# Latest **URL:** https://discuss.elastic.co/latest.md?page=1673 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1674 --- ## [7.12.1 threshold rule, group by field within actions](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 5\ **Last updated:** [May 18, 2021, 2:43pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209 "2021-05-18T14:43:09Z")
Hi, With 7.12.1 i can see our group by field appearing in the detection event, in this case it is host.name. I have tried pushing through within the actions but it is still empty. I am trying to access this data in se… --- ## [Elastic-Agent send logs but Status Offline](https://discuss.elastic.co/t/elastic-agent-send-logs-but-status-offline/273168)
**Author:** [@Halim\_Bourtala](https://discuss.elastic.co/u/Halim_Bourtala)\ **Replies:** 0\ **Last updated:** [May 17, 2021, 11:36am UTC](https://discuss.elastic.co/t/elastic-agent-send-logs-but-status-offline/273168 "2021-05-17T11:36:38Z")
Hello Elastic team, I am testing elastic agent and we are facing an issue/bug not documented in fleet troubleshooting article, this is why I would like to learn how to Troubleshoot elastic-agent communication with Fleet… --- ## [Sorting a percentile aggregation](https://discuss.elastic.co/t/sorting-a-percentile-aggregation/273298)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:58pm UTC](https://discuss.elastic.co/t/sorting-a-percentile-aggregation/273298 "2021-05-18T13:58:33Z")
Is it possible to sort a percentile aggregation? The query is: "size": 0, "query": { "bool": { "must": \[ { "range": { "dttm": { "gte": "now-24h", "… --- ## [Elasticsearch won't start with Ansible service module](https://discuss.elastic.co/t/elasticsearch-wont-start-with-ansible-service-module/273297)
**Author:** [@Ferencz](https://discuss.elastic.co/u/Ferencz)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:51pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-with-ansible-service-module/273297 "2021-05-18T13:51:48Z")
Hi all, I'm using Ansible to install Elasticsearch and when I want to start the Elasticsearch with service module it won't start but when I execute "service elasticsearch start" manually it is working normally. Ansible… --- ## [Having problem getting syslog to show on Elasticsearch](https://discuss.elastic.co/t/having-problem-getting-syslog-to-show-on-elasticsearch/273179)
**Author:** [@Praewpun](https://discuss.elastic.co/u/Praewpun)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 1:41pm UTC](https://discuss.elastic.co/t/having-problem-getting-syslog-to-show-on-elasticsearch/273179 "2021-05-18T13:41:24Z")
Hi, I'm having problems trying to get syslog sent by external sources to logstash, then to elasticsearch (Kibana). I think the problem is that I don't understand what should the host and port should be specified. Here … --- ## [Unassigned\_shards":1](https://discuss.elastic.co/t/unassigned-shards-1/273083)
**Author:** [@jeyasingh\_t](https://discuss.elastic.co/u/jeyasingh_t)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 1:40pm UTC](https://discuss.elastic.co/t/unassigned-shards-1/273083 "2021-05-18T13:40:01Z")
Hi, We use 6.8.1 with 3 cluster and got into this situation due to one of the hosts ran out of storage. I used the below command to address the read-only index. curl -X PUT 'http://xxxxxxxxxxxxx:9200/\_all/\_settings -H … --- ## [Applying global Time filter within a visualization to other dates](https://discuss.elastic.co/t/applying-global-time-filter-within-a-visualization-to-other-dates/273248)
**Author:** [@Thomas\_Pierrot](https://discuss.elastic.co/u/Thomas_Pierrot)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 1:30pm UTC](https://discuss.elastic.co/t/applying-global-time-filter-within-a-visualization-to-other-dates/273248 "2021-05-18T13:30:53Z")
Hi, I'm creating a visualization and I need to filter some dates using the same time range selected in the time picker and I simply don't know how to do so. Basically, I'm creating a visualization based on an index th… --- ## [Grok hhtp](https://discuss.elastic.co/t/grok-hhtp/273292)
