# Latest **URL:** https://discuss.elastic.co/latest.md?page=1694 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1695 --- ## [Mutate Convert not working as I expect](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 9:29am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133 "2021-05-05T09:29:15Z")
RHEL8.3, ELK 7.12.1, I am using convert as documented, but I just can't see what I've done wrong. Here's the filter, per the docs filter { if \[pbs\_accounting\] { csv { separator =\> ";" columns =\> \["da… --- ## [Default dashboard without field](https://discuss.elastic.co/t/default-dashboard-without-field/272083)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 9:16am UTC](https://discuss.elastic.co/t/default-dashboard-without-field/272083 "2021-05-05T09:16:40Z")
Dear all, I'm collect data from Nginx, apache, linux SO, using metribeat, the data arrive in to the index and I use standard dashboard to graph the data, I'm changing the source data, as example changing the index and f… --- ## [Pipeline to pipeline communication](https://discuss.elastic.co/t/pipeline-to-pipeline-communication/272140)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 9:12am UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-communication/272140 "2021-05-05T09:12:21Z")
I have a requirement. Events will be listening on some TCP ports in Logstash. using a filter plugin I will extract the username field from the event. After that, I have to query another API server providing that username… --- ## [Does Filebeat take in logs missed when it is stopped?](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130)
**Author:** [@shifenglim](https://discuss.elastic.co/u/shifenglim)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 7:58am UTC](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130 "2021-05-05T07:58:01Z")
I have filebeat 7.8.1 streaming logs to my elasticsearch via this setup Application -\> Logfile -\> Filebeat -\> Logstash -\> Elasticsearch The application team is concerned if Filebeat is down, it will cause logs to be mi… --- ## [Remove a key that starts with 0 to 9](https://discuss.elastic.co/t/remove-a-key-that-starts-with-0-to-9/272142)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 7:49am UTC](https://discuss.elastic.co/t/remove-a-key-that-starts-with-0-to-9/272142 "2021-05-05T07:49:54Z")
Hello team, I need to Remove a field that starts with an integer. I am using logstash & kv filter to parse this logs. Can you please help me. PFB sample log line: 2021-01-07 05:32:31,761 Method=get call SoapAction="Ri… --- ## [Slow ingestion speeds](https://discuss.elastic.co/t/slow-ingestion-speeds/271761)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 7\ **Last updated:** [May 5, 2021, 7:48am UTC](https://discuss.elastic.co/t/slow-ingestion-speeds/271761 "2021-05-05T07:48:47Z")
Good Morning all, I have noticed that i appear to be having some ingestion speed issues... in a nut shell, if i look at historical data from a couple of hours ago and keep refreshing my screen, the amount of records inc… --- ## [Unable to authenticate user for REST request](https://discuss.elastic.co/t/unable-to-authenticate-user-for-rest-request/272116)
**Author:** [@Egid](https://discuss.elastic.co/u/Egid)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 7:30am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-for-rest-request/272116 "2021-05-05T07:30:47Z")
Hi I am running the folowing comand: docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -e "ELASTICSEARCH\_USERNAME=egid" -e "ELASTICSEARCH\_PASSWORD=black" -e "xpack.security.enabled=true" docker.elast… --- ## [Directly accessing data from multiline log data](https://discuss.elastic.co/t/directly-accessing-data-from-multiline-log-data/272135)
**Author:** [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 5:50am UTC](https://discuss.elastic.co/t/directly-accessing-data-from-multiline-log-data/272135 "2021-05-05T05:50:52Z")
Hi Below is my sample plain text input to http input , is there any way in filter to directly jump to " Trace: " and then directly jump to "Error type" and retrieve value the part denoted by "XXX" is dynamic it will … --- ## [Unable to create api key](https://discuss.elastic.co/t/unable-to-create-api-key/271603)
