# Latest **URL:** https://discuss.elastic.co/latest.md?page=1741 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1742 --- ## [What is this red dot in index data?](https://discuss.elastic.co/t/what-is-this-red-dot-in-index-data/269612)
**Author:** [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Replies:** 10\ **Last updated:** [April 8, 2021, 8:54pm UTC](https://discuss.elastic.co/t/what-is-this-red-dot-in-index-data/269612 "2021-04-08T20:54:15Z")
Hi I'm seeing this red dot appear in my index data as shown below: This has also been reported by other people here in the discuss section of elasticsearch. See: Here And here In both cases there was nothing rea… --- ## [Using Metricbeat to Monitor MS SQL Server Performance - What Permissions in MS SQL Server?](https://discuss.elastic.co/t/using-metricbeat-to-monitor-ms-sql-server-performance-what-permissions-in-ms-sql-server/267417)
**Author:** [@efaile](https://discuss.elastic.co/u/efaile)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 8:38pm UTC](https://discuss.elastic.co/t/using-metricbeat-to-monitor-ms-sql-server-performance-what-permissions-in-ms-sql-server/267417 "2021-04-08T20:38:43Z")
Instructions tell you how to install metricbeat and enable the MS SQL server module - but I can find no coverage (anywhere - google, elasticsearch, metricbeat docs) on what the required permissions within MS SQL must be … --- ## [Lab 2 Assistance (Observability Fundamentals)](https://discuss.elastic.co/t/lab-2-assistance-observability-fundamentals/268958)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 7:29pm UTC](https://discuss.elastic.co/t/lab-2-assistance-observability-fundamentals/268958 "2021-04-08T19:29:36Z")
I'm stuck at this step, not to much detail is shown to accomplish this. Now, edit filebeat.yml to configure Filebeat to output to your Elastic Cloud deployment. Insert the following two lines at the end of the config fi… --- ## [\[Kibana Enhanced Table\] Cell line / separator](https://discuss.elastic.co/t/kibana-enhanced-table-cell-line-separator/267072)
**Author:** [@uusername](https://discuss.elastic.co/u/uusername)\ **Replies:** 7\ **Last updated:** [April 8, 2021, 7:20pm UTC](https://discuss.elastic.co/t/kibana-enhanced-table-cell-line-separator/267072 "2021-04-08T19:20:32Z")
Hi @fbaligand, I'm very thank you for creating Kibana Enhanced Table Plugin. Can I know if there is a way to achieve to draw the table cell line / separator in this plugin? --- ## [Filebeat fails with connecting to Kibana over GET 127.0.0.1:5601](https://discuss.elastic.co/t/filebeat-fails-with-connecting-to-kibana-over-get-127-0-0-1-5601/269193)
**Author:** [@makrellen](https://discuss.elastic.co/u/makrellen)\ **Replies:** 7\ **Last updated:** [April 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-fails-with-connecting-to-kibana-over-get-127-0-0-1-5601/269193 "2021-04-08T19:10:45Z")
Description of problem I'm trying to get Filebeat to work on my Ubuntu VPS via docker-compose and I've set it up behind my caddy-reverse proxy and configured everything as I should according to the Filebeat docs, but I … --- ## [Questions re Sniffing in Logstash elasticsearch output](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 6:59pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631 "2021-04-08T18:59:47Z")
I'm testing Logstash sniffing in our environment for the Elasticsearch output. So far, it appears to resolve a few issues I've had, but I've got a few questions: sniffing =\> true in my elasticsearch output appears to … --- ## [Logstash Parser error - tried to parse field as object, but found a concrete value](https://discuss.elastic.co/t/logstash-parser-error-tried-to-parse-field-as-object-but-found-a-concrete-value/269140)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 13\ **Last updated:** [April 8, 2021, 6:42pm UTC](https://discuss.elastic.co/t/logstash-parser-error-tried-to-parse-field-as-object-but-found-a-concrete-value/269140 "2021-04-08T18:42:57Z")
