# Latest **URL:** https://discuss.elastic.co/latest.md?page=1637 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1638 --- ## [Could not execute action: PipelineAction::Create](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create/275196)
**Author:** [@jeroen.antsec](https://discuss.elastic.co/u/jeroen.antsec)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 8:02pm UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create/275196 "2021-06-07T20:02:26Z")
Hi guys, I have a question. I have a nice running logstash and elastic cluster. When i create a large pipeline of over 4000 lines logstash crashes with the following error: \[2021-06-07T19:27:23,511\]\[INFO \]\[logstash.jav… --- ## [Filebeat now reading the files with numbers](https://discuss.elastic.co/t/filebeat-now-reading-the-files-with-numbers/275195)
**Author:** [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 7:57pm UTC](https://discuss.elastic.co/t/filebeat-now-reading-the-files-with-numbers/275195 "2021-06-07T19:57:36Z")
My log files are named with numbers for example 45678.rdlog and the filebeat couldn't able to read it and if I re name the file to something like test.rdlog it can able to read it. these logs are generated by rundeck an… --- ## [Create HTTPS Enabled Elasticsearch API](https://discuss.elastic.co/t/create-https-enabled-elasticsearch-api/274881)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 7:51pm UTC](https://discuss.elastic.co/t/create-https-enabled-elasticsearch-api/274881 "2021-06-07T19:51:37Z")
While going through the document of creating an Elasticsearch API, there is a note for http.ssl.enabled node. It is asking to specify https while creating API key, but I am bit confused that where I need to mention about… --- ## [Metricbeat AWS credentials not working for Non-region endpoint](https://discuss.elastic.co/t/metricbeat-aws-credentials-not-working-for-non-region-endpoint/275191)
**Author:** [@swontonsoup](https://discuss.elastic.co/u/swontonsoup)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 7:29pm UTC](https://discuss.elastic.co/t/metricbeat-aws-credentials-not-working-for-non-region-endpoint/275191 "2021-06-07T19:29:23Z")
This is similar to Metricbeat AWS module endpoint not working correctly. I tested on 7.13.1, but I think this should persist to current master branch. So I tried 3 different configurations and am unable to get the desir… --- ## [Having a hard time writing a query to exclude results](https://discuss.elastic.co/t/having-a-hard-time-writing-a-query-to-exclude-results/275186)
**Author:** [@ccvanilla](https://discuss.elastic.co/u/ccvanilla)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 6:25pm UTC](https://discuss.elastic.co/t/having-a-hard-time-writing-a-query-to-exclude-results/275186 "2021-06-07T18:25:00Z")
Hello! I'm having a hard time writing a query to exclude certain results. I want to be able to search the index for one or many job titles, but also exclude one or many job titles from the results. For example, I want … --- ## [Winlogbeat drop\_fields not working](https://discuss.elastic.co/t/winlogbeat-drop-fields-not-working/275129)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 5\ **Last updated:** [June 7, 2021, 6:20pm UTC](https://discuss.elastic.co/t/winlogbeat-drop-fields-not-working/275129 "2021-06-07T18:20:48Z")
Hi All, I have configured Winlogbeat to drop some fields from all the events using below configuration. But it seems the "drop\_fields" process is not applying to the events since I can see those fields in the Kibana. C… --- ## [Logstash stops getting events once in 3 days](https://discuss.elastic.co/t/logstash-stops-getting-events-once-in-3-days/274490)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 10\ **Last updated:** [June 7, 2021, 5:11pm UTC](https://discuss.elastic.co/t/logstash-stops-getting-events-once-in-3-days/274490 "2021-06-07T17:11:40Z")
We are using Logstash 7.4.2. Once in 3-4 days, Logstash stops processing events and its not parsing new events till we restart the service. We see only below error in log , :body=\>"{"error":{"root\_cause":\[{"type":"actio… --- ## [Sql Query to get data from more than one Indices](https://discuss.elastic.co/t/sql-query-to-get-data-from-more-than-one-indices/275147)