**Author:** [@delacoche28](https://discuss.elastic.co/u/delacoche28)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:28pm UTC](https://discuss.elastic.co/t/grok-hhtp/273292 "2021-05-18T13:28:06Z")
hello with this log line: HTTP/1.0" 200 285 "-" "-" 30.853 I want to have a word to have paterns like : protocole : HTPP HTTP\_VERSION: 1.0 THX --- ## [Bad Top values on Data table](https://discuss.elastic.co/t/bad-top-values-on-data-table/273276)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 12:28pm UTC](https://discuss.elastic.co/t/bad-top-values-on-data-table/273276 "2021-05-18T12:28:37Z")
Hello, I'm on Kibana V7.12.0 I have inconsistent values on data table : Like you see, I have lot of Other value... But, I can understant why (the limits of 100 values). But you can see "RepMgr.exe" is on second posi… --- ## [Watcher alerts null pointer error](https://discuss.elastic.co/t/watcher-alerts-null-pointer-error/273268)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 11:17am UTC](https://discuss.elastic.co/t/watcher-alerts-null-pointer-error/273268 "2021-05-18T11:17:55Z")
Hey, I'm trying to get Kibana Watcher alerts to insert documents to new index. When simulating the script I'm getting the following error: The error seems to be with the aggregations field - null pointer. But I did… --- ## [EQL - Network Port scan - Watcher to EQL](https://discuss.elastic.co/t/eql-network-port-scan-watcher-to-eql/273104)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 11:52am UTC](https://discuss.elastic.co/t/eql-network-port-scan-watcher-to-eql/273104 "2021-05-18T11:52:01Z")
Please help me to convert the below port scan watcher query to EQL in ELK SIEM 7.12.1. PUT \_watcher/watch/port\_scan\_watch { "trigger": { "schedule": { "interval": "10s" } }, "input": { "search": { "request": { … --- ## [Local install with ansible role](https://discuss.elastic.co/t/local-install-with-ansible-role/273274)
**Author:** [@uysalnet\_io](https://discuss.elastic.co/u/uysalnet_io)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 11:47am UTC](https://discuss.elastic.co/t/local-install-with-ansible-role/273274 "2021-05-18T11:47:06Z")
Hi, I am using official ansible role to deploy cluster but I didn't understand if this role supports local installation of elasticsearch packages. By default this role using official elasticsearch repos to download pack… --- ## [Error xpack monitoring elasticsearch password hasn't been registered and elastalert-kibana-plugin.serverHost and serverPort" settings were not applied](https://discuss.elastic.co/t/error-xpack-monitoring-elasticsearch-password-hasnt-been-registered-and-elastalert-kibana-plugin-serverhost-and-serverport-settings-were-not-applied/273214)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 11:38am UTC](https://discuss.elastic.co/t/error-xpack-monitoring-elasticsearch-password-hasnt-been-registered-and-elastalert-kibana-plugin-serverhost-and-serverport-settings-were-not-applied/273214 "2021-05-18T11:38:59Z")
Hi All, I have all the yaml file and config file with me but i want to deploy through docker stack like docker stack deploy -c docker-compose.yaml test After deploy only elasticsearch container is working and logstash… --- ## [Detect Horizontal Port Scan](https://discuss.elastic.co/t/detect-horizontal-port-scan/272710)
**Author:** [@pmorenosi](https://discuss.elastic.co/u/pmorenosi)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 11:23am UTC](https://discuss.elastic.co/t/detect-horizontal-port-scan/272710 "2021-05-18T11:23:09Z")
Hello everyone, From the logs that I have stored in Elasticsearch from a Firewall, I need to detect a type of attack called "Horizontal Port Scan" that is defined as follows: Unique source IP address that has "N" differ… --- ## [Elastic Cloud Enterprise 2.9.2 released](https://discuss.elastic.co/t/elastic-cloud-enterprise-2-9-2-released/273271)
**Author:** [@AranK](https://discuss.elastic.co/u/AranK)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 11:22am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-2-9-2-released/273271 "2021-05-18T11:22:55Z")
We are pleased to announce that ECE 2.9.2 has been released today. This is a bugfix release. Release notes: Elastic Cloud Enterprise 2.9.2 | Elastic Cloud Enterprise Reference \[2.9\] | Elastic --- ## [Logstash Syslog input plugin | @timestamp issue](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 11:04am UTC](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244 "2021-05-18T11:04:13Z")
