# Latest **URL:** https://discuss.elastic.co/latest.md?page=1729 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1730 --- ## [I have a query regarding dense\_vector in elastic search](https://discuss.elastic.co/t/i-have-a-query-regarding-dense-vector-in-elastic-search/270327)
**Author:** [@Rahul\_Singh](https://discuss.elastic.co/u/Rahul_Singh)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 5:55am UTC](https://discuss.elastic.co/t/i-have-a-query-regarding-dense-vector-in-elastic-search/270327 "2021-04-16T05:55:14Z")
Hi, I am using elastic search using python, i am creating dense\_vector in mapping and then trying to add the feild via python a list of float value e.g - \[1.02,2,1.01..\] and am unable to ad it. the error says cant chan… --- ## [Filebeat failed to collect docker metadata](https://discuss.elastic.co/t/filebeat-failed-to-collect-docker-metadata/270321)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 3:20am UTC](https://discuss.elastic.co/t/filebeat-failed-to-collect-docker-metadata/270321 "2021-04-16T03:20:05Z")
I use filebeat to collect docker container logs. The log is collected by ID, but the corresponding container name cannot be collected. So I tried to add metadata for the docker container, but I couldn't succeed（Auto disc… --- ## [Upgrarding from logstash 5.6.16 to 6.8 results in errors for logstash tcp input plugin](https://discuss.elastic.co/t/upgrarding-from-logstash-5-6-16-to-6-8-results-in-errors-for-logstash-tcp-input-plugin/270316)
**Author:** [@mchoudhary](https://discuss.elastic.co/u/mchoudhary)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 1:19am UTC](https://discuss.elastic.co/t/upgrarding-from-logstash-5-6-16-to-6-8-results-in-errors-for-logstash-tcp-input-plugin/270316 "2021-04-16T01:19:43Z")
After upgrading the logstash version from 5.6.16 to 6.8, the logstash tcp plugin from 4.2.2 to 5.2.2 After upgrade, we do see the following errors in the logstash logs: \[2021-04-16T01:14:50,392\]\[ERROR\]\[logstash.inputs.… --- ## [Kibana unable to query index data from ES](https://discuss.elastic.co/t/kibana-unable-to-query-index-data-from-es/270134)
**Author:** [@GregoryBrown](https://discuss.elastic.co/u/GregoryBrown)\ **Replies:** 10\ **Last updated:** [April 16, 2021, 1:14am UTC](https://discuss.elastic.co/t/kibana-unable-to-query-index-data-from-es/270134 "2021-04-16T01:14:36Z")
I am able to upload the following data into my ES Cluster, and have an index template apply to it. However the default search of kibana (using an index pattern) doesn't query the data. Index Template that gets applied t… --- ## [Display string list returned by scripted field in new line in discovery](https://discuss.elastic.co/t/display-string-list-returned-by-scripted-field-in-new-line-in-discovery/270074)
**Author:** [@yash\_gupta](https://discuss.elastic.co/u/yash_gupta)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 1:13am UTC](https://discuss.elastic.co/t/display-string-list-returned-by-scripted-field-in-new-line-in-discovery/270074 "2021-04-16T01:13:30Z")
Hi, I have a scripted filed returning a list of String, when I am viewing the field in discovery page I can see the values are coming as coma separated but I need them to come in new line. Is there any way to achieve t… --- ## [Distinct Report based on 2 columns (Text Field )](https://discuss.elastic.co/t/distinct-report-based-on-2-columns-text-field/270143)
**Author:** [@Showman](https://discuss.elastic.co/u/Showman)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 1:05am UTC](https://discuss.elastic.co/t/distinct-report-based-on-2-columns-text-field/270143 "2021-04-16T01:05:25Z")
Hello, am new to kibana & elastic am trying to get a simple report from a table that has different status for the same Refrence id as Follows: '''''' { "took": 0, "timed\_out": false, "\_shards": { "total": 1, "su… --- ## [Is metricbeat pod sending right host metadata on kubernetes?](https://discuss.elastic.co/t/is-metricbeat-pod-sending-right-host-metadata-on-kubernetes/270177)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 12:15am UTC](https://discuss.elastic.co/t/is-metricbeat-pod-sending-right-host-metadata-on-kubernetes/270177 "2021-04-16T00:15:49Z")