**Author:** [@Resington\_R](https://discuss.elastic.co/u/Resington_R)\ **Replies:** 5\ **Last updated:** [June 7, 2021, 5:03pm UTC](https://discuss.elastic.co/t/sql-query-to-get-data-from-more-than-one-indices/275147 "2021-06-07T17:03:54Z")
Hi... I am using the below query to get the data from 2 Indices, but I am getting this error "Queries with multiple indices are not supported". myindex1 and myindex2 structures are identical. I am using Elasticsearch V… --- ## [Filter aggregation buckets by top hits scripted field](https://discuss.elastic.co/t/filter-aggregation-buckets-by-top-hits-scripted-field/275181)
**Author:** [@mouse\_clicker](https://discuss.elastic.co/u/mouse_clicker)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 5:03pm UTC](https://discuss.elastic.co/t/filter-aggregation-buckets-by-top-hits-scripted-field/275181 "2021-06-07T17:03:41Z")
Hello everyone. Let me start by explaining the end goal of the query I'm trying to build. We have a document with the following (relative to the question) mapping: { "analysis-results" : { "mappings" : { "pr… --- ## [Cannot get original timestamp from WSo2 logs coming from Source -\> filebeat -\> logstash -\> Elasticsearch](https://discuss.elastic.co/t/cannot-get-original-timestamp-from-wso2-logs-coming-from-source-filebeat-logstash-elasticsearch/275148)
**Author:** [@Jefledge](https://discuss.elastic.co/u/Jefledge)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 4:59pm UTC](https://discuss.elastic.co/t/cannot-get-original-timestamp-from-wso2-logs-coming-from-source-filebeat-logstash-elasticsearch/275148 "2021-06-07T16:59:19Z")
I currently have logstash and filebeat running on the same AWS EC2 as a proof of concept to get logs from efs and push to Elastic for us to view on Kibana. It is all set up and working nicely, there is just one issue I c… --- ## [How Logstash works for 10,000 lines of log file](https://discuss.elastic.co/t/how-logstash-works-for-10-000-lines-of-log-file/275118)
**Author:** [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 4:58pm UTC](https://discuss.elastic.co/t/how-logstash-works-for-10-000-lines-of-log-file/275118 "2021-06-07T16:58:00Z")
I have log file that has 10,000 lines of logs, every hour 10 lines of logs will be added in the log file. at 3 AM I have 10,000 line of logs at 4 AM 10,010 lines of logs at 5 AM 10,020 lines of logs.... I would like … --- ## [Elastic App Search -- Importing Json files](https://discuss.elastic.co/t/elastic-app-search-importing-json-files/274992)
**Author:** [@NiklasSpira](https://discuss.elastic.co/u/NiklasSpira)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 4:51pm UTC](https://discuss.elastic.co/t/elastic-app-search-importing-json-files/274992 "2021-06-07T16:51:35Z")
Hello Guys, I have a problem with importing Jsons into my Elastic App Search. I've gone through nearly all the existing threads, here and everywhere else but I couldn't get my problem fixed. I'm currently trying to imp… --- ## [Logstach output data to mongodb handshake error](https://discuss.elastic.co/t/logstach-output-data-to-mongodb-handshake-error/275099)
**Author:** [@zhidong\_yuan](https://discuss.elastic.co/u/zhidong_yuan)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 4:35pm UTC](https://discuss.elastic.co/t/logstach-output-data-to-mongodb-handshake-error/275099 "2021-06-07T16:35:12Z")
I just output data to monodb with Mongodb output plugin(v3.1.6). However, somethong worng happens when logstash straring up . The logs like this: \[INFO \] 2021-06-07 13:20:09.220 \[\[main\]-pipeline-manager\] javapipeline… --- ## [Processor foreach field error hash map](https://discuss.elastic.co/t/processor-foreach-field-error-hash-map/274848)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 6\ **Last updated:** [June 7, 2021, 4:02pm UTC](https://discuss.elastic.co/t/processor-foreach-field-error-hash-map/274848 "2021-06-07T16:02:26Z")
Hi, I have this processor: \[ { "foreach": { "field": "location", "processor": { "set": { "field": "geo.lat", "value": "{{\_ingest.\_value.lat}}" } } } }, … --- ## [Highest value possible for boosted fields](https://discuss.elastic.co/t/highest-value-possible-for-boosted-fields/275175)
