# Latest **URL:** https://discuss.elastic.co/latest.md?page=1648 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1649 --- ## [Remove drive letter from file path GROK pattern](https://discuss.elastic.co/t/remove-drive-letter-from-file-path-grok-pattern/274609)
**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 9:57am UTC](https://discuss.elastic.co/t/remove-drive-letter-from-file-path-grok-pattern/274609 "2021-06-01T09:57:00Z")
Im trying to remove the drive letter from file paths as they are ingested through the pipeline, my input is something like C:\\folder1\\folder2\\file.ext (This is just an example the file could be many more folders deep) … --- ## [Create a customized transaction for any function or code](https://discuss.elastic.co/t/create-a-customized-transaction-for-any-function-or-code/274520)
**Author:** [@karim-pai](https://discuss.elastic.co/u/karim-pai)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 9:36am UTC](https://discuss.elastic.co/t/create-a-customized-transaction-for-any-function-or-code/274520 "2021-06-01T09:36:12Z")
Hi, Is it possible to create/trigger a transaction for any given part of the code (apart from http or gRPC request). I know it is possible in python custom code instrumentation E.g. I want to instrument this function … --- ## [Identify event fom JDBC input](https://discuss.elastic.co/t/identify-event-fom-jdbc-input/274607)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 9:36am UTC](https://discuss.elastic.co/t/identify-event-fom-jdbc-input/274607 "2021-06-01T09:36:08Z")
Hi, I'm currently having issues to identify my JDBC input from my beat input and all others. I'm quite new to using jdbc as input in logstash. I actually have a workflow where data from my beats go through a bunch of f… --- ## [Change value of @timestamp](https://discuss.elastic.co/t/change-value-of-timestamp/274343)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 9:33am UTC](https://discuss.elastic.co/t/change-value-of-timestamp/274343 "2021-06-01T09:33:29Z")
Hello! How can I remplace the value of @timestamp with the value that I get with a regular expresion? I need change the value of @timestamp because when the data is indexed in elasticsearch it shows in this field the v… --- ## [Vega Visualization with nested Hashes](https://discuss.elastic.co/t/vega-visualization-with-nested-hashes/274604)
**Author:** [@etot94](https://discuss.elastic.co/u/etot94)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 9:28am UTC](https://discuss.elastic.co/t/vega-visualization-with-nested-hashes/274604 "2021-06-01T09:28:46Z")
Hello ES Team. :slight\_smile: I would like to visualize my data from ES with Vega-lite. My fields are: data\_field which is an array of nested hashes. data\_number which is just a number representing each of the data\_f… --- ## [Creating a pipeline which runs with particular interval on same index](https://discuss.elastic.co/t/creating-a-pipeline-which-runs-with-particular-interval-on-same-index/274584)
**Author:** [@aswanth\_jabba](https://discuss.elastic.co/u/aswanth_jabba)\ **Replies:** 6\ **Last updated:** [June 1, 2021, 9:22am UTC](https://discuss.elastic.co/t/creating-a-pipeline-which-runs-with-particular-interval-on-same-index/274584 "2021-06-01T09:22:45Z")
Can anyone please tell me, if this is possible ? I am trying to create a pipeline but I want it to run in particular intervals on the same index For example : { "description":"Find the Progress", "processors":\[ … --- ## [Count query is returning inaccurate results](https://discuss.elastic.co/t/count-query-is-returning-inaccurate-results/274436)
**Author:** [@kapso](https://discuss.elastic.co/u/kapso)\ **Replies:** 13\ **Last updated:** [June 1, 2021, 9:12am UTC](https://discuss.elastic.co/t/count-query-is-returning-inaccurate-results/274436 "2021-06-01T09:12:47Z")
Count query (filter term) is returning inaccurate results - \*/\_count We have tried to get the count using a regular search query using this approach - "size":0,"track\_total\_hits":true and the count is still inaccurate. … --- ## [Setting for alerts in elk](https://discuss.elastic.co/t/setting-for-alerts-in-elk/274489)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 9:06am UTC](https://discuss.elastic.co/t/setting-for-alerts-in-elk/274489 "2021-06-01T09:06:31Z")
