# Latest **URL:** https://discuss.elastic.co/latest.md?page=1753 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1754 --- ## [How to create time series bar with site names in y-axis](https://discuss.elastic.co/t/how-to-create-time-series-bar-with-site-names-in-y-axis/267700)
**Author:** [@Dvir\_Alony](https://discuss.elastic.co/u/Dvir_Alony)\ **Replies:** 12\ **Last updated:** [April 1, 2021, 4:24pm UTC](https://discuss.elastic.co/t/how-to-create-time-series-bar-with-site-names-in-y-axis/267700 "2021-04-01T16:24:41Z")
Hi, I would like to create time series bar with site names in y-axis. For each site there will be a horizontal line representing the validity of the site with colors (green, yellow, red) according to the relevant time. … --- ## [APM-Server ILM policy is not applied](https://discuss.elastic.co/t/apm-server-ilm-policy-is-not-applied/268960)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 3:58pm UTC](https://discuss.elastic.co/t/apm-server-ilm-policy-is-not-applied/268960 "2021-04-01T15:58:17Z")
I have APM Server running with following error apm-server.yml# Source : https://github.com/elastic/apm-server/blob/master/apm-server.docker.yml ################################ APM Server ###############################… --- ## [Watcher email and slack failing](https://discuss.elastic.co/t/watcher-email-and-slack-failing/268854)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 14\ **Last updated:** [April 1, 2021, 3:33pm UTC](https://discuss.elastic.co/t/watcher-email-and-slack-failing/268854 "2021-04-01T15:33:19Z")
Hello, I am trying to configure slack and email action in watcher on my ES and Kibana 7.12 installed on Amazon Linux AMI. below are my slack settings (plus webhook url in keystore): xpack.notification.slack: default… --- ## [Elastic APM does not support the Otel Span Events. is there an alternative?](https://discuss.elastic.co/t/elastic-apm-does-not-support-the-otel-span-events-is-there-an-alternative/269020)
**Author:** [@ayada\_yassine](https://discuss.elastic.co/u/ayada_yassine)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 3:12pm UTC](https://discuss.elastic.co/t/elastic-apm-does-not-support-the-otel-span-events-is-there-an-alternative/269020 "2021-04-01T15:12:15Z")
I want to use span events to attach my logs to my span, Elastic Apm ignore opentelemetry exported span events. is there an alternative ? OpenTelemetry Span Events: opentelemetry-specification/api.md at main · open-tel… --- ## [Pipeline stopped due to database recovery](https://discuss.elastic.co/t/pipeline-stopped-due-to-database-recovery/268983)
**Author:** [@Dhruv\_Rank](https://discuss.elastic.co/u/Dhruv_Rank)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 3:05pm UTC](https://discuss.elastic.co/t/pipeline-stopped-due-to-database-recovery/268983 "2021-04-01T15:05:52Z")
Hello,I am new to this and everyday I got same issue \[2021-03-31T19:28:00,364\]\[ERROR\]\[logstash.inputs.jdbc \]\[add-jobs\] Unable to connect to database. Tried 1 times {:error\_message=\>"Java::OrgPostgresqlUtil::PSQLExcepti… --- ## [Dynamic input for logstash](https://discuss.elastic.co/t/dynamic-input-for-logstash/269004)
**Author:** [@igorid70](https://discuss.elastic.co/u/igorid70)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 2:55pm UTC](https://discuss.elastic.co/t/dynamic-input-for-logstash/269004 "2021-04-01T14:55:09Z")
Hi I have a use case when my logstash pipeline generates output based on which I want to initiate another logstash pipeline with input based on that output. In more details: the current pipeline uses a command input th… --- ## [Changing logstash jdbc statement](https://discuss.elastic.co/t/changing-logstash-jdbc-statement/269037)
**Author:** [@Gregorkosmina](https://discuss.elastic.co/u/Gregorkosmina)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 2:53pm UTC](https://discuss.elastic.co/t/changing-logstash-jdbc-statement/269037 "2021-04-01T14:53:13Z")
I want to change SQL statement in my logstash, so I would fill index with newely queried data. I re-run logstash with new statement but my index still contains old data. Am I missing something? --- ## [Geoip cache\_size # relates to + flush frequency?](https://discuss.elastic.co/t/geoip-cache-size-relates-to-flush-frequency/269007)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 2:52pm UTC](https://discuss.elastic.co/t/geoip-cache-size-relates-to-flush-frequency/269007 "2021-04-01T14:52:05Z")