**Author:** [@samueliako](https://discuss.elastic.co/u/samueliako)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 5:47am UTC](https://discuss.elastic.co/t/unable-to-create-api-key/271603 "2021-05-05T05:47:24Z")
Hi all, I have problem with generating api key using this command "#sudo -u apm-server apm-server apikey create --name user1-key". I'm receiving this error: {"error":{"root\_cause":\[{"type":"feature\_not\_enabled\_exceptio… --- ## [Logstash filter for muliple values not working](https://discuss.elastic.co/t/logstash-filter-for-muliple-values-not-working/272087)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 5:04am UTC](https://discuss.elastic.co/t/logstash-filter-for-muliple-values-not-working/272087 "2021-05-05T05:04:01Z")
Hi All, I am trying to remove message for few service tags, but I am facing below issue. Below is not working if \[SERVICE\] in \["GET", "UPDATE"\] { mutate { remove\_field =\> \["message"\] } } Below is working if "GET"… --- ## [SIEM with Basic License On-Prem?](https://discuss.elastic.co/t/siem-with-basic-license-on-prem/272109)
**Author:** [@R99Stny](https://discuss.elastic.co/u/R99Stny)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 12:56am UTC](https://discuss.elastic.co/t/siem-with-basic-license-on-prem/272109 "2021-05-05T00:56:27Z")
We have a 3 node cluster on prem 7.6. Couple questions: Based on the docs we should be able to see and use pre-built detections with only a basic license? We do need (required to) have tls/ssl set up within the cluster… --- ## [Filebeat and Winlogbeat](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 6\ **Last updated:** [May 4, 2021, 11:48pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780 "2021-05-04T23:48:41Z")
I am enrolling my Windows servers in Fleet on ELK 7.12. I can see lots of 'logs-\* via discover relating to these servers. Do I need to manually install winlogbeat and or filebeat in addition to what I already have. My c… --- ## [Rule exception in SIEM Kibana 7.12](https://discuss.elastic.co/t/rule-exception-in-siem-kibana-7-12/272072)
**Author:** [@dsgamr](https://discuss.elastic.co/u/dsgamr)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 11:38pm UTC](https://discuss.elastic.co/t/rule-exception-in-siem-kibana-7-12/272072 "2021-05-04T23:38:22Z")
Hi, One of build in rules - Whoami Process Activity - generates a lot of false positives in my environment so I tried to add exception to the rule. Problem is that to do it properly one has to use wildcards which doesn… --- ## [ES 7.11.2 / Kibana error : index has lifecycle error](https://discuss.elastic.co/t/es-7-11-2-kibana-error-index-has-lifecycle-error/272098)
**Author:** [@webfr](https://discuss.elastic.co/u/webfr)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 10:46pm UTC](https://discuss.elastic.co/t/es-7-11-2-kibana-error-index-has-lifecycle-error/272098 "2021-05-04T22:46:44Z")
Hello guys, could you help me please fixing this issue? Index lifecycle error illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index \[myindex\] is empty or not defined index setting: { "in… --- ## [Two nodes cluster questions](https://discuss.elastic.co/t/two-nodes-cluster-questions/272115)
**Author:** [@nuzolx](https://discuss.elastic.co/u/nuzolx)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 9:06pm UTC](https://discuss.elastic.co/t/two-nodes-cluster-questions/272115 "2021-05-04T21:06:48Z")
Hi, I have a two nodes cluster in production. I know this not good but, right now, I cant afford a 3th node. I have read: Resilience in small clusters | Elasticsearch Guide \[7.12\] | Elastic For example node1 is maste… --- ## [Elastic Endopint fails deployment v7.12.1](https://discuss.elastic.co/t/elastic-endopint-fails-deployment-v7-12-1/271838)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 8:33pm UTC](https://discuss.elastic.co/t/elastic-endopint-fails-deployment-v7-12-1/271838 "2021-05-04T20:33:30Z")
