# Latest **URL:** https://discuss.elastic.co/latest.md?page=1696 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1697 --- ## [How to include if you don't have a row = 1 on the Learn expression canvas](https://discuss.elastic.co/t/how-to-include-if-you-dont-have-a-row-1-on-the-learn-expression-canvas/271981)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 10:50am UTC](https://discuss.elastic.co/t/how-to-include-if-you-dont-have-a-row-1-on-the-learn-expression-canvas/271981 "2021-05-04T10:50:29Z")
I have an SQL query to return some values, like: Avarege, warning, disaster, high. sometimes he returns all but sometimes he returns two of them, however I need to make a manipulation going through them all. I need a con… --- ## [Connection error between filebeat and kibana](https://discuss.elastic.co/t/connection-error-between-filebeat-and-kibana/272058)
**Author:** [@babi2002](https://discuss.elastic.co/u/babi2002)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 10:43am UTC](https://discuss.elastic.co/t/connection-error-between-filebeat-and-kibana/272058 "2021-05-04T10:43:52Z")
Hi to all, I'm a newby into the Elastic Stack. I'm installing a wazuh-manager server and I need to monitor our firewalls via syslog. I have configured Wazuh manager, and I receive syslog messages from our firewall. I'v… --- ## [Kibana Dashboard - define his own index pattern](https://discuss.elastic.co/t/kibana-dashboard-define-his-own-index-pattern/270881)
**Author:** [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Replies:** 3\ **Last updated:** [May 4, 2021, 9:46am UTC](https://discuss.elastic.co/t/kibana-dashboard-define-his-own-index-pattern/270881 "2021-05-04T09:46:05Z")
Hi all, I'm trying to apply some filter in a Kibana dashboard with no success because it will be applyed to the defined global default index pattern and this Dashboard visualizations get all their data from other index … --- ## [How to trace/log all delete action](https://discuss.elastic.co/t/how-to-trace-log-all-delete-action/272054)
**Author:** [@Michael\_Oullion](https://discuss.elastic.co/u/Michael_Oullion)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 9:44am UTC](https://discuss.elastic.co/t/how-to-trace-log-all-delete-action/272054 "2021-05-04T09:44:21Z")
Hi, I have a shared ELK in my Enterprise and we need to trace/log 2 type of action : Delete Index by API DELETE Call Delete doc by Delete\_by\_query I try without success with Audit and slowlog. Is there a way to have… --- ## [Kibana stack monitoring graphs is not clear](https://discuss.elastic.co/t/kibana-stack-monitoring-graphs-is-not-clear/271875)
**Author:** [@fatihtekin](https://discuss.elastic.co/u/fatihtekin)\ **Replies:** 4\ **Last updated:** [May 4, 2021, 9:31am UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-graphs-is-not-clear/271875 "2021-05-04T09:31:58Z")
I upgraded elasticsearch and kibana version from 7.5 to 7.12. I have seen unclear stack monitoring graphs after the upgrade process. I don't understand why it happens. I added screenshots. Can you help me with why it hap… --- ## [Output Elasticsearch index name error](https://discuss.elastic.co/t/output-elasticsearch-index-name-error/271979)
**Author:** [@Frack](https://discuss.elastic.co/u/Frack)\ **Replies:** 3\ **Last updated:** [May 4, 2021, 9:25am UTC](https://discuss.elastic.co/t/output-elasticsearch-index-name-error/271979 "2021-05-04T09:25:45Z")
I have a "logstash" index with documents while I have hardcoded the name of the output index by the tags. when I check in the index "logstash" my logs have the right tag "windows" or "iptable" ... I added a final "else… --- ## [Remote cluster - TCP connection is not happened with Istio ingress](https://discuss.elastic.co/t/remote-cluster-tcp-connection-is-not-happened-with-istio-ingress/271040)
**Author:** [@rmssath](https://discuss.elastic.co/u/rmssath)\ **Replies:** 3\ **Last updated:** [May 4, 2021, 8:57am UTC](https://discuss.elastic.co/t/remote-cluster-tcp-connection-is-not-happened-with-istio-ingress/271040 "2021-05-04T08:57:01Z")
Hi Team, We have followed the below step to configure remote cluster. In remote cluster, we have create istio ingress gateway/virtualservice with TCP to expose the service. apiVersion: networking.istio.io/v1alpha3 k… --- ## [Using Filebeat with ecs logging](https://discuss.elastic.co/t/using-filebeat-with-ecs-logging/272049)