Hi all! Thanks to you guys that I could deploy metricbeat pods on AWS EKS easily because of yaml file on documentation. I added add\_host\_metadata processor and watched how host os data comes and it was like below: "h… --- ## [Elastic Support Portal beta](https://discuss.elastic.co/t/elastic-support-portal-beta/269304)
**Author:** [@Erwin\_Willemsen](https://discuss.elastic.co/u/Erwin_Willemsen)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 11:16pm UTC](https://discuss.elastic.co/t/elastic-support-portal-beta/269304 "2021-04-15T23:16:14Z")
Hi community, I have received an invite to participate in the Elastic Support beta. I am looking forward to this, however I would like to know if there is an indication of the workload involved. I need this to manage the… --- ## [Kibana- vega: might be kibana vega context issue - querying separate index data](https://discuss.elastic.co/t/kibana-vega-might-be-kibana-vega-context-issue-querying-separate-index-data/269909)
**Author:** [@wangyf2010](https://discuss.elastic.co/u/wangyf2010)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 10:52pm UTC](https://discuss.elastic.co/t/kibana-vega-might-be-kibana-vega-context-issue-querying-separate-index-data/269909 "2021-04-15T22:52:33Z")
I'm using vega to work out my visualization. As you can see, I'm querying "telemetry" index. While if I input via filter (either in dashboard filter field or visualization filter - KQL) by using "appName" field, I foun… --- ## [Problem when activating Flattened field type on Filebeat fields.yml](https://discuss.elastic.co/t/problem-when-activating-flattened-field-type-on-filebeat-fields-yml/270168)
**Author:** [@Laamimech\_Salah](https://discuss.elastic.co/u/Laamimech_Salah)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 2:43am UTC](https://discuss.elastic.co/t/problem-when-activating-flattened-field-type-on-filebeat-fields-yml/270168 "2021-04-15T02:43:00Z")
Hello, We encounter an error like the one in the following example ,when we activate Flattened field type on the template /etc/filebeat/fields.yml : Filebeat version : 7.6.2 Elasticsearch version : 7.6.2 2021-04-15T0… --- ## [Using Fortinet Integration in Logstash](https://discuss.elastic.co/t/using-fortinet-integration-in-logstash/270304)
**Author:** [@b0r1s](https://discuss.elastic.co/u/b0r1s)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 10:17pm UTC](https://discuss.elastic.co/t/using-fortinet-integration-in-logstash/270304 "2021-04-15T22:17:28Z")
Hey everyone o/ I'm using that conf I found on this topic for parsing logs from FortigateFW with Logstash: input { udp { port =\> 514 type =\> "forti\_log" tags =\> \[""\] } } #THE BEGINNING DOESN'T FORMAT TO CODE … --- ## [Issue setting up basic security on Elasticsearch 7.12](https://discuss.elastic.co/t/issue-setting-up-basic-security-on-elasticsearch-7-12/270284)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 8:39pm UTC](https://discuss.elastic.co/t/issue-setting-up-basic-security-on-elasticsearch-7-12/270284 "2021-04-15T20:39:23Z")
I just downloaded Elasticsearch 7.12 and have it configured for basic operation with no security enabled. When I go to enable minimum security as per the documentation - Set up minimal security for Elasticsearch and ena… --- ## [Is it possible to use regexp or wildcard when adding exception to detection rules?](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 8:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204 "2021-04-15T20:22:02Z")
Hi, when adding exceptions to detection rules, is it possible to use regular expressions or wildcards? sometimes executable are started in directories created with random names, or have parameters with other variable p… --- ## [Functionbeat for logs available in S3 bucket](https://discuss.elastic.co/t/functionbeat-for-logs-available-in-s3-bucket/270305)
**Author:** [@Shivani92](https://discuss.elastic.co/u/Shivani92)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 7:55pm UTC](https://discuss.elastic.co/t/functionbeat-for-logs-available-in-s3-bucket/270305 "2021-04-15T19:55:16Z")
Can we use functionbeat to ship logs available in s3 bucket to Elasticsearch? If yes, kindly explain flow and functionbeat configuration a bit. --- ## [How to identify the ip address of application which sends the bulk updates to elasticsearch cluster?](https://discuss.elastic.co/t/how-to-identify-the-ip-address-of-application-which-sends-the-bulk-updates-to-elasticsearch-cluster/270154)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 7\ **Last updated:** [April 15, 2021, 7:32pm UTC](https://discuss.elastic.co/t/how-to-identify-the-ip-address-of-application-which-sends-the-bulk-updates-to-elasticsearch-cluster/270154 "2021-04-15T19:32:45Z")