How to setup kibana and elasticsearch for alerts , involving the certificates and ca? --- ## [Kibana result machine learning job contain negative values](https://discuss.elastic.co/t/kibana-result-machine-learning-job-contain-negative-values/274525)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 8:52am UTC](https://discuss.elastic.co/t/kibana-result-machine-learning-job-contain-negative-values/274525 "2021-06-01T08:52:06Z")
Hi, I have a question about the results obtained when I run my machine learning job, when I check the anomalies I find that in typical values there are negative values but in my index I don't have negative values. Why … --- ## [Filter and return only specific fields using elasticsearch plugin with logstash](https://discuss.elastic.co/t/filter-and-return-only-specific-fields-using-elasticsearch-plugin-with-logstash/274599)
**Author:** [@Nico3](https://discuss.elastic.co/u/Nico3)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 8:51am UTC](https://discuss.elastic.co/t/filter-and-return-only-specific-fields-using-elasticsearch-plugin-with-logstash/274599 "2021-06-01T08:51:14Z")
Hello, I'm trying to create a pipeline with logstash in order to "extract" a specific metric from Elasticsearch (window\_cpu\_time\_total). Here is my pipeline: input { elasticsearch { hosts =\> \["http://localhos… --- ## [Index.sort on sequence numbers](https://discuss.elastic.co/t/index-sort-on-sequence-numbers/274485)
**Author:** [@fhalde](https://discuss.elastic.co/u/fhalde)\ **Replies:** 7\ **Last updated:** [June 1, 2021, 8:42am UTC](https://discuss.elastic.co/t/index-sort-on-sequence-numbers/274485 "2021-06-01T08:42:21Z")
We have a use case that can greatly benefit from the ability to have an index.sort on \_seq\_no meta field of ES but that's not possible it seems As of now, that's not possible curl -XPUT -H "Content-Type:application/jso… --- ## [ILM action - lifecycle action \[migrate\] waiting for \[1\] shards to be moved to the \[data\_cold\] tier](https://discuss.elastic.co/t/ilm-action-lifecycle-action-migrate-waiting-for-1-shards-to-be-moved-to-the-data-cold-tier/274574)
**Author:** [@Kmalik19](https://discuss.elastic.co/u/Kmalik19)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 8:40am UTC](https://discuss.elastic.co/t/ilm-action-lifecycle-action-migrate-waiting-for-1-shards-to-be-moved-to-the-data-cold-tier/274574 "2021-06-01T08:40:44Z")
Hello Everyone, We have configured ILM policy but it's stucked in warm phase.Here is the details: ILM Policy definition { "km\_ilm" : { "version" : 3, "modified\_date" : "2021-05-31T14:28:26.359Z", "policy… --- ## [Multiple fast consecutive updates on the same document](https://discuss.elastic.co/t/multiple-fast-consecutive-updates-on-the-same-document/274595)
**Author:** [@Niels\_Theen](https://discuss.elastic.co/u/Niels_Theen)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 8:26am UTC](https://discuss.elastic.co/t/multiple-fast-consecutive-updates-on-the-same-document/274595 "2021-06-01T08:26:37Z")
Hi there, I hope someone can help me with a very specific problem I have. We integrated Elasticsearch in our multi-tenant-system. Based on our system we forced to use update\_by\_query instead of update. This system cr… --- ## [Es\_rejected\_execution\_exception](https://discuss.elastic.co/t/es-rejected-execution-exception/274594)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 8:13am UTC](https://discuss.elastic.co/t/es-rejected-execution-exception/274594 "2021-06-01T08:13:47Z")
All of a sudden, our cluster has started to receive a huge of amount of "es\_rejected\_execution\_exception" errors when upserting. Nothing has really changed on our code side so we are at a complete loss. Our main API is n… --- ## [Logstash stores field as multifield](https://discuss.elastic.co/t/logstash-stores-field-as-multifield/274331)
**Author:** [@nberens](https://discuss.elastic.co/u/nberens)\ **Replies:** 2\ **Last updated:** [May 30, 2021, 2:26am UTC](https://discuss.elastic.co/t/logstash-stores-field-as-multifield/274331 "2021-05-30T02:26:04Z")
Hello, i am currently migrating from an old elatic 6.8 cluster to a new 7.13. The Logstash pipeline is the same: input { kafka { bootstrap\_servers =\> '{{ logstash\_kafka\_bootstrap }}' … --- ## [Kibana is not ready in 7.12](https://discuss.elastic.co/t/kibana-is-not-ready-in-7-12/274545)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 7:34am UTC](https://discuss.elastic.co/t/kibana-is-not-ready-in-7-12/274545 "2021-06-01T07:34:24Z")
