# Latest **URL:** https://discuss.elastic.co/latest.md?page=1691 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1692 --- ## [Can't access Detections from a different space](https://discuss.elastic.co/t/cant-access-detections-from-a-different-space/272118)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 9\ **Last updated:** [May 6, 2021, 8:55pm UTC](https://discuss.elastic.co/t/cant-access-detections-from-a-different-space/272118 "2021-05-06T20:55:49Z")
Hi, \*Running ELK 7.11.2 Standalone I am trying to setup a user to have access to Security in a separate space. I have been following all directions from the official documentation, but the user can't access the "Detect… --- ## [Unable to index a file (Word document) greater than 45 MB](https://discuss.elastic.co/t/unable-to-index-a-file-word-document-greater-than-45-mb/272220)
**Author:** [@saqib619](https://discuss.elastic.co/u/saqib619)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 6:59pm UTC](https://discuss.elastic.co/t/unable-to-index-a-file-word-document-greater-than-45-mb/272220 "2021-05-06T18:59:21Z")
We are trying to index a file (word document) which is \> 45 MB . It is failing throwing an exception as below: Maximum timeout reached while retrying request. Call: Status code unknown from: PUT /test\_index6/\_doc/16601?… --- ## [Index template order fields seems not to work](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 6\ **Last updated:** [May 6, 2021, 6:07pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778 "2021-05-06T18:07:33Z")
Hello, I have few templates each for every index name based on the module name for ilm management. I notice that after the update to 7.12.1 all my indices have applied templates with order value 10 event though there a… --- ## [ECK Operator 1.4 stuck in deployment - Error: no matches for kind "EnterpriseSearch" in version "enterpriseseach.k8s.elastic.co/v1"](https://discuss.elastic.co/t/eck-operator-1-4-stuck-in-deployment-error-no-matches-for-kind-enterprisesearch-in-version-enterpriseseach-k8s-elastic-co-v1/271818)
**Author:** [@Jorge\_Alvarado](https://discuss.elastic.co/u/Jorge_Alvarado)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 5:34pm UTC](https://discuss.elastic.co/t/eck-operator-1-4-stuck-in-deployment-error-no-matches-for-kind-enterprisesearch-in-version-enterpriseseach-k8s-elastic-co-v1/271818 "2021-05-06T17:34:51Z")
Hi, I am trying to deploy eck operator 1.4 but it gets stuck. Using eck operator 1.3.2 deployment works as expected. Also, I've using latest version of elasticsearch 7.12.0 and kibana version 7.12.0. I have attached the… --- ## [No Data for Metricbeat AWS billing estimated charges](https://discuss.elastic.co/t/no-data-for-metricbeat-aws-billing-estimated-charges/272132)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 4:05pm UTC](https://discuss.elastic.co/t/no-data-for-metricbeat-aws-billing-estimated-charges/272132 "2021-05-06T16:05:00Z")
Dear Team, We have configured Metricbeat with AWS module for AWS billing metrics PFB configuration - module: aws period: 24h metricsets: - billing role\_arn: xxxxxxxxxxxxxxxx cost\_explorer\_config: group\_… --- ## [Heartbeat issue when matching on response body string negatively](https://discuss.elastic.co/t/heartbeat-issue-when-matching-on-response-body-string-negatively/270542)
**Author:** [@Nipun1](https://discuss.elastic.co/u/Nipun1)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 3:26pm UTC](https://discuss.elastic.co/t/heartbeat-issue-when-matching-on-response-body-string-negatively/270542 "2021-05-06T15:26:16Z")
Hi all, I am setting up a heartbeat monitor (version 7.5.0) for an API whose response can be of the following types #response is okay, API can be considered up { "usersList": \[ { "firstName": "L… --- ## [Parsing nested json not happening properly](https://discuss.elastic.co/t/parsing-nested-json-not-happening-properly/272282)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 3:20pm UTC](https://discuss.elastic.co/t/parsing-nested-json-not-happening-properly/272282 "2021-05-06T15:20:51Z")
Hi Folks, I am trying to parse modsecurity audit logs which are natively being logged in JSON format. However when I am using logstash to ingest in elastic stack those appears like below and actual needed fields are not… --- ## [How to remove original message field after parsing using json filter](https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306)
