# Latest **URL:** https://discuss.elastic.co/latest.md?page=1735 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1736 --- ## [Filebeat Autodiscover Issue](https://discuss.elastic.co/t/filebeat-autodiscover-issue/269970)
**Author:** [@danielc](https://discuss.elastic.co/u/danielc)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 8:19am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-issue/269970 "2021-04-13T08:19:04Z")
Some errors occurred when I had below filebeat config. How can I fix the issue? org.elasticsearch.index.mapper.MapperParsingException: object mapping for \[json\] tried to parse field \[json\] as object, but found a concret… --- ## [Retrive File logs from remote server using file beat without deploying filebeat to remote server](https://discuss.elastic.co/t/retrive-file-logs-from-remote-server-using-file-beat-without-deploying-filebeat-to-remote-server/269894)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 8:17am UTC](https://discuss.elastic.co/t/retrive-file-logs-from-remote-server-using-file-beat-without-deploying-filebeat-to-remote-server/269894 "2021-04-13T08:17:39Z")
Hi Team, We have requirement of retrieving file logs from multiple remote server . Remote server will put the file logs in specific folder location , we need to retrieve those logs and share it in Log stash for further… --- ## [How Can I Control JSON Parsing Depth?](https://discuss.elastic.co/t/how-can-i-control-json-parsing-depth/269969)
**Author:** [@danielc](https://discuss.elastic.co/u/danielc)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 8:16am UTC](https://discuss.elastic.co/t/how-can-i-control-json-parsing-depth/269969 "2021-04-13T08:16:50Z")
In Decode JSON fields | Filebeat Reference \[7.12\] | Elastic max\_depth (Optional) The maximum parsing depth. A value of 1 will decode the JSON objects in fields indicated in fields, a value of 2 will also decode the obj… --- ## [Logstash Runs And Does Nothing](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932)
**Author:** [@baklavadeseni](https://discuss.elastic.co/u/baklavadeseni)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 8:16am UTC](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932 "2021-04-13T08:16:39Z")
Hi there, I have simple file input/output logstash pipeline. Logstash runs but does nothing. There is no output. In logstash log file only suspicious thing is this "One or more required cgroup files or directories not f… --- ## [Filebeat Ingests K8S Older Logs](https://discuss.elastic.co/t/filebeat-ingests-k8s-older-logs/269950)
**Author:** [@danielc](https://discuss.elastic.co/u/danielc)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 8:15am UTC](https://discuss.elastic.co/t/filebeat-ingests-k8s-older-logs/269950 "2021-04-13T08:15:06Z")
I'm using beats/filebeat-kubernetes.yaml at v7.8.1 · elastic/beats · GitHub to ingest K8S. There have been 2 issues: Filebeat picks up older logs when there is an other application deployment and generates old indices … --- ## [Event Correlation detection - tiebreaker field](https://discuss.elastic.co/t/event-correlation-detection-tiebreaker-field/269974)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 8:12am UTC](https://discuss.elastic.co/t/event-correlation-detection-tiebreaker-field/269974 "2021-04-13T08:12:10Z")
Hi, I need to use a tiebreaker field within an Event Correlation detection rule, I cannot find in the docs other than for a query, hoping its possible somehow Thanks --- ## [Winlogbeat setup error: x509 certificate is valid for \, not \](https://discuss.elastic.co/t/winlogbeat-setup-error-x509-certificate-is-valid-for-ip-not-same-ip/269176)
**Author:** [@Michlol\_502](https://discuss.elastic.co/u/Michlol_502)\ **Replies:** 6\ **Last updated:** [April 13, 2021, 7:44am UTC](https://discuss.elastic.co/t/winlogbeat-setup-error-x509-certificate-is-valid-for-ip-not-same-ip/269176 "2021-04-13T07:44:43Z")
I'm trying to send logs from Winlogbeat to my ELK stack. I did everything according to the official guide and it worked for my host. However, when copying the same winlogbeat directory to my Event Collector server, it di… --- ## [Display image from rows on kibana](https://discuss.elastic.co/t/display-image-from-rows-on-kibana/269927)