I obtain this error can someone help me? kibana | {"type":"log","@timestamp":"2021-05-31T19:22:13+00:00","tags":\["info","savedobjects-service"\],"pid":7,"message":"Waiting until all Elasticsearch nodes a… --- ## [Getting Invalid FieldReference error because of non-indexed property name in document](https://discuss.elastic.co/t/getting-invalid-fieldreference-error-because-of-non-indexed-property-name-in-document/274205)
**Author:** [@rs0000](https://discuss.elastic.co/u/rs0000)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 7:33am UTC](https://discuss.elastic.co/t/getting-invalid-fieldreference-error-because-of-non-indexed-property-name-in-document/274205 "2021-06-01T07:33:18Z")
Hi, My Logstash pipeline keeps failing during scroll because of an error. There are multiple documents causing that issue. Those are referral urls that sometimes look weird. The property itself is not indexed in elastic… --- ## [Essql join on canvas essql](https://discuss.elastic.co/t/essql-join-on-canvas-essql/274496)
**Author:** [@lucac](https://discuss.elastic.co/u/lucac)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 7:29am UTC](https://discuss.elastic.co/t/essql-join-on-canvas-essql/274496 "2021-06-01T07:29:30Z")
Hi, is it possible to write an essql query with join inside? I have a field in one index and I would to compare that to another field in another index and extract some value. I need this value in canvas. How can I do… --- ## [Disable logstash logger for inputs.jdbc](https://discuss.elastic.co/t/disable-logstash-logger-for-inputs-jdbc/274526)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 7:15am UTC](https://discuss.elastic.co/t/disable-logstash-logger-for-inputs-jdbc/274526 "2021-06-01T07:15:08Z")
Hi all, I am using Logstash 7.12.1 to update an elasticsearch 7.12.1 index from an oracle database. I have no problem establishing communication with the DB using the below input jdbc declaration: input { jdbc { … --- ## [Rolling Upgrade not supported for kibana](https://discuss.elastic.co/t/rolling-upgrade-not-supported-for-kibana/274588)
**Author:** [@Sachin\_kovuru](https://discuss.elastic.co/u/Sachin_kovuru)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 7:11am UTC](https://discuss.elastic.co/t/rolling-upgrade-not-supported-for-kibana/274588 "2021-06-01T07:11:38Z")
I see that kibana doesn't support rolling upgrades as per the below link. Since the rolling upgrade is one of the basic upgrading strategies of Kubernetes. So, is there any plans of supporting rolling upgrade in future… --- ## [Dynamically append field from an index to same field in other indices](https://discuss.elastic.co/t/dynamically-append-field-from-an-index-to-same-field-in-other-indices/274579)
**Author:** [@CoolCommando\_Sniper](https://discuss.elastic.co/u/CoolCommando_Sniper)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:51am UTC](https://discuss.elastic.co/t/dynamically-append-field-from-an-index-to-same-field-in-other-indices/274579 "2021-06-01T05:51:10Z")
Hi, I would like to achieve the following: Lets say there are 3 indices A, B & C, each having a document with \_id '1'. I would like to append value of a field in A to the same field in indices B & C, where document \_i… --- ## [Sum aggregated values](https://discuss.elastic.co/t/sum-aggregated-values/274554)
**Author:** [@qvers](https://discuss.elastic.co/u/qvers)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 6:41am UTC](https://discuss.elastic.co/t/sum-aggregated-values/274554 "2021-06-01T06:41:44Z")
Hello. I'm trying to collect some statistics data from my docs, but I'm struggling a bit. My docs looks like this: { "productId": "156" "price": "101.23" "discount": "2.23" "marketplace": "some\_marketplace" "… --- ## [How to get whole results when searching with OAuth Service?](https://discuss.elastic.co/t/how-to-get-whole-results-when-searching-with-oauth-service/273228)