Hi, The default is cache\_size for geoip is documented at 1000. Is that 1000 IPs, bytes/kb? Also with pereodic\_flush:false (default), when does this flush? Tracing down a mismatch IP where going back a month up until … --- ## [Does Elasticsearch 7.11 not supported by ECK operator](https://discuss.elastic.co/t/does-elasticsearch-7-11-not-supported-by-eck-operator/268984)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 2:44pm UTC](https://discuss.elastic.co/t/does-elasticsearch-7-11-not-supported-by-eck-operator/268984 "2021-04-01T14:44:07Z")
Hi, I trying to deploy the Elasticsearch 7.11.0 version cluster using eck operator 1.3 version, it fails in init container elastic-internal-init-filesystem . It says unsupported\_distribution Is 7.11 version not suppor… --- ## [Need to get the list of hosts not sending the logs to kibana](https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922)
**Author:** [@mbm\_wfm](https://discuss.elastic.co/u/mbm_wfm)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 2:41pm UTC](https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922 "2021-04-01T14:41:50Z")
Hi, I need to get list of hosts not sending logs over two days for example, a query with kibana would be awesome! --- ## [How to filter logs coming from filebeat and apply a filter on message](https://discuss.elastic.co/t/how-to-filter-logs-coming-from-filebeat-and-apply-a-filter-on-message/267694)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 2:32pm UTC](https://discuss.elastic.co/t/how-to-filter-logs-coming-from-filebeat-and-apply-a-filter-on-message/267694 "2021-04-01T14:32:49Z")
Hi Folks, I am using Logstash 7.8 version and i will be getting logs from multiple data sources as part of my requirement. I wanted to apply a filter on my log message coming from filebeat and containing the string "pa… --- ## [Help needed on winlogbeat](https://discuss.elastic.co/t/help-needed-on-winlogbeat/269041)
**Author:** [@Ashish\_Lal](https://discuss.elastic.co/u/Ashish_Lal)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 2:18pm UTC](https://discuss.elastic.co/t/help-needed-on-winlogbeat/269041 "2021-04-01T14:18:45Z")
Hello there, I am new to winlogbeat and elastic stack. I have installed winlogbeat 7.11.0 to monitor windows event logs of a proprietary application (eXX). The windows event log contains entries from 10th March upto 26t… --- ## [Stopwords are not working in custom tokenizer](https://discuss.elastic.co/t/stopwords-are-not-working-in-custom-tokenizer/269033)
**Author:** [@tusharl](https://discuss.elastic.co/u/tusharl)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 2:23pm UTC](https://discuss.elastic.co/t/stopwords-are-not-working-in-custom-tokenizer/269033 "2021-04-01T14:23:47Z")
Consider below example GET \_analyze { "tokenizer": { "pattern" : ",", "type" : "pattern" }, "filter": \[ { "type": "edge\_ngram", "min\_gram": 2, "max\_g… --- ## [Is it bad to disable mmapfs when running elasticsearch in fargate](https://discuss.elastic.co/t/is-it-bad-to-disable-mmapfs-when-running-elasticsearch-in-fargate/269044)
**Author:** [@Heshan\_Anupama](https://discuss.elastic.co/u/Heshan_Anupama)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 2:28pm UTC](https://discuss.elastic.co/t/is-it-bad-to-disable-mmapfs-when-running-elasticsearch-in-fargate/269044 "2021-04-01T14:28:19Z")
Hello, I am trying to get elasticsearch with fargate and I am getting the error of \[2\]: max virtual memory areas vm.max\_map\_count \[65530\] is too low, increase to at least \[262144\]. I understand that we could not change … --- ## [ZonedDateTime.parse function not working for custom DateTimeFormatter](https://discuss.elastic.co/t/zoneddatetime-parse-function-not-working-for-custom-datetimeformatter/268819)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 6\ **Last updated:** [April 1, 2021, 1:36pm UTC](https://discuss.elastic.co/t/zoneddatetime-parse-function-not-working-for-custom-datetimeformatter/268819 "2021-04-01T13:36:04Z")
