# Latest **URL:** https://discuss.elastic.co/latest.md?page=1728 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1729 --- ## [Trying to run the 'Get duration by using bucket script' but not working](https://discuss.elastic.co/t/trying-to-run-the-get-duration-by-using-bucket-script-but-not-working/269648)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 9:52pm UTC](https://discuss.elastic.co/t/trying-to-run-the-get-duration-by-using-bucket-script-but-not-working/269648 "2021-04-16T21:52:38Z")
Hello, I'm attempting to calculate Session Duration by using the provided example here: I even followed this users successful implementation: Computing session durations from timestamps scattered over two documents - … --- ## [Problem in importing csv with logstrash](https://discuss.elastic.co/t/problem-in-importing-csv-with-logstrash/270332)
**Author:** [@Fady\_Hany](https://discuss.elastic.co/u/Fady_Hany)\ **Replies:** 8\ **Last updated:** [April 16, 2021, 9:51pm UTC](https://discuss.elastic.co/t/problem-in-importing-csv-with-logstrash/270332 "2021-04-16T21:51:38Z")
i have read a lot of similar problems in this nice forum , but non of them fit my situation my .conf file : input { file { path =\> "E:/test/\*.csv" start\_position =\> "beginning" sincedb\_pat… --- ## [Is there a way to prevent that new fields are added to a schema during document ingestion via API?](https://discuss.elastic.co/t/is-there-a-way-to-prevent-that-new-fields-are-added-to-a-schema-during-document-ingestion-via-api/270373)
**Author:** [@Ralph2021](https://discuss.elastic.co/u/Ralph2021)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 9:46pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-prevent-that-new-fields-are-added-to-a-schema-during-document-ingestion-via-api/270373 "2021-04-16T21:46:04Z")
On a regular basis we see fields appearing in a schema that should not be there. The cause is that if a developer starts ingesting documents they may use the fields or make a typo. The result is that new fields are creat… --- ## [Convert Packetbeat Field Contents to Lowercase](https://discuss.elastic.co/t/convert-packetbeat-field-contents-to-lowercase/270402)
**Author:** [@John\_Collins](https://discuss.elastic.co/u/John_Collins)\ **Replies:** 8\ **Last updated:** [April 16, 2021, 8:31pm UTC](https://discuss.elastic.co/t/convert-packetbeat-field-contents-to-lowercase/270402 "2021-04-16T20:31:58Z")
I am sending DNS queries from a windows DNS server to Logstash via Packetbeat. When I view the contents of the field dns.question.name in Kibana, some entries contain capitalizations. I have tried the following in a Lo… --- ## [How to download data from an elasticsearch index](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-index/269354)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 12\ **Last updated:** [April 16, 2021, 8:29pm UTC](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-index/269354 "2021-04-16T20:29:12Z")
Hi, guy's How can i download all the data of an index in elasticsearch? it downloads the CSV but it does not show all the data, I need to download the whole index, please help me? --- ## [APM Server Docker instance - metricbeat not able to see stats](https://discuss.elastic.co/t/apm-server-docker-instance-metricbeat-not-able-to-see-stats/270414)
**Author:** [@doyelese](https://discuss.elastic.co/u/doyelese)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 7:28pm UTC](https://discuss.elastic.co/t/apm-server-docker-instance-metricbeat-not-able-to-see-stats/270414 "2021-04-16T19:28:04Z")
When following the steps here for my docker instance of apm-server I can't get the local machine to cUrl the exposed http port. On the container I can curl localhost:5067/stats and get a JSON returned, but when I try … --- ## [Ingest ASN.1 binary files](https://discuss.elastic.co/t/ingest-asn-1-binary-files/270411)
**Author:** [@fformoso](https://discuss.elastic.co/u/fformoso)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 7:07pm UTC](https://discuss.elastic.co/t/ingest-asn-1-binary-files/270411 "2021-04-16T19:07:33Z")
Hello! I'm trying to setup an ingest pipeline of CDR files encoded in ASN.1 binary format and load the data in the elastic cluster I've been reading and trying to determine if we have built in tools in Elastic to accom… --- ## [Unknown key for a START\_OBJECT in \[runtime\_mappings\]](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-runtime-mappings/270317)