**Author:** [@neko](https://discuss.elastic.co/u/neko)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 8:46am UTC](https://discuss.elastic.co/t/using-filebeat-with-ecs-logging/272049 "2021-05-04T08:46:33Z")
Hi, I want to have my logs to ECS format before shipping them to elasticsearch cluster. We got a server collecting logs from different equipments, each equipment having its dedicated log directory on the server. Fileb… --- ## [Elasticsearch 7.9, set or not manually JVM heap memory](https://discuss.elastic.co/t/elasticsearch-7-9-set-or-not-manually-jvm-heap-memory/272041)
**Author:** [@parallelism](https://discuss.elastic.co/u/parallelism)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-7-9-set-or-not-manually-jvm-heap-memory/272041 "2021-05-04T08:22:51Z")
Hello, We are deploying an Elasticsearch 7.9.3 cluster in a production environment. About setting or not the Java heap memory assignment, we find in the documentation something that seems a little contradictory. Accord… --- ## [Is Elasticsearch going to sleep after some hours?](https://discuss.elastic.co/t/is-elasticsearch-going-to-sleep-after-some-hours/272035)
**Author:** [@JdKock](https://discuss.elastic.co/u/JdKock)\ **Replies:** 9\ **Last updated:** [May 4, 2021, 8:20am UTC](https://discuss.elastic.co/t/is-elasticsearch-going-to-sleep-after-some-hours/272035 "2021-05-04T08:20:34Z")
We are using Elasticsearch (v7.3.2) for our search solution and we use a Java API to get the search results from Elasticsearch. This is working fine. In the Test environment we are not using Elasticsearch everyday. What… --- ## [License information could not be obtained from Elasticsearch due to \[illegal\_argument\_exception\] request \[/\_xpack\] contains unrecognized parameter: \[accept\_enterprise\]](https://discuss.elastic.co/t/license-information-could-not-be-obtained-from-elasticsearch-due-to-illegal-argument-exception-request-xpack-contains-unrecognized-parameter-accept-enterprise/271990)
**Author:** [@IBoskov](https://discuss.elastic.co/u/IBoskov)\ **Replies:** 3\ **Last updated:** [May 4, 2021, 8:10am UTC](https://discuss.elastic.co/t/license-information-could-not-be-obtained-from-elasticsearch-due-to-illegal-argument-exception-request-xpack-contains-unrecognized-parameter-accept-enterprise/271990 "2021-05-04T08:10:05Z")
Hi there, We are trying to upgrade elasticsearch stack from 7.4.0 to 7.10.2, however when upgrading to 7.10.2 we are facing the following error message from kibana logs. {"type":"log","@timestamp":"2021-05-03T13:20:35Z… --- ## [How to configure GREDDYDATA in logstash to take mutiline input](https://discuss.elastic.co/t/how-to-configure-greddydata-in-logstash-to-take-mutiline-input/272046)
**Author:** [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 7:46am UTC](https://discuss.elastic.co/t/how-to-configure-greddydata-in-logstash-to-take-mutiline-input/272046 "2021-05-04T07:46:33Z")
INFO 2021-04-17 21:40:25,689 \[\[MuleRuntime\].uber.01: \[testproject\].testprojectFlow.CPU\_LITE @4d779882\] \[processor: testprojectFlow/processors/0; event: 6b78a980-9f97-11eb-a8e6-f8ac6500be0e\] org.mule.runtime.core.interna… --- ## [Issues with "Analyzing Windows Host Data" Course](https://discuss.elastic.co/t/issues-with-analyzing-windows-host-data-course/271821)
**Author:** [@merium.khalid](https://discuss.elastic.co/u/merium.khalid)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 7:35am UTC](https://discuss.elastic.co/t/issues-with-analyzing-windows-host-data-course/271821 "2021-05-04T07:35:50Z")
When trying to do the Lab for the course “Analyzing Windows Host Data”. I am unable to get to the Kibana instance on “https://ec2-35-157-116-2.eu-central-1.compute.amazonaws.com:5601/app/kibana#”. I was able to obtain th… --- ## [Hmac hash log integrity check](https://discuss.elastic.co/t/hmac-hash-log-integrity-check/272040)
**Author:** [@syn](https://discuss.elastic.co/u/syn)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 7:29am UTC](https://discuss.elastic.co/t/hmac-hash-log-integrity-check/272040 "2021-05-04T07:29:41Z")
Hi, I'm using graylog with filebeats. each line of log has a hash appended at the end. the hash is supposed to be used for data integrity check. Is there a way for the filebeats harvester to check and match the log da… --- ## [Thread Pool max Size and Number of Processor](https://discuss.elastic.co/t/thread-pool-max-size-and-number-of-processor/271971)
