# Latest **URL:** https://discuss.elastic.co/latest.md?page=1686 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1687 --- ## [Configuring analyser for field inside filbeat configuration file](https://discuss.elastic.co/t/configuring-analyser-for-field-inside-filbeat-configuration-file/270232)
**Author:** [@bbtl](https://discuss.elastic.co/u/bbtl)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 4:44pm UTC](https://discuss.elastic.co/t/configuring-analyser-for-field-inside-filbeat-configuration-file/270232 "2021-05-10T16:44:13Z")
Hi I am currently using filbeat to send logs to ELK stack. However, one of the fields has a syslog structure and I would like to force filbeat to use a whitespace analyser and I would also like to have the .raw version … --- ## [Why sometime 99.99th doesn't shown](https://discuss.elastic.co/t/why-sometime-99-99th-doesnt-shown/272467)
**Author:** [@GITnewfish](https://discuss.elastic.co/u/GITnewfish)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 4:32pm UTC](https://discuss.elastic.co/t/why-sometime-99-99th-doesnt-shown/272467 "2021-05-10T16:32:05Z")
I do found sometime 99.99th doesn't shown in my summary, and sometime it shows ok. In the doc, it said "Rally will not show a 99.99th percentile if it could only capture five samples because that would be a vanity metri… --- ## [Logstash no processing all my logs from Filebeat](https://discuss.elastic.co/t/logstash-no-processing-all-my-logs-from-filebeat/272593)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 4:05pm UTC](https://discuss.elastic.co/t/logstash-no-processing-all-my-logs-from-filebeat/272593 "2021-05-10T16:05:20Z")
I have Filebeat transporting my logs to logstash and then to ES. The behaviour I have noticed is that some of my logs are processed and available in Kibana by not all. I see all the logs in the logstash debug log with … --- ## [False-positive](https://discuss.elastic.co/t/false-positive/272598)
**Author:** [@em3rals](https://discuss.elastic.co/u/em3rals)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 3:53pm UTC](https://discuss.elastic.co/t/false-positive/272598 "2021-05-10T15:53:30Z")
Hello, how is everything ? My name is Emerson, I work in the IT infrastructure sector at GAtec Gestão agroindustrial, I would like to report a FALSE POSITIVE in relation to an executable of our company. False positive wa… --- ## [Static lookup empty field value not showing in Kibana](https://discuss.elastic.co/t/static-lookup-empty-field-value-not-showing-in-kibana/272428)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 3:16pm UTC](https://discuss.elastic.co/t/static-lookup-empty-field-value-not-showing-in-kibana/272428 "2021-05-10T15:16:06Z")
Hi all, I'm using Currency field with option of Static lookup to change values . But I'm not able to change values for empty field values. Below screenshot. Empty fields are not showing unknown. Still they are emp… --- ## [APM architecture and usage](https://discuss.elastic.co/t/apm-architecture-and-usage/272591)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 2:51pm UTC](https://discuss.elastic.co/t/apm-architecture-and-usage/272591 "2021-05-10T14:51:16Z")
Hi there, I wonder how apm's works, AFAIK it's client-server architecture. The question is: a) what is the recomendation for APM server (cpu,memory,storage) b) can i install APM server for example with elastic -node … --- ## [Missing outgoing HTTP Span GO Lang](https://discuss.elastic.co/t/missing-outgoing-http-span-go-lang/272452)
**Author:** [@ianmcgraw](https://discuss.elastic.co/u/ianmcgraw)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 2:48pm UTC](https://discuss.elastic.co/t/missing-outgoing-http-span-go-lang/272452 "2021-05-10T14:48:21Z")
Kibana version: v 7.9.2 (elastic cloud) Elasticsearch version: v 7.9.2 (elastic cloud) APM Server version: v 7.9.2 (elastic cloud) APM Agent language and version: Golang go.elastic.co/apm/module/apmgorilla v1.1… --- ## [Using ElasticAPM distributed tracing to monitor mysql from PHP library calls](https://discuss.elastic.co/t/using-elasticapm-distributed-tracing-to-monitor-mysql-from-php-library-calls/272557)