**Author:** [@Sandeep4](https://discuss.elastic.co/u/Sandeep4)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 2:51pm UTC](https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306 "2021-05-06T14:51:50Z")
First try:- filter { mutate { gsub =\> \[ "message", "^\\w+\`string\`", "" \] } json { source =\> "message" remove\_field =\> "message" } } Second try:- filter { mutate { gsub =\> \[ "message", "^\\w+\`string\`",… --- ## [Is it possible to replicate the index WITHOUT yellow status? (replication disabled due to faster reindex)](https://discuss.elastic.co/t/is-it-possible-to-replicate-the-index-without-yellow-status-replication-disabled-due-to-faster-reindex/272308)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 2:42pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replicate-the-index-without-yellow-status-replication-disabled-due-to-faster-reindex/272308 "2021-05-06T14:42:15Z")
Hi there, due to speedup of re-indexing, I'm setting "number\_of\_replicas": 0 while re-indexing is running. Once finished, than I'm setting 1 replica: PUT bmpf\_claim\_docs\_v2/\_settings { "number\_of\_replicas": 1 } U… --- ## [Text Embedding in Elastic Search](https://discuss.elastic.co/t/text-embedding-in-elastic-search/272242)
**Author:** [@harry\_richard](https://discuss.elastic.co/u/harry_richard)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 2:42pm UTC](https://discuss.elastic.co/t/text-embedding-in-elastic-search/272242 "2021-05-06T14:42:36Z")
Hi All, I have implemented text embedding using doc 2 vec and stored the vectors in elastic search , using cosine similarity I am trying to search for similar texts. But the issue is whenver I am giving a same text twi… --- ## [ECS in avro format](https://discuss.elastic.co/t/ecs-in-avro-format/272170)
**Author:** [@birko](https://discuss.elastic.co/u/birko)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 2:22pm UTC](https://discuss.elastic.co/t/ecs-in-avro-format/272170 "2021-05-06T14:22:47Z")
I'm looking for avro schema representation of ecs. It is necessary in Apache NiFi, when you're trying to transform data with record-oriented processors. Workaround is to use InferAvroSchema processor, but there is necess… --- ## [Filebeat dissect line break](https://discuss.elastic.co/t/filebeat-dissect-line-break/272274)
**Author:** [@mostpha456](https://discuss.elastic.co/u/mostpha456)\ **Replies:** 6\ **Last updated:** [May 6, 2021, 2:06pm UTC](https://discuss.elastic.co/t/filebeat-dissect-line-break/272274 "2021-05-06T14:06:11Z")
Hello, i am using dissect processor to parse a multiline log. i got the error dissect\_parsing\_error, i think it s because of the \\n. Do you have any idea where i can find any exemple of filebeat dissect for multiline. … --- ## [Cannot read property 'get' of undefined](https://discuss.elastic.co/t/cannot-read-property-get-of-undefined/272199)
**Author:** [@Aqib\_Rehman](https://discuss.elastic.co/u/Aqib_Rehman)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 1:47pm UTC](https://discuss.elastic.co/t/cannot-read-property-get-of-undefined/272199 "2021-05-06T13:47:12Z")
Hi, I'm using Suricata to collect logs on Kibana, after connecting Suricata with Elastic via filebeat, Kibana cannot visualize logs with following error: Cannot read property 'get' of undefined. It receives data but cann… --- ## [Metricbeat in Kubernetes only get processes from the container and not the host (Windows)](https://discuss.elastic.co/t/metricbeat-in-kubernetes-only-get-processes-from-the-container-and-not-the-host-windows/272128)
**Author:** [@jproulx](https://discuss.elastic.co/u/jproulx)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 1:22pm UTC](https://discuss.elastic.co/t/metricbeat-in-kubernetes-only-get-processes-from-the-container-and-not-the-host-windows/272128 "2021-05-06T13:22:14Z")
Context I am trying to setup metricbeat 7.12 as a DaemonSet in an Azure Kubernetes Cluster on a Nano Windows Server host. I based my Kubernetes config of metricbeat on this document. In this document, the ConfigMap nam… --- ## [Turn on SIEM in Kibana 7.10.2](https://discuss.elastic.co/t/turn-on-siem-in-kibana-7-10-2/271346)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 1:15pm UTC](https://discuss.elastic.co/t/turn-on-siem-in-kibana-7-10-2/271346 "2021-05-06T13:15:25Z")
