# Latest **URL:** https://discuss.elastic.co/latest.md?page=1713 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1714 --- ## [Kibana cluster email alerts](https://discuss.elastic.co/t/kibana-cluster-email-alerts/270712)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 7:26am UTC](https://discuss.elastic.co/t/kibana-cluster-email-alerts/270712 "2021-04-26T07:26:22Z")
Hi, I have configured monitoring.cluster\_alerts.email\_notifications.email\_address in kibana.yml in elasticsearch.yml I am using SES The SES configuration does not allow me to include a from, ES refuses to start if its… --- ## [Jira connector mapped to the wrong field](https://discuss.elastic.co/t/jira-connector-mapped-to-the-wrong-field/269535)
**Author:** [@kyles](https://discuss.elastic.co/u/kyles)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 6:48am UTC](https://discuss.elastic.co/t/jira-connector-mapped-to-the-wrong-field/269535 "2021-04-26T06:48:38Z")
I setup the Jira connector to Elastic security but it automatically mapped the description field to a custom field that is not the description field. Is there a way to manually change what it is mapped to? --- ## [ServiceNow SIR Action Type Missing from Detection Configuration](https://discuss.elastic.co/t/servicenow-sir-action-type-missing-from-detection-configuration/270417)
**Author:** [@BrianD](https://discuss.elastic.co/u/BrianD)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 6:33am UTC](https://discuss.elastic.co/t/servicenow-sir-action-type-missing-from-detection-configuration/270417 "2021-04-26T06:33:07Z")
The recent update to Elastic 7.12 included a new Connector for ServiceNow SIR creation. I setup the connector and proceeded to implement it as an Action for one of the SIEM Detection rules. However, when I go to select … --- ## [Environmental variable in Logstash](https://discuss.elastic.co/t/environmental-variable-in-logstash/271063)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 6:25am UTC](https://discuss.elastic.co/t/environmental-variable-in-logstash/271063 "2021-04-26T06:25:41Z")
Hi Folks, I use Logstash to send logs to a cloud SIEM. In particular I use an output plugin for the SIEM Vendor In order to authenticate towards the cloud Logstash presents id which is public and don't bother me and k… --- ## [Missing authentication credentials for REST request](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/271215)
**Author:** [@jojbapsaekki](https://discuss.elastic.co/u/jojbapsaekki)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 5:51am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/271215 "2021-04-26T05:51:17Z")
xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.tran… --- ## [Logstash is not starting in windows](https://discuss.elastic.co/t/logstash-is-not-starting-in-windows/270577)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 4:36am UTC](https://discuss.elastic.co/t/logstash-is-not-starting-in-windows/270577 "2021-04-26T04:36:00Z")
Hey Guys , I am using Logstash to send logs to kibana . I have configured logstash in windows instances with Two pipelines in my pipelines.yaml and this is the config that is present in pipelines.yml - pipeline.id… --- ## [Autodiscovering logstash nodes in Kubernetes](https://discuss.elastic.co/t/autodiscovering-logstash-nodes-in-kubernetes/270002)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 7\ **Last updated:** [April 26, 2021, 4:20am UTC](https://discuss.elastic.co/t/autodiscovering-logstash-nodes-in-kubernetes/270002 "2021-04-26T04:20:14Z")
So, I have a Logstash Statefulset running in Kubernetes. I have a headless service defined to establish network connection to the logstash pods. I deployed beats as a deployment using the official docker image, and I wa… --- ## [Watcher does not show results in the mail message](https://discuss.elastic.co/t/watcher-does-not-show-results-in-the-mail-message/271106)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 2:59am UTC](https://discuss.elastic.co/t/watcher-does-not-show-results-in-the-mail-message/271106 "2021-04-26T02:59:15Z")
Hello good day, I have a problem with the action of a watch, it does not show me the results in the email message it sends, I use {{ctx.payload.hits.total}} and also {{ctx.payload.aggregations.heartbeat\_count}} to show t… --- ## [Missing "Host" and Event Log Data under Security tab](https://discuss.elastic.co/t/missing-host-and-event-log-data-under-security-tab/271183)