**Author:** [@Mark\_Paget](https://discuss.elastic.co/u/Mark_Paget)\ **Replies:** 0\ **Last updated:** [May 10, 2021, 9:13am UTC](https://discuss.elastic.co/t/using-elasticapm-distributed-tracing-to-monitor-mysql-from-php-library-calls/272557 "2021-05-10T09:13:41Z")
Kibana version: 7.12.1 Elasticsearch version: 7.12.1 APM Server version: 7.12.1 APM Agent language and version:PHP 1.0.1 Browser version: Chrome Version 90.0.4430.93 (Official Build) (x86\_64) Original install method… --- ## [Okta Module drops a lot of debugContext information from events](https://discuss.elastic.co/t/okta-module-drops-a-lot-of-debugcontext-information-from-events/272588)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 2:18pm UTC](https://discuss.elastic.co/t/okta-module-drops-a-lot-of-debugcontext-information-from-events/272588 "2021-05-10T14:18:41Z")
I recently noticed that the Okta module (mainly the Elastic pipeline) drops a good amount of data from the debugData field when moving it from json.debugContext to okta.debug\_context, and was wondering if this is intende… --- ## [Upgrade Agents Offline](https://discuss.elastic.co/t/upgrade-agents-offline/272585)
**Author:** [@scottdfedorov](https://discuss.elastic.co/u/scottdfedorov)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 2:05pm UTC](https://discuss.elastic.co/t/upgrade-agents-offline/272585 "2021-05-10T14:05:44Z")
The docs are clear that Fleet: Requires internet access for Kibana to download integration packages and No proxy support in Elastic Agent However, it appears that each Agent also requires internet access in order… --- ## [Kibana increasing memory usage](https://discuss.elastic.co/t/kibana-increasing-memory-usage/272171)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 2:03pm UTC](https://discuss.elastic.co/t/kibana-increasing-memory-usage/272171 "2021-05-10T14:03:05Z")
Hi, after upgrading to 7.12.0 a strange problem started occuring. Kibana keeps consuming more and more RAM until it goes to swap and then I have to restart kibana service because the performance goes wildly off. We have… --- ## [API key and document-level security: Query not limiting response](https://discuss.elastic.co/t/api-key-and-document-level-security-query-not-limiting-response/271786)
**Author:** [@sgasse](https://discuss.elastic.co/u/sgasse)\ **Replies:** 5\ **Last updated:** [May 10, 2021, 1:54pm UTC](https://discuss.elastic.co/t/api-key-and-document-level-security-query-not-limiting-response/271786 "2021-05-10T13:54:25Z")
Hi! I was reading up a bit on API keys and document level security. Here are the relevant guides that I read: Create an API key Document Level Secuity Now I created an API key like this: POST /\_security/api\_key { … --- ## [Actual Exam Lab environment](https://discuss.elastic.co/t/actual-exam-lab-environment/272236)
**Author:** [@suselena22](https://discuss.elastic.co/u/suselena22)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 1:45pm UTC](https://discuss.elastic.co/t/actual-exam-lab-environment/272236 "2021-05-10T13:45:36Z")
Hi there: I was using 21'inc monitor but I still find the lab screen was pretty small, is that possible to make the lab's screen bigger as big as my 21'inc monitor? Please advise, thanks. --- ## [Grok works in debugger but not in Logstash](https://discuss.elastic.co/t/grok-works-in-debugger-but-not-in-logstash/272509)
**Author:** [@therealjack404](https://discuss.elastic.co/u/therealjack404)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 1:41pm UTC](https://discuss.elastic.co/t/grok-works-in-debugger-but-not-in-logstash/272509 "2021-05-10T13:41:39Z")
Hi. I am struggling to write a grok pattern for Modsecurity Logs from the apache error log. I have included a sample log and the grok pattern. I isolated the timestamp creation which works on its own. However the rest wo… --- ## [Index not rollover when the date changes](https://discuss.elastic.co/t/index-not-rollover-when-the-date-changes/272385)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 1:37pm UTC](https://discuss.elastic.co/t/index-not-rollover-when-the-date-changes/272385 "2021-05-10T13:37:33Z")