I was able to turn off / on SIEM in kibana 7.8.1 under spaces however this seems to be gone in 7.10.2 How can i enable SIEM in Kibana 7.10.2 ? 7.8.1 7.10.2 --- ## [JSON filter swallowing events with no errors](https://discuss.elastic.co/t/json-filter-swallowing-events-with-no-errors/272221)
**Author:** [@brian\_m](https://discuss.elastic.co/u/brian_m)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 1:14pm UTC](https://discuss.elastic.co/t/json-filter-swallowing-events-with-no-errors/272221 "2021-05-06T13:14:45Z")
Hello, I'm trying to do some testing on ingesting JSON data, and having trouble with the JSON filter. My pipeline configuration is below (output filter has been modified to remove credentials and IPs) input { http {}… --- ## [Error: fail to communicate with updated API client hosts](https://discuss.elastic.co/t/error-fail-to-communicate-with-updated-api-client-hosts/270268)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 1:02pm UTC](https://discuss.elastic.co/t/error-fail-to-communicate-with-updated-api-client-hosts/270268 "2021-05-06T13:02:04Z")
Hi there, I have installed the ElasticAgent on Ubuntu 18.04 LTS via the suggested commandline: sudo ./elastic-agent install -f --kibana-url=https://10.0.0.75:5601 --enrollment-token=cTZFSzFuZ0JrSlg2TXhjV1o0M1E6bUdzNVhF… --- ## [Variable content from file](https://discuss.elastic.co/t/variable-content-from-file/272296)
**Author:** [@emilsvil](https://discuss.elastic.co/u/emilsvil)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 12:50pm UTC](https://discuss.elastic.co/t/variable-content-from-file/272296 "2021-05-06T12:50:46Z")
Hi. Im using cidr filter to check if an IP si public or private. The list of cidrs to check is now hardcoded in the filter but I need to read it from a file or using a meta-variable loaded at runtime. cidr { … --- ## [Getting single line from multiline](https://discuss.elastic.co/t/getting-single-line-from-multiline/272292)
**Author:** [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 12:35pm UTC](https://discuss.elastic.co/t/getting-single-line-from-multiline/272292 "2021-05-06T12:35:32Z")
hi , my message is like below Error type : VALIDATION:INVALID\_NUMBER FlowStack : at db-error-logFlow(db-error-logFlow/processors/0 @ db-error-log:db-error-log.xml:18 i want just single line " E… --- ## [Configure Open ID connect using Azure AD roles](https://discuss.elastic.co/t/configure-open-id-connect-using-azure-ad-roles/272137)
**Author:** [@nityaraj06](https://discuss.elastic.co/u/nityaraj06)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 12:17pm UTC](https://discuss.elastic.co/t/configure-open-id-connect-using-azure-ad-roles/272137 "2021-05-06T12:17:19Z")
Hi, Is it possible to map the azure roles in kibana role mapping since my organisation does not allow azure groups to be enabled in the token response. The only possible fields seem to be username, groups, realm and dn.… --- ## [Last record for each unique value](https://discuss.elastic.co/t/last-record-for-each-unique-value/271077)
**Author:** [@JeremyLoyd](https://discuss.elastic.co/u/JeremyLoyd)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 11:11am UTC](https://discuss.elastic.co/t/last-record-for-each-unique-value/271077 "2021-05-06T11:11:15Z")
Hello, Our company changed to Elastic few months ago. before then we used to log a lot of things to one simple SQL table. in SQL i was able to find for each unique identifier last value that was recorded with simple Que… --- ## [Pie chart with percentage](https://discuss.elastic.co/t/pie-chart-with-percentage/272168)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 11:08am UTC](https://discuss.elastic.co/t/pie-chart-with-percentage/272168 "2021-05-06T11:08:31Z")
Hi, I've written this query: SELECT idMaxNet,COUNT(tagId) as num FROM "itt\_data\_bridgenuzoo" WHERE date \>= CURRENT\_DATE - INTERVAL '7' DAY AND idMaxNet!=0 AND (idMaxNet=128 OR idMaxNet=129 OR idMaxNet=130 OR idMaxNet=1… --- ## [Java plugin - Irrelevant JARs are loaded and cause conflicts](https://discuss.elastic.co/t/java-plugin-irrelevant-jars-are-loaded-and-cause-conflicts/272276)