Hi, I am trying to parse a log but i have this error. \[source\] tried to parse field \[source\] as object, but found a concrete value if "string" in \[tags\] { grok { match =\> \[ "message", "(?\ **Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 5:51pm UTC](https://discuss.elastic.co/t/epoch-to-readable-timestamp/269623 "2021-04-08T17:51:52Z") Hello guys. Hope you are doing well. Im having a little problem trying to convert an event time in epoch to a readable timestamp, per example in UTC. So, the log that i have is something like this: event\_time=1613523… --- ## [Same Snap Repository, Less Snaps](https://discuss.elastic.co/t/same-snap-repository-less-snaps/269364)
**Author:** [@glimmbo](https://discuss.elastic.co/u/glimmbo)\ **Replies:** 7\ **Last updated:** [April 8, 2021, 5:48pm UTC](https://discuss.elastic.co/t/same-snap-repository-less-snaps/269364 "2021-04-08T17:48:50Z")
Using AWS ES Service, with repository-s3 plugin, I have two instances, launched with the same settings. I register the same snap repo successfully, but when I GET /\_cat/snapshots/repo\_name?v the second instance (created … --- ## [Elasticsearch stuck applyingchanges and reconciliation ended with failed predicates](https://discuss.elastic.co/t/elasticsearch-stuck-applyingchanges-and-reconciliation-ended-with-failed-predicates/268954)
**Author:** [@fozzylyon](https://discuss.elastic.co/u/fozzylyon)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 5:04pm UTC](https://discuss.elastic.co/t/elasticsearch-stuck-applyingchanges-and-reconciliation-ended-with-failed-predicates/268954 "2021-04-08T17:04:28Z")
ECK 1.0.1 k8s 1.16.9 The ECK operator's been stellar. But I ran into trouble deploying node resource and count changes at the same time. In one cluster, it seems to have worked as expected, but in another the elastic… --- ## [Composite Query and Aggregation results different doc\_count value](https://discuss.elastic.co/t/composite-query-and-aggregation-results-different-doc-count-value/269626)
**Author:** [@amr1](https://discuss.elastic.co/u/amr1)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 4:41pm UTC](https://discuss.elastic.co/t/composite-query-and-aggregation-results-different-doc-count-value/269626 "2021-04-08T16:41:57Z")
I am trying to query on my data set with composite query. Here is my Query 1: curl -X POST "localhost:9200/index1-202103/\_search?size=0&pretty" -H 'Content-Type: application/json' -d' { "query": {"bool": {"filter": \[{ … --- ## [Intake very slow (more than 10secondes)](https://discuss.elastic.co/t/intake-very-slow-more-than-10secondes/269558)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 4:21pm UTC](https://discuss.elastic.co/t/intake-very-slow-more-than-10secondes/269558 "2021-04-08T16:21:29Z")
Elastic stack version 7.12.0 with Platinium licence APM Agent language and version: nodeJS - 3.X (latest) Run on k8s. Our nodeJS application complains about timeout when sending APM events to intake API. I setup instr… --- ## [Unable to access https://localhost:9200, issue with Elastic User](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510)
**Author:** [@Bbruteforce](https://discuss.elastic.co/u/Bbruteforce)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 4:19pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510 "2021-04-08T16:19:38Z")
Hello Team, I am trying to send data from Wazuh Manager to Elasticsearch via Filebeat over port 9200. In the "Discover" tab of Kibana i see no data , even though the agent seems to sending data properly to manager I se… --- ## [Watcher - display for each bucket, its corresponding sub buckets results](https://discuss.elastic.co/t/watcher-display-for-each-bucket-its-corresponding-sub-buckets-results/269620)
**Author:** [@toms130](https://discuss.elastic.co/u/toms130)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 4:00pm UTC](https://discuss.elastic.co/t/watcher-display-for-each-bucket-its-corresponding-sub-buckets-results/269620 "2021-04-08T16:00:43Z")
Hi there, I've a query result like this : "aggregations": { "backend": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_doc\_count": 0, "buckets": \[ … --- ## [XML parser, alter field](https://discuss.elastic.co/t/xml-parser-alter-field/269415)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 3:55pm UTC](https://discuss.elastic.co/t/xml-parser-alter-field/269415 "2021-04-08T15:55:29Z")