**Author:** [@mually](https://discuss.elastic.co/u/mually)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 10:37am UTC](https://discuss.elastic.co/t/missing-host-and-event-log-data-under-security-tab/271183 "2021-04-25T10:37:46Z")
Hi, I deployed the elastic agent to my Windows server and enabled the endpoint security integration. The agent is visible and healthy from the fleet menu, and also from the administration page under the security menu. H… --- ## [Security not appear data](https://discuss.elastic.co/t/security-not-appear-data/271029)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 12:50am UTC](https://discuss.elastic.co/t/security-not-appear-data/271029 "2021-04-26T00:50:03Z")
HI, may i know, why my data not display in security in kibana. Previously i'm using basic license. then i extend it to trial license. however, i saw my data for auditbeat and filebeat appear in discovery. but i just con… --- ## [ECS fields and ML jobs for modules loaded by process](https://discuss.elastic.co/t/ecs-fields-and-ml-jobs-for-modules-loaded-by-process/271188)
**Author:** [@hukel](https://discuss.elastic.co/u/hukel)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 12:40pm UTC](https://discuss.elastic.co/t/ecs-fields-and-ml-jobs-for-modules-loaded-by-process/271188 "2021-04-25T12:40:55Z")
We want to run ML jobs for rare module loads in processes. From what I have seen, this is not in the ECS today, though I think it would be similar to process.args. Before we start creating custom fields and ML jobs, … --- ## [Query about number of CPU cores](https://discuss.elastic.co/t/query-about-number-of-cpu-cores/271144)
**Author:** [@Yash\_Srivastava](https://discuss.elastic.co/u/Yash_Srivastava)\ **Replies:** 3\ **Last updated:** [April 25, 2021, 7:52pm UTC](https://discuss.elastic.co/t/query-about-number-of-cpu-cores/271144 "2021-04-25T19:52:44Z")
I want to know Number of cpu cores used in Elastic Cloud for IO/Intensive and Compute-Intensive hardware profiles for 4 GB RAM setup. Any idea? --- ## [ZFS Module for Metricbeat](https://discuss.elastic.co/t/zfs-module-for-metricbeat/271202)
**Author:** [@Niecke](https://discuss.elastic.co/u/Niecke)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 7:44pm UTC](https://discuss.elastic.co/t/zfs-module-for-metricbeat/271202 "2021-04-25T19:44:43Z")
I am looking for the possibility to gather metrics from ZFS pools and datasets. Sadly this seems not to be implemented in metricbeat (Metricbeat: Add support for ZFS metrics · Issue #10848 · elastic/beats · GitHub). I th… --- ## [Element involves results from two KQLs?](https://discuss.elastic.co/t/element-involves-results-from-two-kqls/270915)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 4\ **Last updated:** [April 25, 2021, 7:18pm UTC](https://discuss.elastic.co/t/element-involves-results-from-two-kqls/270915 "2021-04-25T19:18:30Z")
Hi, in Kibana Canvas, I want to have an image element that changes color according to results from two separate KQLs. Is it possible? If not, any suggestions on how I may be able to work around this limitation? Thanks a… --- ## [Split of JSON array into multiple events in Kibana](https://discuss.elastic.co/t/split-of-json-array-into-multiple-events-in-kibana/271018)
**Author:** [@pedro\_gonzalez](https://discuss.elastic.co/u/pedro_gonzalez)\ **Replies:** 7\ **Last updated:** [April 25, 2021, 5:55pm UTC](https://discuss.elastic.co/t/split-of-json-array-into-multiple-events-in-kibana/271018 "2021-04-25T17:55:28Z")
Hi, I am trying to split into different events (logs) this log schema: "\_index": "cocacola", "\_type": "raw", "\_id": "CqwJ63MBEQS11DmXsDyRZl", "\_score": 1, "\_source": { … --- ## [Filebeat 7.12 event collection rate drops after a period of time](https://discuss.elastic.co/t/filebeat-7-12-event-collection-rate-drops-after-a-period-of-time/271157)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 1\ **Last updated:** [April 24, 2021, 5:42pm UTC](https://discuss.elastic.co/t/filebeat-7-12-event-collection-rate-drops-after-a-period-of-time/271157 "2021-04-24T17:42:59Z")