**Author:** [@MosheElisha](https://discuss.elastic.co/u/MosheElisha)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 10:20am UTC](https://discuss.elastic.co/t/java-plugin-irrelevant-jars-are-loaded-and-cause-conflicts/272276 "2021-05-06T10:20:55Z")
Hi, I am creating a Java input plugin that uses 'software.amazon.awssdk:s3:2.16.26' and libraries from manticore-0.7.0-java are loaded into my plugin and cause conflicts. After successful installation, when I try to us… --- ## [Colouring text result from query](https://discuss.elastic.co/t/colouring-text-result-from-query/272149)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 11:05am UTC](https://discuss.elastic.co/t/colouring-text-result-from-query/272149 "2021-05-06T11:05:00Z")
Hi, I'm trying to color text that is result from a query: filters | essql query="SELECT date + interval '2' hour as dateNew, DATEDIFF('minute',date, CURRENT\_TIMESTAMP()) as diff FROM device\_data\_eggy ORDER BY date D… --- ## [No alive nodes found in your cluster](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/272216)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 10:49am UTC](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/272216 "2021-05-06T10:49:32Z")
I'm on Ubuntu 20.04 with Elasticsearch 7.10.2 (though this has happened in previous minor versions too) We have a PHP script that runs every night using 7.12.0 of the PHP SDK where it re-indexes live documents and delet… --- ## [Are nested docs efficiently skipped?](https://discuss.elastic.co/t/are-nested-docs-efficiently-skipped/271847)
**Author:** [@egalpin](https://discuss.elastic.co/u/egalpin)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 10:44am UTC](https://discuss.elastic.co/t/are-nested-docs-efficiently-skipped/271847 "2021-05-06T10:44:35Z")
Hi all, I’m curious if anyone is able to comment on the handling of nested documents at query time. Are nested documents skipped over in the advance or nextDoc step, or must they also be considered if, for example, nest… --- ## [Control visualization](https://discuss.elastic.co/t/control-visualization/272158)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 9\ **Last updated:** [May 6, 2021, 10:37am UTC](https://discuss.elastic.co/t/control-visualization/272158 "2021-05-06T10:37:59Z")
Dear all, it is possible to use Control visualization to filter on group of parameters? Suppose that there are: Test ServerTest-1 ServerTest-2 Prod ServerProd-1 ServerProd-2 It is possible to have Control … --- ## [Kibana refuse connection on docker-compose config](https://discuss.elastic.co/t/kibana-refuse-connection-on-docker-compose-config/272272)
**Author:** [@danyxs](https://discuss.elastic.co/u/danyxs)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 10:03am UTC](https://discuss.elastic.co/t/kibana-refuse-connection-on-docker-compose-config/272272 "2021-05-06T10:03:33Z")
Hi, I have a problem with the following docker-compose.yaml file. I used a default file, but when i want to run the containers the kibana refuse connection. I attached the docker-compose config version: '3' services:… --- ## [Spark scala "saveToEs" got the wrong ip](https://discuss.elastic.co/t/spark-scala-savetoes-got-the-wrong-ip/272269)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 9:40am UTC](https://discuss.elastic.co/t/spark-scala-savetoes-got-the-wrong-ip/272269 "2021-05-06T09:40:40Z")
Hi, I am trying spark and elasticsearch. setting: windows 10 pro spark version: 2.4.0 scala version: 2.11.12 ELK version: 7.10 start like so: .\\spark-shell --jars C:\\spark\\jars\\elasticsearch-spark-20\_2.11-7.10.0… --- ## [Data stream index Rollover exception "..names need to be unique.."](https://discuss.elastic.co/t/data-stream-index-rollover-exception-names-need-to-be-unique/272239)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 9:38am UTC](https://discuss.elastic.co/t/data-stream-index-rollover-exception-names-need-to-be-unique/272239 "2021-05-06T09:38:57Z")
Hi, We have an index .ds-logs-network.azure-default-000001 that is returning: illegal\_state\_exception: index, alias, and data stream names need to be unique, but the following duplicates were found \[logs-network.azure-… [Previous page](https://discuss.elastic.co/latest.md?page=1690) [Next page](https://discuss.elastic.co/latest.md?page=1692)