**Author:** [@jlarroque](https://discuss.elastic.co/u/jlarroque)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 3:49pm UTC](https://discuss.elastic.co/t/highest-value-possible-for-boosted-fields/275175 "2021-06-07T15:49:14Z")
Hi Elastic team, I would like to know what are the limits for boosting for boosted fields on a query, can I use 2000 ? Can I use 1M ? All examples I have seen are between 0 and 2, but I would like to know in advance what… --- ## [Kibana TSVB Metric -\> Delta between today and yesterday](https://discuss.elastic.co/t/kibana-tsvb-metric-delta-between-today-and-yesterday/274064)
**Author:** [@Lucas\_Erlacher](https://discuss.elastic.co/u/Lucas_Erlacher)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 3:39pm UTC](https://discuss.elastic.co/t/kibana-tsvb-metric-delta-between-today-and-yesterday/274064 "2021-06-07T15:39:55Z")
Hello Community, I have the following metric showing today's & yesterday's avg. session duration. Is there a way to show the delta between the 2 metrics? Thanks a lot for your help. --- ## [\[filebeat azure module\] storage account permissions](https://discuss.elastic.co/t/filebeat-azure-module-storage-account-permissions/275172)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 3:37pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-storage-account-permissions/275172 "2021-06-07T15:37:25Z")
Hi everybody, the storage\_account used in the Azure module of Filebeat what permissions does require? Thanks Daniele --- ## [Vega Maps Zoom](https://discuss.elastic.co/t/vega-maps-zoom/275111)
**Author:** [@gerardo\_dutan](https://discuss.elastic.co/u/gerardo_dutan)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 2:47pm UTC](https://discuss.elastic.co/t/vega-maps-zoom/275111 "2021-06-07T14:47:04Z")
I'm currently using vega maps to look at geo data and noticed that the zoom level for a vega map based visualization seems to lower than what is theoretically possible from the local map tile server that I'm using, curre… --- ## [Time\_zone parameter](https://discuss.elastic.co/t/time-zone-parameter/275161)
**Author:** [@qwerty123](https://discuss.elastic.co/u/qwerty123)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 2:41pm UTC](https://discuss.elastic.co/t/time-zone-parameter/275161 "2021-06-07T14:41:34Z")
hi !! does elasticsearch range query always work based on UTC time zone ?? if so, is it possible to change this and make it work according to user required time zone ?? even when i use time\_zone parameter in my query, t… --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/275072)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 14\ **Last updated:** [June 7, 2021, 2:28pm UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/275072 "2021-06-07T14:28:09Z")
My ELK stack version is 7.9.2 My aim is to enable authentication in Kibana login page but I'm not able to do that. I'm alays directed to the dashboard directly and it never asks for username and password ELK servers ar… --- ## [Value does not exist](https://discuss.elastic.co/t/value-does-not-exist/274833)
**Author:** [@kehers](https://discuss.elastic.co/u/kehers)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 2:04pm UTC](https://discuss.elastic.co/t/value-does-not-exist/274833 "2021-06-07T14:04:05Z")
I am familiar with checking if a field exists using the exists query. I am wondering if there is a way to check if a value does not exist instead; something like this: GET /\_search { "query": { "bool": { "m… --- ## [Data Path per-Index Basis](https://discuss.elastic.co/t/data-path-per-index-basis/275157)
**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 2:00pm UTC](https://discuss.elastic.co/t/data-path-per-index-basis/275157 "2021-06-07T14:00:57Z")
Hi Elastic Community, I'm running a three node cluster. I've defined the directory for storing indices with data.path in elasticsearch.yml. Is it possible to change the storing directory for a specific index? Personall… --- ## [EQL cidrmatch issue](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 1:46pm UTC](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885 "2021-06-07T13:46:28Z")