**Author:** [@mani1](https://discuss.elastic.co/u/mani1)\ **Replies:** 10\ **Last updated:** [May 4, 2021, 7:25am UTC](https://discuss.elastic.co/t/thread-pool-max-size-and-number-of-processor/271971 "2021-05-04T07:25:03Z")
Hi, In latest elasticSearch Version 7 series, How to decide the maximum Search Thread Pool Size, will it depends on number of vCPUs , and decided by the formula (vCPU\*3/2)+1 OR the max size still is based on 32 vCPUs a… --- ## [Join indexes in Kibana](https://discuss.elastic.co/t/join-indexes-in-kibana/271885)
**Author:** [@Tulay](https://discuss.elastic.co/u/Tulay)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 6:37am UTC](https://discuss.elastic.co/t/join-indexes-in-kibana/271885 "2021-05-04T06:37:39Z")
How can we join two indexes , if we want to join by a specific field of each index in Kibana --- ## [Unable to view "Snapshot & restore" option in Kibana UI( v6.8.14)](https://discuss.elastic.co/t/unable-to-view-snapshot-restore-option-in-kibana-ui-v6-8-14/272010)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 3\ **Last updated:** [May 4, 2021, 6:34am UTC](https://discuss.elastic.co/t/unable-to-view-snapshot-restore-option-in-kibana-ui-v6-8-14/272010 "2021-05-04T06:34:30Z")
Hi All, I am novice to elk stack, installed elasticsearch & kibana both with 6.8.14 version however I dont see "Snapshot & restore" option in kibana ui. But I can see "snapshot & restore" option in version 7.12 of kiban… --- ## [Synonym filter not working within a Multiplexer Filter](https://discuss.elastic.co/t/synonym-filter-not-working-within-a-multiplexer-filter/271719)
**Author:** [@gquaire](https://discuss.elastic.co/u/gquaire)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 5:53am UTC](https://discuss.elastic.co/t/synonym-filter-not-working-within-a-multiplexer-filter/271719 "2021-05-04T05:53:06Z")
Hello, I'm using Elasticsearch v7.6.2. I am currently trying to create an custom analyser that uses a MultiplexerFilter with only one filters branc. This branch contains only a SynonymFilter. My goal is to keep original… --- ## [.Net Core Console App APM Integrations](https://discuss.elastic.co/t/net-core-console-app-apm-integrations/271909)
**Author:** [@KARAOGLU](https://discuss.elastic.co/u/KARAOGLU)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 5:39am UTC](https://discuss.elastic.co/t/net-core-console-app-apm-integrations/271909 "2021-05-04T05:39:27Z")
Hello, Can we only use APM in .net web-based applications? I was able to run it in a simple web-based application, but I could not run it in a console application with the same settings. I haven't seen a sample or work… --- ## [Grok regex, How should I interpret the hour pattern?](https://discuss.elastic.co/t/grok-regex-how-should-i-interpret-the-hour-pattern/272030)
**Author:** [@111420](https://discuss.elastic.co/u/111420)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 5:33am UTC](https://discuss.elastic.co/t/grok-regex-how-should-i-interpret-the-hour-pattern/272030 "2021-05-04T05:33:59Z")
In Logstash, does HOUR's regular expression (?:2\[0123\]|\[01\])?\[0-9\]) I wonder what the number after the colon means and how to interpret the whole thing. --- ## [Security-exception-action-\[indices:admin/settings/update\] is unauthorized for user \[kibana\] on indices \[apm-7.6.0-error-000001\]](https://discuss.elastic.co/t/security-exception-action-indices-admin-settings-update-is-unauthorized-for-user-kibana-on-indices-apm-7-6-0-error-000001/271737)
**Author:** [@Kevin\_Christopher](https://discuss.elastic.co/u/Kevin_Christopher)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 4:24am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-settings-update-is-unauthorized-for-user-kibana-on-indices-apm-7-6-0-error-000001/271737 "2021-05-04T04:24:05Z")
I have the elasticsearch,kibana,apm-server in a single ec2 instance. Able to get apm agent data from other application servers. When I look into Index Management I can see index errors for all apm indices ilm.step:ERR… --- ## [Connect to sql](https://discuss.elastic.co/t/connect-to-sql/272021)
**Author:** [@Jeancarlos\_Netto](https://discuss.elastic.co/u/Jeancarlos_Netto)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 4:01am UTC](https://discuss.elastic.co/t/connect-to-sql/272021 "2021-05-04T04:01:28Z")
I am new here I would like to make a query in a sql database and store the results of this query in elastic, can someone help me to configure the application to work this way? --- ## [Some problems about index life cycle](https://discuss.elastic.co/t/some-problems-about-index-life-cycle/271953)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 8\ **Last updated:** [May 4, 2021, 3:20am UTC](https://discuss.elastic.co/t/some-problems-about-index-life-cycle/271953 "2021-05-04T03:20:43Z")