Hi, I faced a brick wall and I seem to not be able to overcome it. My scenario FW logs coming to a server where they are caught by Syslog-ng Syslog-ng passes the logs to Logstash on the same server Currently, as a test… --- ## [Elastic search duplicate document with same Id and different routing](https://discuss.elastic.co/t/elastic-search-duplicate-document-with-same-id-and-different-routing/273242)
**Author:** [@Mohanapriya\_Gopal1](https://discuss.elastic.co/u/Mohanapriya_Gopal1)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/elastic-search-duplicate-document-with-same-id-and-different-routing/273242 "2021-05-18T10:39:55Z")
While indexing using logstash from db to elastic, we got duplicate documents with same Id and different routing.how canwe fix this --- ## [Kibana Watcher action failed: specified foreach object was null](https://discuss.elastic.co/t/kibana-watcher-action-failed-specified-foreach-object-was-null/272817)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/kibana-watcher-action-failed-specified-foreach-object-was-null/272817 "2021-05-18T10:35:27Z")
I'm using ELK 7.9. I have configured Watchers to trigger Webhook action. I'm trying to add a foreach function to trigger webhooks for each recorded application errors. I'm getting error when trying to execute. Watcher … --- ## [Influence of Master Nodes and Large Cluster State on Search](https://discuss.elastic.co/t/influence-of-master-nodes-and-large-cluster-state-on-search/273103)
**Author:** [@itays](https://discuss.elastic.co/u/itays)\ **Replies:** 7\ **Last updated:** [May 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/influence-of-master-nodes-and-large-cluster-state-on-search/273103 "2021-05-18T10:35:06Z")
Hey, We are running in production an elasticsearch cluster. The setup is: 10 data nodes - 8 cpus and 64G ram, half is heap 3 master nodes - 4 cpus and 16g ram, half is heap In our cluster we have large number of indi… --- ## [Invalid NEST response built from a successful (200) low level call on PUT](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-successful-200-low-level-call-on-put/273266)
**Author:** [@niaz](https://discuss.elastic.co/u/niaz)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 10:13am UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-successful-200-low-level-call-on-put/273266 "2021-05-18T10:13:49Z")
I am running with elasticsearch 7.12.1 on Ubuntu 20.04.2 LTS. Only elasticsearch is running on port 9200. Kibana is also installed on the same VM, port 5601 but its service is currently stopped. I am using NEST to conn… --- ## [Want to create an index already present in index management using API](https://discuss.elastic.co/t/want-to-create-an-index-already-present-in-index-management-using-api/273212)
**Author:** [@Changra](https://discuss.elastic.co/u/Changra)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 10:03am UTC](https://discuss.elastic.co/t/want-to-create-an-index-already-present-in-index-management-using-api/273212 "2021-05-18T10:03:11Z")
Hi Team, I am trying to create index which is already present in the index management using API . But I am unable to execute any API . Please Help me with it. --- ## [Elastic Agent removes all metricbeat unix-sock endpoint when any metricbeat is killed](https://discuss.elastic.co/t/elastic-agent-removes-all-metricbeat-unix-sock-endpoint-when-any-metricbeat-is-killed/271581)
**Author:** [@buptubuntu](https://discuss.elastic.co/u/buptubuntu)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 9:58am UTC](https://discuss.elastic.co/t/elastic-agent-removes-all-metricbeat-unix-sock-endpoint-when-any-metricbeat-is-killed/271581 "2021-05-18T09:58:16Z")
Hi, all We try to use elastic agent to manage beats, and configured agent.monitoring to use a sidecar metricbeat to monitor the managed beats，after all the beats are started，if we kill the sidecar metricbeat process，the… --- ## [Split data into into two sets (test/train)](https://discuss.elastic.co/t/split-data-into-into-two-sets-test-train/273236)
**Author:** [@eliase](https://discuss.elastic.co/u/eliase)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 9:01am UTC](https://discuss.elastic.co/t/split-data-into-into-two-sets-test-train/273236 "2021-05-18T09:01:49Z")
Hi, for machine learning validation I would like to split the data in elastic search into two sets. The random score in combination with the size parameter would give me one set but how can I obtain all other documents… --- ## [Geo\_point automatically](https://discuss.elastic.co/t/geo-point-automatically/273183)