**Author:** [@erwan22](https://discuss.elastic.co/u/erwan22)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 7:32am UTC](https://discuss.elastic.co/t/display-image-from-rows-on-kibana/269927 "2021-04-13T07:32:17Z")
Hello, I have a DataFrame (100 rows) in which i have a column dedicated to base64 encoded image. I have uploaded this dataframe in elastic and i'm able to visualise all the images in the "Discover" section for each row… --- ## [Watcher alert syntax error](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 6:14am UTC](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920 "2021-04-13T06:14:03Z")
Hello, I have the following watcher alert code. I simply want to check if 2 specific messages (at least 1 out of 2) exist in the message field of a certain facility named: galaxus-service. BUT i get the syntax er… --- ## [Hot warm architecture in ES](https://discuss.elastic.co/t/hot-warm-architecture-in-es/269915)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 6:12am UTC](https://discuss.elastic.co/t/hot-warm-architecture-in-es/269915 "2021-04-13T06:12:22Z")
How to configure Hot warm architecture of elastic serach in kubernetes cluster? Is this comes under community edition or x-pack? Could you please share urls to configure. --- ## [Plot only documents with the latest time](https://discuss.elastic.co/t/plot-only-documents-with-the-latest-time/269800)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 5:42am UTC](https://discuss.elastic.co/t/plot-only-documents-with-the-latest-time/269800 "2021-04-13T05:42:46Z")
I have an index in with time field, and for each time there are multiple documents. I want to present only the results of the latest time. how can I do it? Is there a way to calculate the maximum value of the time fiel… --- ## [Kibana visualization built with context of other logs](https://discuss.elastic.co/t/kibana-visualization-built-with-context-of-other-logs/269745)
**Author:** [@mbrad](https://discuss.elastic.co/u/mbrad)\ **Replies:** 4\ **Last updated:** [April 13, 2021, 4:39am UTC](https://discuss.elastic.co/t/kibana-visualization-built-with-context-of-other-logs/269745 "2021-04-13T04:39:05Z")
Hello - My team is using ElasticSearch/Kibana for security metric related things and we are having trouble with a specific use case: When a finding is open, a document is created with alerts.status:open associated to t… --- ## [Issues with Canvas when using a time filter](https://discuss.elastic.co/t/issues-with-canvas-when-using-a-time-filter/269958)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 5\ **Last updated:** [April 13, 2021, 3:48am UTC](https://discuss.elastic.co/t/issues-with-canvas-when-using-a-time-filter/269958 "2021-04-13T03:48:47Z")
Hi there! I have a Canvas workpad with a few charts (metrics, horizontal bars, pie) that was working fine until I added a time filter. I added the time filter to take advantage of a timelion query I already have on the … --- ## [How Do I Change The Format Of A Metric/File Beat Log Field?](https://discuss.elastic.co/t/how-do-i-change-the-format-of-a-metric-file-beat-log-field/269723)
**Author:** [@kss](https://discuss.elastic.co/u/kss)\ **Replies:** 6\ **Last updated:** [April 13, 2021, 3:22am UTC](https://discuss.elastic.co/t/how-do-i-change-the-format-of-a-metric-file-beat-log-field/269723 "2021-04-13T03:22:21Z")
I am using ElasticSearch FileBeat and MetricBeat to provide logging for my apps. I am using Grafana to visualize this log data. I do have a question though regarding the host.hostname field.... This field is storing t… --- ## [Can Significant text aggregation work on copy\_to fields](https://discuss.elastic.co/t/can-significant-text-aggregation-work-on-copy-to-fields/269908)
