t/search-using-misspelled-querys/275783 "2021-06-14T04:18:46Z")
Hi there, I'm working with elasticsearch version 6.2.4 along with the MEN stack. I was wondering if there is any way for elasticsearch to do searches even when the query is misspelled. I'll put it in Spanish to see if I … --- ## [Unassigned shards of index - not permitted by any node](https://discuss.elastic.co/t/unassigned-shards-of-index-not-permitted-by-any-node/275766)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 4:01am UTC](https://discuss.elastic.co/t/unassigned-shards-of-index-not-permitted-by-any-node/275766 "2021-06-14T04:01:07Z")
Hey, I'm trying to understand how to fix this issue of unassigned shards in my index: When running the explain API - I'm getting "no" for allocation: "can\_allocate" : "no" And in each node (9 of them), the decider… --- ## [APM Server specification- Recommendations](https://discuss.elastic.co/t/apm-server-specification-recommendations/273781)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 7\ **Last updated:** [June 14, 2021, 3:33am UTC](https://discuss.elastic.co/t/apm-server-specification-recommendations/273781 "2021-06-14T03:33:34Z")
Can anybody help me in getting below information: - APM Server Specification APM Recommendations --- ## [Number of docs count does not match number of json file records](https://discuss.elastic.co/t/number-of-docs-count-does-not-match-number-of-json-file-records/275739)
**Author:** [@rafaell2](https://discuss.elastic.co/u/rafaell2)\ **Replies:** 7\ **Last updated:** [June 13, 2021, 9:58pm UTC](https://discuss.elastic.co/t/number-of-docs-count-does-not-match-number-of-json-file-records/275739 "2021-06-13T21:58:26Z")
Hi. I am trying to load a json file with 8 records from filebeats to logstash (latest verion 7.13). It looks like i have no errors but when i check number of records at Kibana Index Management i see docs counts = 1 (also… --- ## [Adding Threat Intel Module To Existing Filebeat.yml Installed via Elastic-Agent](https://discuss.elastic.co/t/adding-threat-intel-module-to-existing-filebeat-yml-installed-via-elastic-agent/275775)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 9:56pm UTC](https://discuss.elastic.co/t/adding-threat-intel-module-to-existing-filebeat-yml-installed-via-elastic-agent/275775 "2021-06-13T21:56:25Z")
Can I add a threat intel module (e.g., otx) to an existing filebeat.yml that was installed via an elastic agent? --- ## [JSON Filtering In Logstash To Remove Unwanted Fields](https://discuss.elastic.co/t/json-filtering-in-logstash-to-remove-unwanted-fields/275697)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 2\ **Last updated:** [June 13, 2021, 9:38pm UTC](https://discuss.elastic.co/t/json-filtering-in-logstash-to-remove-unwanted-fields/275697 "2021-06-13T21:38:18Z")
I want to ingest JSON PE file data that has 40+ fields w/nested fields. I only want the first few fields. Is there a way to either drop the unwanted fields or can I explicitly state which fields I want? --- ## ["All fetched documents included fields with arrays of values and cannot be visualized."](https://discuss.elastic.co/t/all-fetched-documents-included-fields-with-arrays-of-values-and-cannot-be-visualized/275774)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 8:14pm UTC](https://discuss.elastic.co/t/all-fetched-documents-included-fields-with-arrays-of-values-and-cannot-be-visualized/275774 "2021-06-13T20:14:39Z")
Hello, I'm trying to create a data frame analytics ML job, and I have two fields that have an array of numbers. The issue is that the analytics job cannot visualize these arrays. Is there any work around or fix? The err… --- ## [Detections - Kibana](https://discuss.elastic.co/t/detections-kibana/275716)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 7\ **Last updated:** [June 13, 2021, 7:04pm UTC](https://discuss.elastic.co/t/detections-kibana/275716 "2021-06-13T19:04:31Z")
Hi, I am trying to use detection rules in Kibana. I am testing it on predefined rules under Security module. To be exact " User Account Creation" . I am using winlog to send out data to kibana. I see user creation event… --- ## [Sorting on Nested array object within the same json file](https://discuss.elastic.co/t/sorting-on-nested-array-object-within-the-same-json-file/275767)