Hi, I have this setup for XML parser: xml { source =\> "message" target =\> "xml" add\_field =\> { Audit\_Type =\> "%{\[xml\]\[Audit\_Type\]}" Ext\_Name … --- ## [Kibana Road Map layer is not showing](https://discuss.elastic.co/t/kibana-road-map-layer-is-not-showing/269574)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 3:49pm UTC](https://discuss.elastic.co/t/kibana-road-map-layer-is-not-showing/269574 "2021-04-08T15:49:46Z")
I am using elk stack 7.11 , the road map layer is not showing --- ## [Clickable URL kibana 7.11](https://discuss.elastic.co/t/clickable-url-kibana-7-11/269476)
**Author:** [@Chaimaa\_ABD](https://discuss.elastic.co/u/Chaimaa_ABD)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 3:47pm UTC](https://discuss.elastic.co/t/clickable-url-kibana-7-11/269476 "2021-04-08T15:47:52Z")
How to display a field as a clickable URL in data table visualization in kibana 7.11 ? I tried to format the field but it doesn't work --- ## [Show all unique values](https://discuss.elastic.co/t/show-all-unique-values/269606)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 3:30pm UTC](https://discuss.elastic.co/t/show-all-unique-values/269606 "2021-04-08T15:30:00Z")
I have a field and I need to get all unique values by this field in table or something else. Does it have some tools for it ? --- ## [Mapping in App search / Search ui](https://discuss.elastic.co/t/mapping-in-app-search-search-ui/269571)
**Author:** [@Nadir\_Ait\_Lahmouch](https://discuss.elastic.co/u/Nadir_Ait_Lahmouch)\ **Replies:** 2\ **Last updated:** [April 8, 2021, 3:28pm UTC](https://discuss.elastic.co/t/mapping-in-app-search-search-ui/269571 "2021-04-08T15:28:39Z")
Hello, I am trying to build a frontend using React (Search ui) and app search as a backend. So iwas succeful in indexing my documents but i have some questions regarding the mapping. How can we look into the mapping and… --- ## [Functionbeat environment variables](https://discuss.elastic.co/t/functionbeat-environment-variables/269617)
**Author:** [@sce81](https://discuss.elastic.co/u/sce81)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 3:08pm UTC](https://discuss.elastic.co/t/functionbeat-environment-variables/269617 "2021-04-08T15:08:17Z")
Hi, i am wondering if it is possible to override the functionbeat.yml parameters using environment variables? eg: i want to send to elasticsearch with credentials stored as encrypted env vars, but i want this configured… --- ## [Field contains CSV want to extract to array of strings](https://discuss.elastic.co/t/field-contains-csv-want-to-extract-to-array-of-strings/269494)
**Author:** [@ian351c](https://discuss.elastic.co/u/ian351c)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 3:00pm UTC](https://discuss.elastic.co/t/field-contains-csv-want-to-extract-to-array-of-strings/269494 "2021-04-08T15:00:36Z")
Hello all, I am working on migrating from Splunk to ELK for my Palo Alto Networks firewall logs using the pre-built processor in Filebeat. The pipeline is Syslog \> Filebeat \> Elastic. The PANW logs contain two separate … --- ## [AWS NLB config infront of FileBeats Instance](https://discuss.elastic.co/t/aws-nlb-config-infront-of-filebeats-instance/269065)
**Author:** [@Ravi342883](https://discuss.elastic.co/u/Ravi342883)\ **Replies:** 6\ **Last updated:** [April 8, 2021, 2:46pm UTC](https://discuss.elastic.co/t/aws-nlb-config-infront-of-filebeats-instance/269065 "2021-04-08T14:46:40Z")
Hi All, I'm trying to setup a AWS Network Load Balancer (NLB) in-front of Filebeat instance. Need help in 1. How to configure the NLB & 2. How to do health check in NLB. Note: This setup is to collect the logs from v… --- ## [Elasticsearch Autoscaling](https://discuss.elastic.co/t/elasticsearch-autoscaling/269454)