**Author:** [@sj12345](https://discuss.elastic.co/u/sj12345)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 3:14am UTC](https://discuss.elastic.co/t/can-significant-text-aggregation-work-on-copy-to-fields/269908 "2021-04-13T03:14:34Z")
I want to do a significant text aggregation on a field which was copied from few other fields (i.e. its a copy\_to field) "combined\_fields" : { "type" : "text", "store" : true, "norms" : fa… --- ## [Kibana - APM UI - selected trace cannot be found](https://discuss.elastic.co/t/kibana-apm-ui-selected-trace-cannot-be-found/268030)
**Author:** [@chandra2037](https://discuss.elastic.co/u/chandra2037)\ **Replies:** 6\ **Last updated:** [April 13, 2021, 2:31am UTC](https://discuss.elastic.co/t/kibana-apm-ui-selected-trace-cannot-be-found/268030 "2021-04-13T02:31:22Z")
Hi, Elasticsearch - v7.10.1 Kibana - V7.10.1 APM Server - V7.10.1 For some of the transactions in APM UI - Kibana is not showing the trace information, but instead it is showing the following message The selected tr… --- ## [Kibana visualization custom count column in table](https://discuss.elastic.co/t/kibana-visualization-custom-count-column-in-table/269925)
**Author:** [@kibanaUser3](https://discuss.elastic.co/u/kibanaUser3)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 2:23am UTC](https://discuss.elastic.co/t/kibana-visualization-custom-count-column-in-table/269925 "2021-04-13T02:23:24Z")
I'd like to create visualization for IIS logs group by urls with following strucutre url, total count, total count of urls with 500 status code, total count of urls with status code 200 How do I configure the Metric: C… --- ## [Сравнение значений полей в Grafana](https://discuss.elastic.co/t/grafana/269962)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 2:14am UTC](https://discuss.elastic.co/t/grafana/269962 "2021-04-13T02:14:00Z")
Есть 2 Datasources с индексами Elasticsearch в Grafana. Оба источника данных располагаются на 1 сервере с Elastic. Необходимо получить количество документов в которых совпадают значения полей (сравнить документы разных … --- ## [Detection-Rules - Subtechniques](https://discuss.elastic.co/t/detection-rules-subtechniques/269658)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 1:47am UTC](https://discuss.elastic.co/t/detection-rules-subtechniques/269658 "2021-04-13T01:47:59Z")
As I understand from the official GitHub repository for detection-rules, sub-techniques are already used as part of the existing rules. One example can be found here. However, from what I see in the latest guide, it is … --- ## [Value Lists as Exception in Threshold and Correlation type rules](https://discuss.elastic.co/t/value-lists-as-exception-in-threshold-and-correlation-type-rules/268353)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 1:20am UTC](https://discuss.elastic.co/t/value-lists-as-exception-in-threshold-and-correlation-type-rules/268353 "2021-04-13T01:20:53Z")
Why Can't we add value list as exception for Threshold rules and correlation rules even in 7.12? --- ## [Csv filter plugin not working](https://discuss.elastic.co/t/csv-filter-plugin-not-working/268777)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 28\ **Last updated:** [April 13, 2021, 1:07am UTC](https://discuss.elastic.co/t/csv-filter-plugin-not-working/268777 "2021-04-13T01:07:06Z")
I would like to use logstash to format my logs. Specifically, I have a log with the following format format: timestamp \[thread-name\] log-level class-name - log-message example: 2021-03-30 09:38:20.201 \[ConnectionChe… --- ## [Удаление пробелов из поля в LS](https://discuss.elastic.co/t/ls/269957)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 12:43am UTC](https://discuss.elastic.co/t/ls/269957 "2021-04-13T00:43:48Z")
Здравствуйте. Хочу удалить пробелы из поля filed. Сейчас поле содержит следующее значение: "val1 2 3". Хочу, чтобы было так: "val123". Пробовал так: filter { mutate { gsub =\> \["field"," ",""\] } } Также пробо… --- ## [Does logstash use openssl?](https://discuss.elastic.co/t/does-logstash-use-openssl/269827)
**Author:** [@TakaSeki](https://discuss.elastic.co/u/TakaSeki)\ **Replies:** 4\ **Last updated:** [April 13, 2021, 12:41am UTC](https://discuss.elastic.co/t/does-logstash-use-openssl/269827 "2021-04-13T00:41:09Z")
Does logstash use openssl when using the SSL / TLS protocol? If so, where can I find the version of openssl? --- ## [Observability/Logs works only with modules?](https://discuss.elastic.co/t/observability-logs-works-only-with-modules/269953)