hello guys, I created an eql rule for ssh access I wanna match multiple IP ranges but I get this error that the destination.ip field is text and not IP can you please suggest me another way to do that. here's my query { … --- ## [Retrieve transactions from APM using NEST](https://discuss.elastic.co/t/retrieve-transactions-from-apm-using-nest/274924)
**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\ **Replies:** 4\ **Last updated:** [June 7, 2021, 1:38pm UTC](https://discuss.elastic.co/t/retrieve-transactions-from-apm-using-nest/274924 "2021-06-07T13:38:33Z")
I have an asp.net core web app application that will write logs using serilog to elasticsearch and also can read the logs from elasticsearch using NEST. I also have it set up where I can use APM for my application. If I … --- ## [Display aggregated counter value per interval](https://discuss.elastic.co/t/display-aggregated-counter-value-per-interval/272333)
**Author:** [@snicoll](https://discuss.elastic.co/u/snicoll)\ **Replies:** 8\ **Last updated:** [June 7, 2021, 1:34pm UTC](https://discuss.elastic.co/t/display-aggregated-counter-value-per-interval/272333 "2021-06-07T13:34:33Z")
I have two counters for open and closes issues, something like this: timpestamp: epoch\_mill1, total: 2000, open: 200, closed: 1800 timpestamp: epoch\_mill2, total: 2200, open: 250, closed: 1950 timpestamp: epoch\_mill3, t… --- ## ["Latest" transform new feature - does it reduce load compared to a scripted metric?](https://discuss.elastic.co/t/latest-transform-new-feature-does-it-reduce-load-compared-to-a-scripted-metric/274888)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 1:20pm UTC](https://discuss.elastic.co/t/latest-transform-new-feature-does-it-reduce-load-compared-to-a-scripted-metric/274888 "2021-06-07T13:20:28Z")
I have been making use of scripted metrics to find the latest document inside a traditional transform. The new "Latest" document transform offering works to work really well and is dead simple to use! Question - would … --- ## [Selecting a dashboard links to a blank screen](https://discuss.elastic.co/t/selecting-a-dashboard-links-to-a-blank-screen/275151)
**Author:** [@aerodynamic](https://discuss.elastic.co/u/aerodynamic)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 12:55pm UTC](https://discuss.elastic.co/t/selecting-a-dashboard-links-to-a-blank-screen/275151 "2021-06-07T12:55:11Z")
Hello, Selecting a dashboard in Kibana leads to a blank screen. Any ideas on what could be causing this? --- ## [Network bandwidth from firewall logs in timelion](https://discuss.elastic.co/t/network-bandwidth-from-firewall-logs-in-timelion/274637)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 12:54pm UTC](https://discuss.elastic.co/t/network-bandwidth-from-firewall-logs-in-timelion/274637 "2021-06-07T12:54:52Z")
I configured timelion to graph network usage (in Mbps) for all HTTPS traffic. The timelion expression is : .es(q="observer.ingress.interface.name:Untrust-4 and destination.port:443",index="fw-\*",timefield="@timestamp",m… --- ## [Logstash/grok to match only first occurrence and stop parsing repeatedly for same values](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201)
**Author:** [@theirfan](https://discuss.elastic.co/u/theirfan)\ **Replies:** 23\ **Last updated:** [June 7, 2021, 12:10pm UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201 "2021-06-07T12:10:28Z")
Hi all, I have this issue with logstash/grok. Stated Working with ELK some days back. A newbie, please help. I have a log (sample below) Timestamp temperature 20 Timestamp temperature 20 Timestamp temperature 21 N… --- ## [Batch request failed with status 0 meaning](https://discuss.elastic.co/t/batch-request-failed-with-status-0-meaning/272321)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 11:40am UTC](https://discuss.elastic.co/t/batch-request-failed-with-status-0-meaning/272321 "2021-06-07T11:40:43Z")
I'm getting this error on my visuals and I can't find information anywhere about what it may mean. Can anyone tell me? [Previous page](https://discuss.elastic.co/latest.md?page=1636) [Next page](https://discuss.elastic.co/latest.md?page=1638)