**Author:** [@madhan88](https://discuss.elastic.co/u/madhan88)\ **Replies:** 1\ **Last updated:** [June 13, 2021, 7:03pm UTC](https://discuss.elastic.co/t/sorting-on-nested-array-object-within-the-same-json-file/275767 "2021-06-13T19:03:47Z")
Hi, I'm trying to sort the fields present within an array which is of type nested. My data : { "name" : "abc", "shipping":\[ { "shipmentcode" : 5, "shipmentstatus" : "resolved", "shipmentorderid": "12345" }, { … --- ## [Parsing mySql slow query logs using Logstash](https://discuss.elastic.co/t/parsing-mysql-slow-query-logs-using-logstash/275518)
**Author:** [@learningelk](https://discuss.elastic.co/u/learningelk)\ **Replies:** 6\ **Last updated:** [June 13, 2021, 5:07pm UTC](https://discuss.elastic.co/t/parsing-mysql-slow-query-logs-using-logstash/275518 "2021-06-13T17:07:10Z")
I want to parse the mysql slow query logs using logstash and I want to replace modifieddate \> '2021-06-08 08:13:48' with some generix text like modifieddate \> 'NNNN' Below is the log sample : # Time: 2021-06-10T06:30:… --- ## [Nested queries don't work as documented](https://discuss.elastic.co/t/nested-queries-dont-work-as-documented/275737)
**Author:** [@titani0us](https://discuss.elastic.co/u/titani0us)\ **Replies:** 2\ **Last updated:** [June 13, 2021, 4:45pm UTC](https://discuss.elastic.co/t/nested-queries-dont-work-as-documented/275737 "2021-06-13T16:45:55Z")
Hello, As documented in your documentation here, the documentation shows using dot-notation to traverse a nested field (user -\> id). However, when using the query dsl this way, no results are returned. Instead, you mus… --- ## [How can ser grok if log have different content from the same equipment?](https://discuss.elastic.co/t/how-can-ser-grok-if-log-have-different-content-from-the-same-equipment/275541)
**Author:** [@111418](https://discuss.elastic.co/u/111418)\ **Replies:** 5\ **Last updated:** [June 13, 2021, 3:54pm UTC](https://discuss.elastic.co/t/how-can-ser-grok-if-log-have-different-content-from-the-same-equipment/275541 "2021-06-13T15:54:59Z")
Jun 2 16:45:49 tp-id01.test.corp zorp/scb\_ssh\[1379\]: core.alerting(3): (svc/wwVRLvYoUMToHT2Xz9vEbj/ssh\_alert:11/ssh): Audit event was recognized; rule='PatternMatcherRule', type='adp.event.command', pattern='user', acti… --- ## [Find contact with aggs terms and date range and use the found contacts for another aggs with date\_histogram](https://discuss.elastic.co/t/find-contact-with-aggs-terms-and-date-range-and-use-the-found-contacts-for-another-aggs-with-date-histogram/275762)
**Author:** [@gregoire\_Tarres](https://discuss.elastic.co/u/gregoire_Tarres)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 12:25pm UTC](https://discuss.elastic.co/t/find-contact-with-aggs-terms-and-date-range-and-use-the-found-contacts-for-another-aggs-with-date-histogram/275762 "2021-06-13T12:25:13Z")
Hi, i'm new with Elaticsearch and I need some help for a search query.... Thanks in advance ! I've an index with docs between 2021-02-01 and 2021-04-01. I make a search query like this to retrieve phone numbers that app… --- ## [Detection and Response for HAFNIUM Activity](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289)
**Author:** [@devonkerr](https://discuss.elastic.co/u/devonkerr)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 10:47pm UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289 "2021-03-10T22:47:14Z")
Detection and Response for HAFNIUM Activity Executive summary On March 2, 2021, Microsoft released a security update for on-premises Exchange servers to address vulnerabilities being exploited. Security vendors are seein… --- ## [Logs hit value is different](https://discuss.elastic.co/t/logs-hit-value-is-different/275675)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 7\ **Last updated:** [June 13, 2021, 10:40am UTC](https://discuss.elastic.co/t/logs-hit-value-is-different/275675 "2021-06-13T10:40:30Z")
I have two elasticsearch cluster one elk cluster version is 7.6 and other elk cluster version is 7.11 The former elasticsearch cluster is simple it filebeat send the logs to logstash and logstash to elasticsearch, the … --- ## [Best way to define multiple processors based on a group of conditions](https://discuss.elastic.co/t/best-way-to-define-multiple-processors-based-on-a-group-of-conditions/275732)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 2\ **Last updated:** [June 13, 2021, 10:21am UTC](https://discuss.elastic.co/t/best-way-to-define-multiple-processors-based-on-a-group-of-conditions/275732 "2021-06-13T10:21:02Z")