**Author:** [@plm](https://discuss.elastic.co/u/plm)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 6:20pm UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-runtime-mappings/270317 "2021-04-16T18:20:05Z")
Hi, I am getting the following error: upload completely sent off: 426 out of 426 bytes \< HTTP/1.1 400 Bad Request \< content-type: application/json; charset=UTF-8 \< content-length: 374 \< { “error” : { “ro… --- ## [Logstash monitoring with Metricbeat and cluster\_uuid](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-and-cluster-uuid/270410)
**Author:** [@jasenj1](https://discuss.elastic.co/u/jasenj1)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 5:34pm UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-and-cluster-uuid/270410 "2021-04-16T17:34:04Z")
When configuring Logstash monitoring, the Elastic recommended best practice is to create a cluster dedicated to log and metrics collection. One then configures Metricbeat to collect the monitoring data from Logstash us… --- ## [Query on dense vectors](https://discuss.elastic.co/t/query-on-dense-vectors/270105)
**Author:** [@Yves\_Benigot](https://discuss.elastic.co/u/Yves_Benigot)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 5:56pm UTC](https://discuss.elastic.co/t/query-on-dense-vectors/270105 "2021-04-16T17:56:54Z")
Is there a way to create a query in Kibana discover on dense vectors ? I found nothing in the documentation. I would be willing to compute the query dense vector outside Kibana and paste it to get my results. Currentl… --- ## [Map IP Address to geolocation and use of the anomaly detector](https://discuss.elastic.co/t/map-ip-address-to-geolocation-and-use-of-the-anomaly-detector/270027)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 5:55pm UTC](https://discuss.elastic.co/t/map-ip-address-to-geolocation-and-use-of-the-anomaly-detector/270027 "2021-04-16T17:55:24Z")
Hello everyone, i am using the wazuh software combined with ELK. I get some ip adress from Wazuh and i want to find the corresponding geolocation. How i can do that. Furthermore, i want to use the anomaly detector in or… --- ## [Prioritize recent content by date](https://discuss.elastic.co/t/prioritize-recent-content-by-date/269483)
**Author:** [@Bott\_Radio\_Network](https://discuss.elastic.co/u/Bott_Radio_Network)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 4:44pm UTC](https://discuss.elastic.co/t/prioritize-recent-content-by-date/269483 "2021-04-16T16:44:50Z")
Hi, I'm trying to make newer documents score higher in my search results, similar to this post How to prioritize more recent content? but I'm trying to do it in App Search. I added a proximity boost on the date field cen… --- ## [Too many dynamic script compilations within max](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-within-max/270355)
**Author:** [@IYABAO](https://discuss.elastic.co/u/IYABAO)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 4:42pm UTC](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-within-max/270355 "2021-04-16T16:42:10Z")
\[script\] Too many dynamic script compilations within, max: \[75/5m\]; please use indexed, or scripts with parameters instead; this limit can be changed by the \[script.max\_compilations\_rate\] setting How can I get the dynam… --- ## [How to exclude XML & json key-value if key length is greater than 15 char and value length is greater than 100 char](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 14\ **Last updated:** [April 16, 2021, 4:19pm UTC](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248 "2021-04-16T16:19:18Z")
@Badger I want to exclude XML & json key-value if key length is greater than 15 char and value length is greater than 100 char. Is this possible can you please suggest way for it. --- ## [ConnectionClosedException](https://discuss.elastic.co/t/connectionclosedexception/270348)