**Author:** [@Emi\_lie](https://discuss.elastic.co/u/Emi_lie)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 8:40am UTC](https://discuss.elastic.co/t/geo-point-automatically/273183 "2021-05-18T08:40:00Z")
Hello, I struggle to add the geo\_point to my index, automatically. All the solutions I found, official and unofficial, indicate that it is necessary to pass by the devTools to make a PUT of the index. But I use elastic… --- ## [UDP packets cover 50% of packetbeat logs](https://discuss.elastic.co/t/udp-packets-cover-50-of-packetbeat-logs/272689)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 7\ **Last updated:** [May 18, 2021, 8:34am UTC](https://discuss.elastic.co/t/udp-packets-cover-50-of-packetbeat-logs/272689 "2021-05-18T08:34:24Z")
Hi, I can see that 50% of my packetbeat logs are from network.transport: udp . In terms of SIEM perspective do I need this types of logs in kibana? (I don't use any VOIP or streaming services on my monitored machine.) … --- ## [Missing Textfield, when creating a Visulization with Lens](https://discuss.elastic.co/t/missing-textfield-when-creating-a-visulization-with-lens/273124)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 8:17am UTC](https://discuss.elastic.co/t/missing-textfield-when-creating-a-visulization-with-lens/273124 "2021-05-18T08:17:51Z")
Hello and good morning, since the last update to 7.12.1, Lens replaced the "normal" Visulizations. I have an index (oracle alert logs) which has an message field as text, but it is missing the keyword. Even creating a n… --- ## [Failed to parse date field](https://discuss.elastic.co/t/failed-to-parse-date-field/272657)
**Author:** [@KarlWolf](https://discuss.elastic.co/u/KarlWolf)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 6:09am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/272657 "2021-05-18T06:09:10Z")
Hello, I'm new in topic ELK stuff and I try to solve my problem with date parsing. I have two fields with date and time stamp which I connected together. Then I want mark that pool as Date and send to Elastic: My Log l… --- ## [Can we connect one Logstash node with Both Licensed & Open source elastic stack?](https://discuss.elastic.co/t/can-we-connect-one-logstash-node-with-both-licensed-open-source-elastic-stack/273162)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 2:51am UTC](https://discuss.elastic.co/t/can-we-connect-one-logstash-node-with-both-licensed-open-source-elastic-stack/273162 "2021-05-18T02:51:51Z")
Hi All, I would like to understand, If we can connect one Logstash node with Both Licensed & Open source elasticsearch nodes at a time ? currently we are using licensed elasticsearch for centralized pipelined managemen… --- ## [Updating OS packages when using ansible role](https://discuss.elastic.co/t/updating-os-packages-when-using-ansible-role/273213)
**Author:** [@biggtimber](https://discuss.elastic.co/u/biggtimber)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 1:53am UTC](https://discuss.elastic.co/t/updating-os-packages-when-using-ansible-role/273213 "2021-05-18T01:53:09Z")
How is it recommended to run OS updates on the ES nodes that are maintained by the ansible role. Should the ES and Java packages be version locked, and will that effect upgrading the nodes later? --- ## [Error retrieving logs when using Defender ATP (under Microsoft Module)](https://discuss.elastic.co/t/error-retrieving-logs-when-using-defender-atp-under-microsoft-module/273225)
**Author:** [@ismyhairnice](https://discuss.elastic.co/u/ismyhairnice)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:06am UTC](https://discuss.elastic.co/t/error-retrieving-logs-when-using-defender-atp-under-microsoft-module/273225 "2021-05-18T01:06:16Z")
Hi all I am trying to retrieve some Defender ATP logs from Azure using Microsoft Module and encountered error. Current Filebeat version is 7.12. 2021-05-10T13:01:17.495+0800 ERROR \[input.httpjson-cursor\] v2/reques… [Previous page](https://discuss.elastic.co/latest.md?page=1672) [Next page](https://discuss.elastic.co/latest.md?page=1674)