Hi all I have been trying to work out the way define multiple processors based on a group of conditions. The below snippet doesn't seem to be working but hopefully it will give you an idea of what I am trying to accompli… --- ## [Logstash grok nginx log](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583)
**Author:** [@rdnaz](https://discuss.elastic.co/u/rdnaz)\ **Replies:** 2\ **Last updated:** [June 13, 2021, 8:19am UTC](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583 "2021-06-13T08:19:36Z")
Hi dears, I want to grok nginx access log but i cant get the seperated field of the message , i tried to use overwrite and doesn't make the solution. my Log format is below : \ Jun 10, 2021 @ 11:07:43.648 host:lo… --- ## [Need to load balance Logstash](https://discuss.elastic.co/t/need-to-load-balance-logstash/275619)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 8\ **Last updated:** [June 13, 2021, 6:45am UTC](https://discuss.elastic.co/t/need-to-load-balance-logstash/275619 "2021-06-13T06:45:58Z")
I'm currently running a single logstash and interested in creating several for resilience in case one goes down, and for improving performance. I'm ingesting data currently with the http input plugin. I'm thinking about… --- ## [Filebeat not reading the files with names saved as numbers](https://discuss.elastic.co/t/filebeat-not-reading-the-files-with-names-saved-as-numbers/275741)
**Author:** [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\ **Replies:** 1\ **Last updated:** [June 13, 2021, 6:05am UTC](https://discuss.elastic.co/t/filebeat-not-reading-the-files-with-names-saved-as-numbers/275741 "2021-06-13T06:05:40Z")
My log files are named with numbers for example 45678.rdlog and the filebeat couldn't able to read it and if I re name the file to something like test.rdlog it can able to read it. these logs are generated by rundeck an… --- ## [Received fatal alert: handshake\_failure. How to Solve it?](https://discuss.elastic.co/t/received-fatal-alert-handshake-failure-how-to-solve-it/275749)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 5:18am UTC](https://discuss.elastic.co/t/received-fatal-alert-handshake-failure-how-to-solve-it/275749 "2021-06-13T05:18:12Z")
Hi All While running LS, i am getting this below error. My HTTP endpoint uses TLS 1.3 It works perfectly for HTTP endpoint with TLS V1.2 looks like LS package does not support for open jruby-openssl In the Gem.lock f… --- ## [Set up - load the Kibana templates](https://discuss.elastic.co/t/set-up-load-the-kibana-templates/275731)
**Author:** [@sk88](https://discuss.elastic.co/u/sk88)\ **Replies:** 3\ **Last updated:** [June 13, 2021, 12:48am UTC](https://discuss.elastic.co/t/set-up-load-the-kibana-templates/275731 "2021-06-13T00:48:21Z")
i have the fllowing error root@stathis:/home/stathis# /usr/share/filebeat/bin/filebeat setup Exiting: error loading config file: stat filebeat.yml: no such file or directory filebeat test config: Config OK also file… --- ## [EQL library where](https://discuss.elastic.co/t/eql-library-where/275524)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [June 12, 2021, 7:57pm UTC](https://discuss.elastic.co/t/eql-library-where/275524 "2021-06-12T19:57:22Z")
Hello, Just noticed an EQL query in Suspicious RDP ActiveX Client Loaded | Elastic Security Solution \[7.13\] | Elastic where a "library where" clause is used. What kind of events contain library? I always though the firs… --- ## [Node memory](https://discuss.elastic.co/t/node-memory/275634)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 2\ **Last updated:** [June 12, 2021, 4:50pm UTC](https://discuss.elastic.co/t/node-memory/275634 "2021-06-12T16:50:14Z")
Hi All, Currently on our nodes we have 64GB RAM, with 30GB allocated to the heap, and the other 34GB for OS. I understand that I shouldn't allocate more then 30GB to the heap, but will ES/OS benefit from 128GB or 256GB… --- ## [Kibana 7.13.1 Windows - kibana-encryption-keys](https://discuss.elastic.co/t/kibana-7-13-1-windows-kibana-encryption-keys/275695)
**Author:** [@KSib](https://discuss.elastic.co/u/KSib)\ **Replies:** 2\ **Last updated:** [June 12, 2021, 2:33pm UTC](https://discuss.elastic.co/t/kibana-7-13-1-windows-kibana-encryption-keys/275695 "2021-06-12T14:33:56Z")
Hi there, from a fresh install of Kibana, I see the following warnings log \[17:57:12.982\] \[info\]\[plugins\]\[taskManager\] TaskManager is identified by the Kibana UUID: 2e13faf3-b90d-44dd-bfe8-07962b2b6a2a log \[17:5… [Previous page](https://discuss.elastic.co/latest.md?page=1625) [Next page](https://discuss.elastic.co/latest.md?page=1627)