**Author:** [@Mkian](https://discuss.elastic.co/u/Mkian)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 2:39pm UTC](https://discuss.elastic.co/t/elasticsearch-autoscaling/269454 "2021-04-08T14:39:42Z")
With the introduction of Autoscaling on Elastic cloud, does anyone know if Scale In is also in place? Or it's just adding more nodes? --- ## [Snapshot got stuck in IN\_PROGRESS state](https://discuss.elastic.co/t/snapshot-got-stuck-in-in-progress-state/269595)
**Author:** [@akshatsharma](https://discuss.elastic.co/u/akshatsharma)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 2:20pm UTC](https://discuss.elastic.co/t/snapshot-got-stuck-in-in-progress-state/269595 "2021-04-08T14:20:27Z")
Hi, We noticed that one of our snapshots is stuck in IN\_PROGRESS state for a while now: GET \_cat/snapshots/es\_backup es-snapshot-1 SUCCESS 1615184123 06:15:23 1615184133 06:15:33 9.4s 17 17 0 17 es-snapshot-2 S… --- ## [Filebeat Cisco Module Nexus dissect\_parsing\_error](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662)
**Author:** [@vqjanderson](https://discuss.elastic.co/u/vqjanderson)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 2:15pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662 "2021-04-08T14:15:26Z")
Not sure why these logs are not being parsed correctly. Are the optimized access logging logs not supported by the module? --- ## [Logstash](https://discuss.elastic.co/t/logstash/268923)
**Author:** [@wpr](https://discuss.elastic.co/u/wpr)\ **Replies:** 2\ **Last updated:** [April 8, 2021, 2:12pm UTC](https://discuss.elastic.co/t/logstash/268923 "2021-04-08T14:12:25Z")
Hi, I am using Logstash to migrate data from ES 5.6 to ES 7.9. I am aware of the changes between those versions. I have the following mapping for a document in 5.6: "transaction\_information": { … --- ## [Elastic No mapping found for \[\_shard\_doc\] in order to sort on](https://discuss.elastic.co/t/elastic-no-mapping-found-for-shard-doc-in-order-to-sort-on/268188)
**Author:** [@111452](https://discuss.elastic.co/u/111452)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 2:11pm UTC](https://discuss.elastic.co/t/elastic-no-mapping-found-for-shard-doc-in-order-to-sort-on/268188 "2021-04-08T14:11:32Z")
I'm trying to use search after parameter in the query to retrieve the next page as it says in Paginate search results | Elasticsearch Reference \[7.12\] | Elastic. If I sort it like "sort": \[ {"@timestamp": "asc"}, … --- ## [Does Search Alert in 7.12 include query?](https://discuss.elastic.co/t/does-search-alert-in-7-12-include-query/269572)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 2:10pm UTC](https://discuss.elastic.co/t/does-search-alert-in-7-12-include-query/269572 "2021-04-08T14:10:36Z")
Dear all =) When I read the summary for https://github.com/elastic/kibana/pull/88528 it says New stack alert for executing ES DSL (query only, no aggregation support) and evaluating the number of matches against a thr… --- ## [Remote Access Available But Local Access Not Available](https://discuss.elastic.co/t/remote-access-available-but-local-access-not-available/268752)
**Author:** [@sewox](https://discuss.elastic.co/u/sewox)\ **Replies:** 22\ **Last updated:** [April 8, 2021, 1:53pm UTC](https://discuss.elastic.co/t/remote-access-available-but-local-access-not-available/268752 "2021-04-08T13:53:43Z")
Hi Everyone, I can access it remotely elasticsearch but I can't access local with PHP driver. \ **Author:** [@AneskaFrisbib](https://discuss.elastic.co/u/AneskaFrisbib)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 1:05pm UTC](https://discuss.elastic.co/t/dot-in-field-names-in-es7-11/269588 "2021-04-08T13:05:31Z") Hello, I currently have the same problem as the one described here : How to handle dot in field names in ES 7.0 Unfortunately, I can't modify the document field names as suggested in the last update. Is there any othe… [Previous page](https://discuss.elastic.co/latest.md?page=1740) [Next page](https://discuss.elastic.co/latest.md?page=1742)