How to identify the IP address of the application which sends the bulk updates to elasticsearch cluster? --- ## [Email Action for Detection Rule](https://discuss.elastic.co/t/email-action-for-detection-rule/270270)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 7:12pm UTC](https://discuss.elastic.co/t/email-action-for-detection-rule/270270 "2021-04-15T19:12:41Z")
Hi! I wonder if it is possible to change the format of email action using a little bit of html or something close to it. Is there any option? Thank you! --- ## [Weird test configuration problem || log\_file --\> Syslog-ng --\> Logstash --\> another\_file](https://discuss.elastic.co/t/weird-test-configuration-problem-log-file-syslog-ng-logstash-another-file/270253)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 6:58pm UTC](https://discuss.elastic.co/t/weird-test-configuration-problem-log-file-syslog-ng-logstash-another-file/270253 "2021-04-15T18:58:42Z")
Hi All, please ignore the stupid use case as I only use this config for testing purposes. I have an Ubuntu server with installed syslog-ng and Logstash. I'd like to do the following: I have a cronjob that on every min… --- ## [Kibana:getting past login page with selenium](https://discuss.elastic.co/t/kibana-getting-past-login-page-with-selenium/269782)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 14\ **Last updated:** [April 15, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-getting-past-login-page-with-selenium/269782 "2021-04-15T18:20:51Z")
I am trying to get some to some pages in kibana through selenium/crome dirver. I have seen some samples from some time ago where providing the user/pwd in the url worked, but now, if I do this, still gets me to the page … --- ## [Detections coverage of ATT&CK documentation](https://discuss.elastic.co/t/detections-coverage-of-att-ck-documentation/269692)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 5:57pm UTC](https://discuss.elastic.co/t/detections-coverage-of-att-ck-documentation/269692 "2021-04-15T17:57:24Z")
Hi, We are trying to review the ATT&CK coverage for the current detections to help us with creation and coverage of our own ruleset, is there anything available for us to use? Thanks --- ## [Gauges don't display a number for last 5 min, but do display for last 1hr, even though there is data](https://discuss.elastic.co/t/gauges-dont-display-a-number-for-last-5-min-but-do-display-for-last-1hr-even-though-there-is-data/270282)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 5:18pm UTC](https://discuss.elastic.co/t/gauges-dont-display-a-number-for-last-5-min-but-do-display-for-last-1hr-even-though-there-is-data/270282 "2021-04-15T17:18:42Z")
Here's an issue that I'm having a hard time figuring out how to search on. So far I haven't found anyone else describing something similar. Any tips would be appreciated. So, I've configured a gauge based on the memory … --- ## [Logstash - elasticsarch and double quotes](https://discuss.elastic.co/t/logstash-elasticsarch-and-double-quotes/270133)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 11\ **Last updated:** [April 15, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsarch-and-double-quotes/270133 "2021-04-15T16:49:21Z")
Hello I'm trying to ingest logs wich have " in some of their fields as part of a string, I'm trying to scape them with \\ or \\ or \\\\ but no luck, so, is there any way to ingest double quotes from logs into elasticsearch … --- ## [Java::JavaLang::IllegalStateException\` for \`PipelineAction::Create\](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/270034)
**Author:** [@prajawalkp](https://discuss.elastic.co/u/prajawalkp)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 5:42pm UTC](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/270034 "2021-04-13T17:42:40Z")
Hii, I am new to logstash and using logstash to syncup mysql with elasticsearch. But I can't get through this error. Please help. It is urgent. Using JAVA\_HOME defined java: /Library/Java/JavaVirtualMachines/jdk-15.… --- ## [Elastic search fill missing values in aggregation](https://discuss.elastic.co/t/elastic-search-fill-missing-values-in-aggregation/270281)