I use logstash to add fields to dynamically generate indexes. index =\> "%{\[service\]}-%{+YYYY.MM.dd}" I configure the following index template to match the generated index { "index\_templates" : \[ { "name" :… --- ## [Get number of unique results from multiple indices](https://discuss.elastic.co/t/get-number-of-unique-results-from-multiple-indices/271401)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 7:37pm UTC](https://discuss.elastic.co/t/get-number-of-unique-results-from-multiple-indices/271401 "2021-05-03T19:37:21Z")
I have 5 indices: all of them with the same schema, so each one of them represents a dataset among many datasets. Each one of them is around 1Tb of size. I want to issue a query to all of the indices at the same time and… --- ## [Load data from sql server to elasticsearch aws](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-aws/272023)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 2:32am UTC](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-aws/272023 "2021-05-04T02:32:53Z")
Hi all, How can I load data from sql server to elasticsearch (aws version 6.5) using logstash ( version 7.9). I can't download the output plugin es-amzon on Windows. Can someone help me please and tell me thé steps … --- ## [Fleets AWS Integration Clarification](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262)
**Author:** [@DaveRT](https://discuss.elastic.co/u/DaveRT)\ **Replies:** 4\ **Last updated:** [May 4, 2021, 2:09am UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262 "2021-05-04T02:09:43Z")
I'm trying to test the Fleets Beta AWS integration. Initially just with CloudTrail logs before adding others. So far I have done the below: -Created IAM User -Created permissions policy with required permissions, and… --- ## [Span.End() method seems to lock the application in certain cases](https://discuss.elastic.co/t/span-end-method-seems-to-lock-the-application-in-certain-cases/271960)
**Author:** [@javiersotodev](https://discuss.elastic.co/u/javiersotodev)\ **Replies:** 3\ **Last updated:** [May 4, 2021, 1:42am UTC](https://discuss.elastic.co/t/span-end-method-seems-to-lock-the-application-in-certain-cases/271960 "2021-05-04T01:42:52Z")
We recently implemented our apm Custom spans in our code (that processes kafka messages in a high speed) and thanks to one of our processes timeouts and further debug logging we catch that a custom Span End method was ca… --- ## [Applying APM Transaction labels to autogenerated spans (python)](https://discuss.elastic.co/t/applying-apm-transaction-labels-to-autogenerated-spans-python/272028)
**Author:** [@Rodrigo\_Jimenez](https://discuss.elastic.co/u/Rodrigo_Jimenez)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 12:58am UTC](https://discuss.elastic.co/t/applying-apm-transaction-labels-to-autogenerated-spans-python/272028 "2021-05-04T00:58:40Z")
I know this might have been asked before but is there any way to make autogenerated spans from custom code (no framework) inherit the same labels as their parent transactions with the python apm-agent? Thanks! --- ## [Multiple indices for single logstash pipeline](https://discuss.elastic.co/t/multiple-indices-for-single-logstash-pipeline/272015)
**Author:** [@srk1](https://discuss.elastic.co/u/srk1)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 12:12am UTC](https://discuss.elastic.co/t/multiple-indices-for-single-logstash-pipeline/272015 "2021-05-04T00:12:31Z")
Hello ES users, i have filebeat instance sending one source log to ES via logstash pipeline. Now, i want to add another file on filebeat input list and use the same logstash pipeline but write to a different new index. C… --- ## [Different field type on couple shards](https://discuss.elastic.co/t/different-field-type-on-couple-shards/272019)
**Author:** [@rh\_es](https://discuss.elastic.co/u/rh_es)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 12:09am UTC](https://discuss.elastic.co/t/different-field-type-on-couple-shards/272019 "2021-05-04T00:09:42Z")
Hello. Somehow the type of one field in two shards is different of type at entire index and rest of the shards. As result some queries that rely on the field having specific type (number) are impacted. I know that it is … [Previous page](https://discuss.elastic.co/latest.md?page=1695) [Next page](https://discuss.elastic.co/latest.md?page=1697)