Hi, Notes: ELK v7.12.1 Standalone OS Win 10 Pro, v20H2, build 19042.928 I recently upgraded to ELK v7.12.1 and have been testing it. Today I tried to update existing agents in Fleet to the most recent version. So far… --- ## [Kibana Visualization with different database](https://discuss.elastic.co/t/kibana-visualization-with-different-database/272107)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 8:31pm UTC](https://discuss.elastic.co/t/kibana-visualization-with-different-database/272107 "2021-05-04T20:31:08Z")
Hi all, We basically use Elasticsearch as database for Kibana. Should we always import data to Elasticsearch? Is there any way in which Kibana can directly read data from a database such as MongoDB and able to visuali… --- ## [What is role of .apm index in kibana?](https://discuss.elastic.co/t/what-is-role-of-apm-index-in-kibana/272106)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 8:29pm UTC](https://discuss.elastic.co/t/what-is-role-of-apm-index-in-kibana/272106 "2021-05-04T20:29:39Z")
Hi, I see .apm index in my kibana indices list. What is .apm and what is its role? --- ## [Classes descontinuadas](https://discuss.elastic.co/t/classes-descontinuadas/272113)
**Author:** [@Jair\_Gomes](https://discuss.elastic.co/u/Jair_Gomes)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 8:29pm UTC](https://discuss.elastic.co/t/classes-descontinuadas/272113 "2021-05-04T20:29:28Z")
Eu estou atualizando um antigo código de um modelo de ranqueamento que utiliza as antigas classes (Acredito que sejam classes das versões 2.X ou 5.X): import org.elasticsearch.action.fieldstats.FieldStats; import org.el… --- ## [Usar pacote elasticsearch no código java](https://discuss.elastic.co/t/usar-pacote-elasticsearch-no-codigo-java/271149)
**Author:** [@Jair\_Gomes](https://discuss.elastic.co/u/Jair_Gomes)\ **Replies:** 4\ **Last updated:** [May 4, 2021, 8:23pm UTC](https://discuss.elastic.co/t/usar-pacote-elasticsearch-no-codigo-java/271149 "2021-05-04T20:23:44Z")
Eu estou tentando reproduzir um código em java (uma linguagem que não sou muito familiar) que utiliza o elastic search, eu acredito que sei como compilar e executar o código usando o jvm que vem com o elastic search. Mas… --- ## [Getting NaN in our data and its killing our C# code, but returns in Kibana?](https://discuss.elastic.co/t/getting-nan-in-our-data-and-its-killing-our-c-code-but-returns-in-kibana/272112)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 8:10pm UTC](https://discuss.elastic.co/t/getting-nan-in-our-data-and-its-killing-our-c-code-but-returns-in-kibana/272112 "2021-05-04T20:10:26Z")
Good Day, Maybe you can help me with this. We have data being indexed into our system and appartantly there are times when there are sections of data that are not just there and may not be populated at certain times of… --- ## [Parsing Palo Alto System Logs with Date Filter](https://discuss.elastic.co/t/parsing-palo-alto-system-logs-with-date-filter/271836)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 7\ **Last updated:** [May 4, 2021, 7:23pm UTC](https://discuss.elastic.co/t/parsing-palo-alto-system-logs-with-date-filter/271836 "2021-05-04T19:23:24Z")
I am trying to parse the Palo Alto System logs with logstash using the following dissect pattern inside a logstash filter: dissect { mapping =\> { "message" =\> '%{?date} %{?date} %{?date} %{?network} - %{?version},%{@… --- ## [Kibana 7.12 Login failure "Fleet"](https://discuss.elastic.co/t/kibana-7-12-login-failure-fleet/271285)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 7:07pm UTC](https://discuss.elastic.co/t/kibana-7-12-login-failure-fleet/271285 "2021-05-04T19:07:35Z")
Upgrading to 7.12 has been one nightmare after another. Been using fleet for "Endpoint" and so far it's been less then pleasant. Got to love Beta. Issue: Unable to login into Kibana with elastic user so you know this i… --- ## [Open results in a new window](https://discuss.elastic.co/t/open-results-in-a-new-window/270426)