I have deployed filebeat 7.12 on a kubernetes cluster for collecting log events. The deployment was smooth and started collecting events as expected. But after a day, after collecting 50K + events the number of events t… --- ## [Not sure if a field is nill, null or empty. Help please](https://discuss.elastic.co/t/not-sure-if-a-field-is-nill-null-or-empty-help-please/271123)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 4\ **Last updated:** [April 24, 2021, 6:55pm UTC](https://discuss.elastic.co/t/not-sure-if-a-field-is-nill-null-or-empty-help-please/271123 "2021-04-24T18:55:29Z")
Hi All, It's about barracuda FW log with the following entry +02:00 Security XXX Block: type=FWD|proto=TCP|srcIF=eth0|srcIP=0.0.0.0|srcPort=58570|srcMAC=00:00:00:00:00:00|dstIP=0.0.0.0|dstPort=3002|dstService=exlm-agen… --- ## [Elasticsearch Security - Asking for Data](https://discuss.elastic.co/t/elasticsearch-security-asking-for-data/271187)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 1\ **Last updated:** [April 25, 2021, 2:51pm UTC](https://discuss.elastic.co/t/elasticsearch-security-asking-for-data/271187 "2021-04-25T14:51:13Z")
I am sending logs from my firewall/home-router(UDM) to rsyslog and copying the logs in Logstash directory. I can see the data in discover and can create visualizations/Dashboard from that data. But the security section i… --- ## [Filebeat AWS ,Azure Modules: Support Multiple Accounts](https://discuss.elastic.co/t/filebeat-aws-azure-modules-support-multiple-accounts/271177)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [April 25, 2021, 1:46pm UTC](https://discuss.elastic.co/t/filebeat-aws-azure-modules-support-multiple-accounts/271177 "2021-04-25T13:46:47Z")
I have successfully started both the filebeat modules AWS and Azure for a single account. I want to know if Filebeat can support multiple accounts for AWS and Azure. I would like to achieve following scenarios. Get mul… --- ## [Is using "filter" inside "aggs" more efficient than "query" at the top level of an aggregation body?](https://discuss.elastic.co/t/is-using-filter-inside-aggs-more-efficient-than-query-at-the-top-level-of-an-aggregation-body/271153)
**Author:** [@mattwelke](https://discuss.elastic.co/u/mattwelke)\ **Replies:** 5\ **Last updated:** [April 25, 2021, 1:02pm UTC](https://discuss.elastic.co/t/is-using-filter-inside-aggs-more-efficient-than-query-at-the-top-level-of-an-aggregation-body/271153 "2021-04-25T13:02:02Z")
I'm working in a legacy code base and I think I've uncovered an inefficient way of doing a filter aggregation based on what I read in the docs. These are my assumptions: Using filters to eliminate documents from searc… --- ## [Non-nested query on copy\_to fields performs worse then a nested query](https://discuss.elastic.co/t/non-nested-query-on-copy-to-fields-performs-worse-then-a-nested-query/271186)
**Author:** [@Ron\_lusha](https://discuss.elastic.co/u/Ron_lusha)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 11:50am UTC](https://discuss.elastic.co/t/non-nested-query-on-copy-to-fields-performs-worse-then-a-nested-query/271186 "2021-04-25T11:50:37Z")
Our service uses a lot of nested queries/data, in order to improve our response time I tried to rewrite our heaviest query and use copy\_to to copy the fields I need from inside the nested docs to the root doc and query t… --- ## [Cluster Health Events FROM Elastic TO Arcsight](https://discuss.elastic.co/t/cluster-health-events-from-elastic-to-arcsight/271185)
**Author:** [@yaharin\_ben\_ayon](https://discuss.elastic.co/u/yaharin_ben_ayon)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 11:30am UTC](https://discuss.elastic.co/t/cluster-health-events-from-elastic-to-arcsight/271185 "2021-04-25T11:30:41Z")
Hello, is there a way to import the cluster health logs or any logs FROM Elastic TO Arcsight with the Logstash Arcsight module or other way? Thank you! --- ## [Aggregation on latest n records](https://discuss.elastic.co/t/aggregation-on-latest-n-records/271169)
**Author:** [@behzad\_dadashpour](https://discuss.elastic.co/u/behzad_dadashpour)\ **Replies:** 2\ **Last updated:** [April 25, 2021, 9:32am UTC](https://discuss.elastic.co/t/aggregation-on-latest-n-records/271169 "2021-04-25T09:32:14Z")
Hi Is there any way to do aggregation on latest N records? this solution didn't work { "query": {...}, "size": N, "order": ..., "aggs": { .... } } for more detail: I want to get last 10 records … --- ## [How to delete by query](https://discuss.elastic.co/t/how-to-delete-by-query/271170)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 1\ **Last updated:** [April 25, 2021, 9:15am UTC](https://discuss.elastic.co/t/how-to-delete-by-query/271170 "2021-04-25T09:15:05Z")