**Author:** [@chen.lu](https://discuss.elastic.co/u/chen.lu)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 6:21am UTC](https://discuss.elastic.co/t/how-to-get-whole-results-when-searching-with-oauth-service/273228 "2021-06-01T06:21:50Z")
Hello, I am using OAuth Service to get search results from workplace search. But when I got the results from workplace search, I can see only top 10 results. How can I get the whole results from workplcace search? --- ## [How I can run jdbc\_streaming filter just one time on multiple jdbc plugin row results](https://discuss.elastic.co/t/how-i-can-run-jdbc-streaming-filter-just-one-time-on-multiple-jdbc-plugin-row-results/274477)
**Author:** [@zeraf29](https://discuss.elastic.co/u/zeraf29)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 6:17am UTC](https://discuss.elastic.co/t/how-i-can-run-jdbc-streaming-filter-just-one-time-on-multiple-jdbc-plugin-row-results/274477 "2021-06-01T06:17:27Z")
Hi. I want to run jdbc\_streaming filter plugin just one time on multiple jdbc plugin row results. For example, I set jdbc input plugin in pipeline, and It return 10 table rows. input{ Jdbc{ #jdbc settings … --- ## [Best Practices / Recommendations for Custom Objects](https://discuss.elastic.co/t/best-practices-recommendations-for-custom-objects/274081)
**Author:** [@Jeff\_Stevens](https://discuss.elastic.co/u/Jeff_Stevens)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 6:16am UTC](https://discuss.elastic.co/t/best-practices-recommendations-for-custom-objects/274081 "2021-06-01T06:16:24Z")
We are evaluating ECS as a common transport schema for our events, logging, and messaging needs. Tags are not enough as we want to have sharable serialized compound objects. We initially started with the .NET NLog mapp… --- ## [Metricbeat for SSH/Secure log](https://discuss.elastic.co/t/metricbeat-for-ssh-secure-log/274581)
**Author:** [@bs\_aggarwal](https://discuss.elastic.co/u/bs_aggarwal)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 6:06am UTC](https://discuss.elastic.co/t/metricbeat-for-ssh-secure-log/274581 "2021-06-01T06:06:55Z")
How to import SSH failed attempts reported in /var/log/secure log using metric beat. or alternatively i want to ssh login attempts using metric beat. pls advise. --- ## [Convert the @timestamp field](https://discuss.elastic.co/t/convert-the-timestamp-field/273902)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 6\ **Last updated:** [June 1, 2021, 5:26am UTC](https://discuss.elastic.co/t/convert-the-timestamp-field/273902 "2021-06-01T05:26:18Z")
Hello All , I am trying to convert the @timestamp field to the required format. @timestamp shows the field as : 2021-05-25T07:34:08.137Z and I want the value to be converted in to this format : 05/25/2021 07:34:08 . I … --- ## [Is there any way to do batch inference(matrix compute) using cosineSimilarity?](https://discuss.elastic.co/t/is-there-any-way-to-do-batch-inference-matrix-compute-using-cosinesimilarity/274573)
**Author:** [@berry](https://discuss.elastic.co/u/berry)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:17am UTC](https://discuss.elastic.co/t/is-there-any-way-to-do-batch-inference-matrix-compute-using-cosinesimilarity/274573 "2021-06-01T05:17:29Z")
In some scenarios, I want to calculate the cosine similarity between M dense\_vectors and all the stored dense\_vectors. This can be achieved by calling the cosineSimilarity function for M times like this: "script": { … --- ## [Elasticsearch 2021 License](https://discuss.elastic.co/t/elasticsearch-2021-license/274133)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 6\ **Last updated:** [June 1, 2021, 5:13am UTC](https://discuss.elastic.co/t/elasticsearch-2021-license/274133 "2021-06-01T05:13:20Z")
Hi. I am asking a question because the elasticsearch license changed in 2021 is not well understood. I have the phrase below, People who take our products and sell them directly as services, like Amazon Elasticsearch … --- ## [Cannot add S3 snapshot repository to ECE](https://discuss.elastic.co/t/cannot-add-s3-snapshot-repository-to-ece/274552)
**Author:** [@dia](https://discuss.elastic.co/u/dia)\ **Replies:** 0\ **Last updated:** [May 31, 2021, 11:22pm UTC](https://discuss.elastic.co/t/cannot-add-s3-snapshot-repository-to-ece/274552 "2021-05-31T23:22:24Z")
hi I cannot add S3 minio bucket as a snapshot repository to ECE. ECE version 2.7.1 all ECE hosts can access minio bucket with rw permission First I tried to add the bucket using API of a test deployment but… [Previous page](https://discuss.elastic.co/latest.md?page=1647) [Next page](https://discuss.elastic.co/latest.md?page=1649)