**Author:** [@Priyank07](https://discuss.elastic.co/u/Priyank07)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 4:18pm UTC](https://discuss.elastic.co/t/connectionclosedexception/270348 "2021-04-16T16:18:53Z")
When I am trying to connect to elastic from java using HighLevelRestClient it is giving connectionClosed Exception but when I am trying to connect using restTemplate it is getting connected without error. Is it necessar… --- ## [Documents and Reference UI sections not populated](https://discuss.elastic.co/t/documents-and-reference-ui-sections-not-populated/269910)
**Author:** [@mack](https://discuss.elastic.co/u/mack)\ **Replies:** 8\ **Last updated:** [April 16, 2021, 3:20pm UTC](https://discuss.elastic.co/t/documents-and-reference-ui-sections-not-populated/269910 "2021-04-16T15:20:10Z")
Hi all, I've recently set up a linux server running AppSearch with the aim of creating a mini search engine for a project I'm working on. I used the new web crawler to drawl a test set of 10 domains and the crawl went w… --- ## [Cluster state is yellow when configuring minimal security](https://discuss.elastic.co/t/cluster-state-is-yellow-when-configuring-minimal-security/270286)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 6\ **Last updated:** [April 16, 2021, 2:54pm UTC](https://discuss.elastic.co/t/cluster-state-is-yellow-when-configuring-minimal-security/270286 "2021-04-16T14:54:14Z")
Greetings folks, I have a cluster with two nodes (node1 and node2) running ELK 7.12, I activated security feature from this link Set up minimal security for Elasticsearch | Elasticsearch Guide \[7.12\] | Elastic, I follow… --- ## [How to convert extract month from date](https://discuss.elastic.co/t/how-to-convert-extract-month-from-date/270035)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 2:35pm UTC](https://discuss.elastic.co/t/how-to-convert-extract-month-from-date/270035 "2021-04-16T14:35:16Z")
Hi, I have below date format . First\_date : Feb-21 (MMM-yy) Second\_date: 12/02/2021 (MM/dd/yyyy) first, I want new field like below: from first date I need month . so output should be first\_date\_month : 02 second … --- ## [Check input contains.message failed](https://discuss.elastic.co/t/check-input-contains-message-failed/270372)
**Author:** [@joepkemel](https://discuss.elastic.co/u/joepkemel)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 2:33pm UTC](https://discuss.elastic.co/t/check-input-contains-message-failed/270372 "2021-04-16T14:33:09Z")
Hi, I am trying to make an if contains /else dissect statement. But I can't really figure it out. This is because a log file contains an extra '|' inside a wanted field. For example 'type|timestamp|IP\[xx.xx| port\]|-' and… --- ## [Date parse failure](https://discuss.elastic.co/t/date-parse-failure/270276)
**Author:** [@Wilfried](https://discuss.elastic.co/u/Wilfried)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 1:42pm UTC](https://discuss.elastic.co/t/date-parse-failure/270276 "2021-04-16T13:42:12Z")
Hello, I struggle to understand why my date matching is failing. We trying to build a reporting application using elasticsearch for our Storage. I've that kind of data in an XML: \ \ \0\ **Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 1:39pm UTC](https://discuss.elastic.co/t/how-to-configure-multiple-ingest-pipelines-on-filebeat-to-load-data-in-elastic-cloud/270290 "2021-04-16T13:39:30Z") Hi, I am running filebeat to ingest logging data from kubernetes. I am having various applications for which I have set different pipelines. How can I configure filebeat to be able to use multiple pipelines. Thanks in … --- ## [Help me writing watcher Query](https://discuss.elastic.co/t/help-me-writing-watcher-query/270103)
**Author:** [@abhishek\_s1](https://discuss.elastic.co/u/abhishek_s1)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 11:47am UTC](https://discuss.elastic.co/t/help-me-writing-watcher-query/270103 "2021-04-16T11:47:39Z")
Hello, We are defining an activity of user to be suspicious if he logs in after very long period (1 month). So, I need to find if there exists a log entry or request with some username whose last request was \>= 1 month… --- ## [Period system.cpu.total.pct versus system.cpu.total.norm.pct](https://discuss.elastic.co/t/period-system-cpu-total-pct-versus-system-cpu-total-norm-pct/270229)