how to delete by query current index\_name :logstash-2021.04.23 actually Data entered the index of the current timestamp because of index definition error. How to delete contain 2021.04.22 in the index(logstash-2021.04.… --- ## [Perform a clear cache operation with no significant change in memory](https://discuss.elastic.co/t/perform-a-clear-cache-operation-with-no-significant-change-in-memory/271165)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 4\ **Last updated:** [April 25, 2021, 9:10am UTC](https://discuss.elastic.co/t/perform-a-clear-cache-operation-with-no-significant-change-in-memory/271165 "2021-04-25T09:10:55Z")
I executed the following request to clear the cache, but when I look at the percentage of memory used by the process on top, there is no change。What is the reason for this? curl -XPOST 'http://172.18.141.39:19200/\_cache… --- ## [Java Automatic Agent Configuration Options are not working](https://discuss.elastic.co/t/java-automatic-agent-configuration-options-are-not-working/270944)
**Author:** [@Kevin\_Christopher](https://discuss.elastic.co/u/Kevin_Christopher)\ **Replies:** 4\ **Last updated:** [April 25, 2021, 7:53am UTC](https://discuss.elastic.co/t/java-automatic-agent-configuration-options-are-not-working/270944 "2021-04-25T07:53:01Z")
Kibana version: 7.12 Elasticsearch version: 7.12 APM Server version: 7.12 APM Agent language and version: Java 1.21 Browser version: Original install method (e.g. download page, yum, deb, from source, etc.) and… --- ## [Filebeat normal start but no update log to elasticsearch](https://discuss.elastic.co/t/filebeat-normal-start-but-no-update-log-to-elasticsearch/270733)
**Author:** [@WhyStart](https://discuss.elastic.co/u/WhyStart)\ **Replies:** 3\ **Last updated:** [April 25, 2021, 6:32am UTC](https://discuss.elastic.co/t/filebeat-normal-start-but-no-update-log-to-elasticsearch/270733 "2021-04-25T06:32:17Z")
I installed filebeta on macos localhost，elk installed on docker desktop for mac,start filebeat log normal output,doesn't seem to have any problems,but it is not transmitted to elasticsearch. filebeat.yml # ============… --- ## [Logstash cannot use docker metadata to build a dynamic index](https://discuss.elastic.co/t/logstash-cannot-use-docker-metadata-to-build-a-dynamic-index/271032)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 3\ **Last updated:** [April 25, 2021, 6:23am UTC](https://discuss.elastic.co/t/logstash-cannot-use-docker-metadata-to-build-a-dynamic-index/271032 "2021-04-25T06:23:05Z")
I use filebeat to collect docker logs and add a label when the docker container starts. - type: docker enabled: true containers.ids: - '\*' tail\_files: true The following configuration is made in logstash … --- ## [How to filter when dynamic index has no value](https://discuss.elastic.co/t/how-to-filter-when-dynamic-index-has-no-value/271166)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 3\ **Last updated:** [April 25, 2021, 6:19am UTC](https://discuss.elastic.co/t/how-to-filter-when-dynamic-index-has-no-value/271166 "2021-04-25T06:19:24Z")
I use the label in the docker metadata to build an index dynamically. When the label of some containers does not exist or the value is empty, I get two indexes at the same time. How can I solve this problem Logstash c… --- ## [Exceptions GUI Improvements](https://discuss.elastic.co/t/exceptions-gui-improvements/270883)
**Author:** [@chris.murray](https://discuss.elastic.co/u/chris.murray)\ **Replies:** 1\ **Last updated:** [April 25, 2021, 5:55am UTC](https://discuss.elastic.co/t/exceptions-gui-improvements/270883 "2021-04-25T05:55:45Z")
I'm curious if there are any future enhancement plans for the Exceptions feature. Our SOC folks are finding a few limitations in managing them through the Kibana UI. Here are few examples of actions that can only be pe… [Previous page](https://discuss.elastic.co/latest.md?page=1712) [Next page](https://discuss.elastic.co/latest.md?page=1714)