**Author:** [@Ivan\_Janev](https://discuss.elastic.co/u/Ivan_Janev)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 4:29pm UTC](https://discuss.elastic.co/t/elastic-search-fill-missing-values-in-aggregation/270281 "2021-04-15T16:29:19Z")
I'm doing a sum aggregation in elasticsearch and in the query part I'm using a range filter. Is there anyway to fill missing data when the results come back? To make this more clear I'm going to share the code which is c… --- ## [Filebeat Zeek module doesn’t add ECS fields to zeek logs](https://discuss.elastic.co/t/filebeat-zeek-module-doesn-t-add-ecs-fields-to-zeek-logs/270047)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 4:36pm UTC](https://discuss.elastic.co/t/filebeat-zeek-module-doesn-t-add-ecs-fields-to-zeek-logs/270047 "2021-04-15T16:36:27Z")
Hi all, I followed the official documentation and I’ve changed zeek’s output to json logs but somehow zeek module from Filebeat does’t enrich data with ECS fields. Filebeat sends the logs, but without adding the extra f… --- ## [Valuelists in EQL (correlation) & Threshold Rules](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 4:31pm UTC](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355 "2021-04-15T16:31:25Z")
Why Can't we add value lists as condition in Correlation Rule Type & Threshold Rule Types even in 7.12? We can only add value lists in indicator match type rules. Why? --- ## [Problem with parent-child join](https://discuss.elastic.co/t/problem-with-parent-child-join/270278)
**Author:** [@MarlMan](https://discuss.elastic.co/u/MarlMan)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:46pm UTC](https://discuss.elastic.co/t/problem-with-parent-child-join/270278 "2021-04-15T15:46:30Z")
Hey guys. I have a big data set with many parents and children. My goal is to find out, how many Jo-children each parent has. So I only want to know about children which have Jo as a part of their name (Joel, John, John… --- ## [Elasticsearch doesn't cache query with rounded date](https://discuss.elastic.co/t/elasticsearch-doesnt-cache-query-with-rounded-date/269706)
**Author:** [@tlinhart](https://discuss.elastic.co/u/tlinhart)\ **Replies:** 25\ **Last updated:** [April 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-cache-query-with-rounded-date/269706 "2021-04-15T15:39:48Z")
I originally posted the question to Stack Overflow but I guess it's more appropriate to ask here. (For reference, the original question is here - caching - Elasticsearch doesn't cache query with rounded date - Stack Over… --- ## [Get per process Metrics](https://discuss.elastic.co/t/get-per-process-metrics/270242)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 12\ **Last updated:** [April 15, 2021, 3:33pm UTC](https://discuss.elastic.co/t/get-per-process-metrics/270242 "2021-04-15T15:33:29Z")
Hi, I'm a new user to Elastic and in order to better understand how elastic works, i would like to create a visualisation or canvas that would allow me to compare per process memory usage on my server. More used to SQL… --- ## [JDBC input parameters add quotes to query](https://discuss.elastic.co/t/jdbc-input-parameters-add-quotes-to-query/270271)
**Author:** [@mlnusd](https://discuss.elastic.co/u/mlnusd)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:32pm UTC](https://discuss.elastic.co/t/jdbc-input-parameters-add-quotes-to-query/270271 "2021-04-15T15:32:48Z")
I'm trying to use jdbc input filter to query Oracle DB and to template a schema name. My statement looks like this: select count(1) from :schema.my\_table And my logstash config is like this: input { \[...connection … --- ## [Flattened alternative for OSS verrsion](https://discuss.elastic.co/t/flattened-alternative-for-oss-verrsion/270029)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 3:23pm UTC](https://discuss.elastic.co/t/flattened-alternative-for-oss-verrsion/270029 "2021-04-15T15:23:18Z")
Is there an alternative/workaround for the flattened mapping type to prevent mapping explosion when using OSS elasticsearch version? [Previous page](https://discuss.elastic.co/latest.md?page=1728) [Next page](https://discuss.elastic.co/latest.md?page=1730)