Hi Team With ILM policy, we can do rollover using different parameters such as size/document\_count/age. This works fine and if we create first index with date-math, we are able to generate date-wise index. But the prob… --- ## [Kibana Sorting out Array values](https://discuss.elastic.co/t/kibana-sorting-out-array-values/272266)
**Author:** [@kanikasingla](https://discuss.elastic.co/u/kanikasingla)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 1:35pm UTC](https://discuss.elastic.co/t/kibana-sorting-out-array-values/272266 "2021-05-10T13:35:13Z")
Hi Team, I am working with Elastic FunctionBeat to send logs from AWS CloudWatch Logs. I am able to create data tables, graphs etc. There is one issue when I am trying to show field which is nested array (nestedResults… --- ## [Dashboard or Canvas with a drop down for filters for a data table](https://discuss.elastic.co/t/dashboard-or-canvas-with-a-drop-down-for-filters-for-a-data-table/272310)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 1:32pm UTC](https://discuss.elastic.co/t/dashboard-or-canvas-with-a-drop-down-for-filters-for-a-data-table/272310 "2021-05-10T13:32:43Z")
I have some network utilization data that I need to filter by all hours, prime business hours, non business hours. The filters are not straight forward as I'm dealing with local times across time zones. The prime filter … --- ## [Error calling pipeline when setting the document ID in beats](https://discuss.elastic.co/t/error-calling-pipeline-when-setting-the-document-id-in-beats/272560)
**Author:** [@Francisco\_Peralta\_Gu](https://discuss.elastic.co/u/Francisco_Peralta_Gu)\ **Replies:** 6\ **Last updated:** [May 10, 2021, 1:30pm UTC](https://discuss.elastic.co/t/error-calling-pipeline-when-setting-the-document-id-in-beats/272560 "2021-05-10T13:30:29Z")
Hi. I'm facing issues when I try to set the document id in filebeat to avoid duplicates: I have a filebeat configuration as following: filebeat.inputs: - type: log paths: - /dumps-json/wsdumps/\*\* … --- ## [ILM phases rolling out index but keeping](https://discuss.elastic.co/t/ilm-phases-rolling-out-index-but-keeping/272291)
**Author:** [@narendraingale2](https://discuss.elastic.co/u/narendraingale2)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 1:27pm UTC](https://discuss.elastic.co/t/ilm-phases-rolling-out-index-but-keeping/272291 "2021-05-10T13:27:21Z")
Hi All Below is my ILM policy { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_size": "200gb", "max\_age": "7d" … --- ## [Elastic shards and replica](https://discuss.elastic.co/t/elastic-shards-and-replica/272552)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [May 10, 2021, 1:21pm UTC](https://discuss.elastic.co/t/elastic-shards-and-replica/272552 "2021-05-10T13:21:43Z")
Hello everyone, I would like to understand something about shards and replica, I have a cluster of 3 DATA nodes (2 Hot and 1 Warm), I have configured ILM to have one shard and one replica in the HOT nodes, and then onc… --- ## [Self hosted in aws ec2](https://discuss.elastic.co/t/self-hosted-in-aws-ec2/272483)
**Author:** [@THOM-AwS](https://discuss.elastic.co/u/THOM-AwS)\ **Replies:** 5\ **Last updated:** [May 10, 2021, 1:13pm UTC](https://discuss.elastic.co/t/self-hosted-in-aws-ec2/272483 "2021-05-10T13:13:27Z")
Hey all, this is part question, and part tips for my elastic experience on ec2. for background I am running two servers, one with elasticsearch on an m6gd.large, and the other server runs kibana on an m6gd.medium. this i… --- ## [Webcrawler and googleoff:all tags](https://discuss.elastic.co/t/webcrawler-and-googleoff-all-tags/272572)
**Author:** [@TimTim](https://discuss.elastic.co/u/TimTim)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 12:23pm UTC](https://discuss.elastic.co/t/webcrawler-and-googleoff-all-tags/272572 "2021-05-10T12:23:32Z")
Hi! I'm crawling our site and it seems to be working fine. But the issue I see is that the content contains text that is outside the !--googleon: all-- tag. The way we have our code is like this: \