Below string to date time code is not working for me and it is returning empty array. script1: String datetime = '2021-03-25 08:41:22.011'; DateTimeFormatter dtf = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SSS… --- ## [Logstash](https://discuss.elastic.co/t/logstash/269018)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 6\ **Last updated:** [April 1, 2021, 1:06pm UTC](https://discuss.elastic.co/t/logstash/269018 "2021-04-01T13:06:58Z")
Hi i hope this message find you well , how could to send filtred logs to elasticsearch and in the same time send raw logs to another server (I need this logs for investigation and forensics task) regards and thanks --- ## [How to monitor restore from snapshot - failure case?](https://discuss.elastic.co/t/how-to-monitor-restore-from-snapshot-failure-case/269012)
**Author:** [@Lavanya](https://discuss.elastic.co/u/Lavanya)\ **Replies:** 5\ **Last updated:** [April 1, 2021, 1:00pm UTC](https://discuss.elastic.co/t/how-to-monitor-restore-from-snapshot-failure-case/269012 "2021-04-01T13:00:06Z")
I found that /\_cat/recovery API gives information about ongoing and completed snapshot recovery activity. In this response body, there is an attribute called stage whose possible values are { init, index, start, translo… --- ## [\[Filebeat CEF\] Microsoft DNS Overview on Filebeat 7.12](https://discuss.elastic.co/t/filebeat-cef-microsoft-dns-overview-on-filebeat-7-12/268891)
**Author:** [@numpty-boy](https://discuss.elastic.co/u/numpty-boy)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 11:44am UTC](https://discuss.elastic.co/t/filebeat-cef-microsoft-dns-overview-on-filebeat-7-12/268891 "2021-04-01T11:44:43Z")
Hi Team, I'm hoping one of you can get me out of this misery ... I have packetbeat set up on my M$ DNS servers and is collecting some really helpful info. My elasticSearch cluster is running separately and seems to be… --- ## [Rollover is taking time](https://discuss.elastic.co/t/rollover-is-taking-time/268927)
**Author:** [@Narayan\_Banik](https://discuss.elastic.co/u/Narayan_Banik)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 10:58am UTC](https://discuss.elastic.co/t/rollover-is-taking-time/268927 "2021-04-01T10:58:23Z")
My Policy is supposed to roll over indices if size reaches to 500mb like below: GET \_ilm/policy/my-policy { "my-policy" : { "version" : 4, "modified\_date" : "2021-03-31T14:34:45.932Z", "policy" : { "… --- ## [Metricbeats output.redis excessiv DNS Querries when redis down](https://discuss.elastic.co/t/metricbeats-output-redis-excessiv-dns-querries-when-redis-down/269021)
**Author:** [@brockp](https://discuss.elastic.co/u/brockp)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 10:56am UTC](https://discuss.elastic.co/t/metricbeats-output-redis-excessiv-dns-querries-when-redis-down/269021 "2021-04-01T10:56:48Z")
We have metricbeats sending data to redis and on to ES. When redis is down metricbeats CPU jumps to 100% and 4 hosts easily create 20,000 DNS requests/second for the list of hosts running redis. Kinda odd it's not cac… --- ## [How do I run multiple filebeat.yml files on Windows?](https://discuss.elastic.co/t/how-do-i-run-multiple-filebeat-yml-files-on-windows/269003)
**Author:** [@pradeep\_gadkari](https://discuss.elastic.co/u/pradeep_gadkari)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 10:05am UTC](https://discuss.elastic.co/t/how-do-i-run-multiple-filebeat-yml-files-on-windows/269003 "2021-04-01T10:05:58Z")
I have to make a centralized log monitoring system. I have to read logs from multiple locations and parse the logs differently in logstash. All these logs need to be sent to one index to Kibana at the output of logstash. … --- ## [Auditbeat \[7.11.2 and 7.12.0\] memory issue](https://discuss.elastic.co/t/auditbeat-7-11-2-and-7-12-0-memory-issue/268830)
**Author:** [@mareckii](https://discuss.elastic.co/u/mareckii)\ **Replies:** 7\ **Last updated:** [April 1, 2021, 9:38am UTC](https://discuss.elastic.co/t/auditbeat-7-11-2-and-7-12-0-memory-issue/268830 "2021-04-01T09:38:38Z")
Hi, I see memory issue when i'm using add\_process\_metadata processor. Memory usage is growing until OOM when i remove this processor from my config: I have dump, but I can't upload here. --- ## [How to solve hard and soft limit machine learning jobs](https://discuss.elastic.co/t/how-to-solve-hard-and-soft-limit-machine-learning-jobs/268933)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 9:28am UTC](https://discuss.elastic.co/t/how-to-solve-hard-and-soft-limit-machine-learning-jobs/268933 "2021-04-01T09:28:18Z")