**Author:** [@nifsight](https://discuss.elastic.co/u/nifsight)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 7:03pm UTC](https://discuss.elastic.co/t/open-results-in-a-new-window/270426 "2021-05-04T19:03:47Z")
We would like PDFs and documents to open in a new window rather than the same browser tab, so customers do not loose a view of our site navigation and their context when documents open from the search page. We've added … --- ## [Geo location distance sorting by proximity boost](https://discuss.elastic.co/t/geo-location-distance-sorting-by-proximity-boost/270749)
**Author:** [@bskade](https://discuss.elastic.co/u/bskade)\ **Replies:** 6\ **Last updated:** [May 4, 2021, 7:03pm UTC](https://discuss.elastic.co/t/geo-location-distance-sorting-by-proximity-boost/270749 "2021-05-04T19:03:21Z")
Hi, we tried some kind of distance sorting by boosting the distance score impact. pseudo code options\["boosts"\] = { location: { type: "proximity", function: "exponential", center: options.facets.location.center, … --- ## [Apply conditions in http monitor , heartbeat](https://discuss.elastic.co/t/apply-conditions-in-http-monitor-heartbeat/270587)
**Author:** [@Kartikey\_Bhatore](https://discuss.elastic.co/u/Kartikey_Bhatore)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 6:35pm UTC](https://discuss.elastic.co/t/apply-conditions-in-http-monitor-heartbeat/270587 "2021-05-04T18:35:06Z")
Hello , I am using heartbeat 6.5.3 Do we have a option to apply conditions at the time of http URL check. eg if URL1 is up then only check URL 2 , if URL2 status is also UP then only status : UP if URL1 is down then … --- ## [Nested Query: Nested document returns unmatched documents](https://discuss.elastic.co/t/nested-query-nested-document-returns-unmatched-documents/272096)
**Author:** [@tkumar](https://discuss.elastic.co/u/tkumar)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 5:17pm UTC](https://discuss.elastic.co/t/nested-query-nested-document-returns-unmatched-documents/272096 "2021-05-04T17:17:23Z")
Hi - We have indexed the document using nested mapping and the document also created in nested format in the Elasticsearch. But while retrieving using nested query it also returns unmatched documents from both the datas… --- ## [Fleet Agents hitting 100% CPU usage](https://discuss.elastic.co/t/fleet-agents-hitting-100-cpu-usage/271529)
**Author:** [@MichaelHuff](https://discuss.elastic.co/u/MichaelHuff)\ **Replies:** 19\ **Last updated:** [May 4, 2021, 6:18pm UTC](https://discuss.elastic.co/t/fleet-agents-hitting-100-cpu-usage/271529 "2021-05-04T18:18:48Z")
We put the elastic-agent for fleet onto our VDI infrastructure. Each VDI machine started out with 2 vCPUs and 4 GB RAM. We installed the elastic-agent through fleet. The machine performed fine for a few hours then became… --- ## [Elasticsearch migrating from mesos container framework to K8s](https://discuss.elastic.co/t/elasticsearch-migrating-from-mesos-container-framework-to-k8s/272104)
**Author:** [@guthurti](https://discuss.elastic.co/u/guthurti)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 6:15pm UTC](https://discuss.elastic.co/t/elasticsearch-migrating-from-mesos-container-framework-to-k8s/272104 "2021-05-04T18:15:54Z")
Team, Can you please someone suggest what is the best way to migrate Elasticsearch Mesos to k8s. I tried one solution but not succeeded, Mesos mount volume same as used k8s statefulset and pix-boot the nodes. I am not … --- ## [ES 7.12 - Java rest high level - multi\_terms aggregation - response error](https://discuss.elastic.co/t/es-7-12-java-rest-high-level-multi-terms-aggregation-response-error/272101)
**Author:** [@hikemachado](https://discuss.elastic.co/u/hikemachado)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 5:57pm UTC](https://discuss.elastic.co/t/es-7-12-java-rest-high-level-multi-terms-aggregation-response-error/272101 "2021-05-04T17:57:01Z")
Hi there, I've a request using SearchTemplateRequest the request script uses "multi\_terms" aggregation I can see in the logs that the response comes as expected but the java rest high level throws an exception saying … [Previous page](https://discuss.elastic.co/latest.md?page=1693) [Next page](https://discuss.elastic.co/latest.md?page=1695)