**Author:** [@\_Manuel](https://discuss.elastic.co/u/_Manuel)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 11:04am UTC](https://discuss.elastic.co/t/period-system-cpu-total-pct-versus-system-cpu-total-norm-pct/270229 "2021-04-16T11:04:10Z")
Hello I have a metricbeat.yml file for system.cpu like metricbeat.modules: - module: system period: 150s metricsets: - cpu - load - memory - network - process - process\_summary cpu.metrics… --- ## [Logstash data load error for a different format data](https://discuss.elastic.co/t/logstash-data-load-error-for-a-different-format-data/270375)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 10:58am UTC](https://discuss.elastic.co/t/logstash-data-load-error-for-a-different-format-data/270375 "2021-04-16T10:58:58Z")
Hi All, We are trying to ingest few data into logstash, the data is pretty different like mentioned below, How do i map the collection\_time with 1618556220 and d\_check to 1 I gave a split filter it didnt work. FYI. … --- ## [Remote cluster not displayed but acknowledged](https://discuss.elastic.co/t/remote-cluster-not-displayed-but-acknowledged/269992)
**Author:** [@pavel.entner](https://discuss.elastic.co/u/pavel.entner)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 8:35am UTC](https://discuss.elastic.co/t/remote-cluster-not-displayed-but-acknowledged/269992 "2021-04-16T08:35:38Z")
Hello, I'm quite new to Elasticsearch. I have installed two Elasticsearch clusters consisting of 3x master node and 3x data node each. On one master node on each cluster I'm running Kibana. I'm using https and transport… --- ## [Oracle Metrics through metricbeat](https://discuss.elastic.co/t/oracle-metrics-through-metricbeat/270182)
**Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 7:42am UTC](https://discuss.elastic.co/t/oracle-metrics-through-metricbeat/270182 "2021-04-16T07:42:40Z")
I am using ELK 7.10 Basic version. I want to get oracle metrics from metricbeat. I enabled oracle module from below command : metricbeat modules enable oracle I installed oracle client and set it's path as system varia… --- ## [Wrong url in uptime UI for ERR\_CERT\_AUTHORITY\_INVALID](https://discuss.elastic.co/t/wrong-url-in-uptime-ui-for-err-cert-authority-invalid/269965)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 7:26am UTC](https://discuss.elastic.co/t/wrong-url-in-uptime-ui-for-err-cert-authority-invalid/269965 "2021-04-16T07:26:26Z")
Hi, I am testing the synthetics package in version 7.12: I have a simple journey that looks like this: - type: browser id: pdl-ui-test name: pdl-ui-test schedule: "@every 1m" source: inline: script… --- ## [Provided Grok patterns do not match data in the input](https://discuss.elastic.co/t/provided-grok-patterns-do-not-match-data-in-the-input/270265)
**Author:** [@Cris\_R](https://discuss.elastic.co/u/Cris_R)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 6:57am UTC](https://discuss.elastic.co/t/provided-grok-patterns-do-not-match-data-in-the-input/270265 "2021-04-16T06:57:17Z")
Hi, Trying to create my own grok patterns, I'm using the following with the Grok Debugger : Sample data : \[ 4812 6032\]\[15 Feb 18:23:15\]\[LdManInit\] Loading Library in Load mode Grok Pattern : %{IDLOG:whom} %{TIMEST:… --- ## [Getting "You do not have permission to access the requested page" after configuring SSO](https://discuss.elastic.co/t/getting-you-do-not-have-permission-to-access-the-requested-page-after-configuring-sso/270301)
**Author:** [@challa](https://discuss.elastic.co/u/challa)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 6:18am UTC](https://discuss.elastic.co/t/getting-you-do-not-have-permission-to-access-the-requested-page-after-configuring-sso/270301 "2021-04-16T06:18:38Z")
Hi, I have configured SSO using the guide here: Configuring SAML single-sign-on on the Elastic Stack | Elasticsearch Guide \[7.12\] | Elastic I also did role mapped my AD group to the role "superuser", when I try to login… --- ## [Vlookup type of thing](https://discuss.elastic.co/t/vlookup-type-of-thing/270298)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 6:01am UTC](https://discuss.elastic.co/t/vlookup-type-of-thing/270298 "2021-04-16T06:01:39Z")
I generate a table of MAC addresses in Kibana. However I’d like to translate the MAC address into a readable name. The MAC, Readable name table is and will forever be static and have and will forever have 50 rows. What’… [Previous page](https://discuss.elastic.co/latest.md?page=1727) [Next page](https://discuss.elastic.co/latest.md?page=1729)