Hello; I have created a machine learning job to detect port scanner using the packetbeat-\* index. type of job: Population Population field: destination.ip metric: distinct count(destination port) influencers: destin… --- ## [Execute aggs query for each unqiue value?](https://discuss.elastic.co/t/execute-aggs-query-for-each-unqiue-value/268997)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 8:38am UTC](https://discuss.elastic.co/t/execute-aggs-query-for-each-unqiue-value/268997 "2021-04-01T08:38:49Z")
Hi, I have the following script which gives me the 10 most used applications. I want to expand this by getting the top 10 applications for each unique value in the customers field. Is this possible? The goal is to appl… --- ## [ElasticSearch Kibana Fields with "keyword"](https://discuss.elastic.co/t/elasticsearch-kibana-fields-with-keyword/268202)
**Author:** [@miklin](https://discuss.elastic.co/u/miklin)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 8:36am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-fields-with-keyword/268202 "2021-04-01T08:36:43Z")
Hi, I had some questions about Kibana Data Analysis training, mainly in fields with "keyword". Why the search (occupation: "Sales") got a result of "Sales Engineer"? I thought it should be exact match for this search? … --- ## [Can't index a special word in Nest!](https://discuss.elastic.co/t/cant-index-a-special-word-in-nest/266457)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 8:35am UTC](https://discuss.elastic.co/t/cant-index-a-special-word-in-nest/266457 "2021-04-01T08:35:20Z")
Let's look at the built in analyzer named "persian" var analyzeResponse = client.Indices.Analyze(a =\> a .Analyzer("persian") .Text("word1 words2 ManyWord3 LargeWOrds4 Sma… --- ## [Find values inside parenthesees and put it into an array](https://discuss.elastic.co/t/find-values-inside-parenthesees-and-put-it-into-an-array/268935)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 8:26am UTC](https://discuss.elastic.co/t/find-values-inside-parenthesees-and-put-it-into-an-array/268935 "2021-04-01T08:26:06Z")
Hi all, i have this problem , i have this kind of value into a field: Update for Windows Server 2012 R2 (KB3013410)"", Update for Windows Server 2012 R2 (KB3033446), Update for Windows Server 2012 R2 (KB3024751), Updat… --- ## [Elastic Agent Unenrollment](https://discuss.elastic.co/t/elastic-agent-unenrollment/266985)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 8:29am UTC](https://discuss.elastic.co/t/elastic-agent-unenrollment/266985 "2021-04-01T08:29:09Z")
Hi, I was wondering if there were plans as part of an Agent un-enrolment to disable the Elastic Agent service on the host and delete the C:\\Program Files\\Elastic directory? As without doing that you can not re-enroll t… --- ## [Asynchronus message communication - spring boot AMQP stream on RabbitMQ](https://discuss.elastic.co/t/asynchronus-message-communication-spring-boot-amqp-stream-on-rabbitmq/268992)
**Author:** [@elk\_novice](https://discuss.elastic.co/u/elk_novice)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 8:15am UTC](https://discuss.elastic.co/t/asynchronus-message-communication-spring-boot-amqp-stream-on-rabbitmq/268992 "2021-04-01T08:15:23Z")
Hi Team, we plan to monitor RabbitMQ and the microservices that communicate with queues in asynchronus way. Going by the document there is APM server config details available for Rabbimq. However, going by some of the d… --- ## [Kibana - How to do customized sort to saved objects API](https://discuss.elastic.co/t/kibana-how-to-do-customized-sort-to-saved-objects-api/266681)
**Author:** [@saifabusaleh](https://discuss.elastic.co/u/saifabusaleh)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 7:27am UTC](https://discuss.elastic.co/t/kibana-how-to-do-customized-sort-to-saved-objects-api/266681 "2021-04-01T07:27:52Z")
Hi, We use: Kibana 7.10.0 Elastic 7.10.2 We use Kibana Saved Objects Find API to get all dashboards (https://www.elastic.co/guide/en/kibana/master/saved-objects-api-find.html) We want to get this dashboard data sort… [Previous page](https://discuss.elastic.co/latest.md?page=1752) [Next page](https://discuss.elastic.co/latest.md?page=1754)