**Author:** [@UltimateOrb](https://discuss.elastic.co/u/UltimateOrb)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 12:22am UTC](https://discuss.elastic.co/t/observability-logs-works-only-with-modules/269953 "2021-04-13T00:22:38Z")
I have a log file in json format. Each line is a separate message. I can parse the log and send it to elastic. But I don't understand how to output it to Observability/Logs --- ## [Replace the @TimeStamp with actual time during a bulk Filebeat Send](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 3\ **Last updated:** [April 12, 2021, 11:22pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882 "2021-04-12T23:22:37Z")
Hi, We are collecting a large amount of logs through out the day and then sending them at 4:30am via Filebeat in a bulk send. The problem is when they end up in Elasticsearch/Kibana all the @TimeStamp fields are 4:30am… --- ## [Unable to setup an alert on log data not received from host for last 1 hour](https://discuss.elastic.co/t/unable-to-setup-an-alert-on-log-data-not-received-from-host-for-last-1-hour/269459)
**Author:** [@elango1](https://discuss.elastic.co/u/elango1)\ **Replies:** 2\ **Last updated:** [April 12, 2021, 10:53pm UTC](https://discuss.elastic.co/t/unable-to-setup-an-alert-on-log-data-not-received-from-host-for-last-1-hour/269459 "2021-04-12T22:53:03Z")
Hi , I am trying to setup an alert when a host has stopped sending logs. I would like to group by hosts and check if log count is zero. The UI is mandating at least 1 condition. Tried setting host.name is , but it liter… --- ## [Update vs Reindex](https://discuss.elastic.co/t/update-vs-reindex/269929)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 10:04pm UTC](https://discuss.elastic.co/t/update-vs-reindex/269929 "2021-04-12T22:04:31Z")
Hello, I am evaluating a few ways of organizing my indices. One of the questions I had was generally speaking, what is the difference in overhead(if any) between updating a document within an index vs using the reindex … --- ## ["Azure Excessive Signin Logs by Azure Identity" unusable azure.signinlogs.identity](https://discuss.elastic.co/t/azure-excessive-signin-logs-by-azure-identity-unusable-azure-signinlogs-identity/269708)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 9:55pm UTC](https://discuss.elastic.co/t/azure-excessive-signin-logs-by-azure-identity-unusable-azure-signinlogs-identity/269708 "2021-04-12T21:55:03Z")
Hello, Just noticed that in the rule "Azure Excessive Signin Logs by Azure Identity" it seems impossible to display the field azure.signinlogs.identity, which is not very user friendly and a waste of time to lookup afte… --- ## [APM Server throwing frequent connection failures against Kibana](https://discuss.elastic.co/t/apm-server-throwing-frequent-connection-failures-against-kibana/269949)
**Author:** [@j-chao](https://discuss.elastic.co/u/j-chao)\ **Replies:** 0\ **Last updated:** [April 12, 2021, 9:14pm UTC](https://discuss.elastic.co/t/apm-server-throwing-frequent-connection-failures-against-kibana/269949 "2021-04-12T21:14:00Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [Issue with Date with Python importing data into Elastic](https://discuss.elastic.co/t/issue-with-date-with-python-importing-data-into-elastic/269918)
**Author:** [@fallenour](https://discuss.elastic.co/u/fallenour)\ **Replies:** 0\ **Last updated:** [April 12, 2021, 5:07pm UTC](https://discuss.elastic.co/t/issue-with-date-with-python-importing-data-into-elastic/269918 "2021-04-12T17:07:37Z")
Hey I have a quick issue regarding using python to connect to elastic. When I go to import data as a date field, its giving me a time error due to time format, but Ive tried everything, including datestamp instead of jus… [Previous page](https://discuss.elastic.co/latest.md?page=1734) [Next page](https://discuss.elastic.co/latest.md?page=1736)