# Latest **URL:** https://discuss.elastic.co/latest.md?page=1756 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1757 --- ## [Only request in Transaction type Java Agent](https://discuss.elastic.co/t/only-request-in-transaction-type-java-agent/268518)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 8:43am UTC](https://discuss.elastic.co/t/only-request-in-transaction-type-java-agent/268518 "2021-03-31T08:43:56Z")
Hi, I have installed a Java agent with default setting, and I only get "request" in transaction type dropdown menu, is there a way to get more transaction types from the agent? --- ## [Script query - iterating through nested docs](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877)
**Author:** [@bruno\_v](https://discuss.elastic.co/u/bruno_v)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 8:20am UTC](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877 "2021-03-31T08:20:14Z")
I have the following nested property in my mapping: "books": { "type": "nested", "properties": { "book\_id": { "type": "keyword" }, "book\_name": { "type": "keyword" } … --- ## [How get object in script in aggregations](https://discuss.elastic.co/t/how-get-object-in-script-in-aggregations/268082)
**Author:** [@Marina\_S](https://discuss.elastic.co/u/Marina_S)\ **Replies:** 2\ **Last updated:** [March 23, 2021, 12:26pm UTC](https://discuss.elastic.co/t/how-get-object-in-script-in-aggregations/268082 "2021-03-23T12:26:31Z")
I have this object which have ArrayList wirh objects "sizeData" : { "id" : 1, "elasticSizeScale" : { "id" : 3, "sizes" : \[ { "id" : 321, … --- ## [Elasticsearch giving query\_shard\_exception for query\_string](https://discuss.elastic.co/t/elasticsearch-giving-query-shard-exception-for-query-string/268556)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 8:01am UTC](https://discuss.elastic.co/t/elasticsearch-giving-query-shard-exception-for-query-string/268556 "2021-03-31T08:01:47Z")
I am storing URL in the elastic search and I making the following request to get a result for elastic search: { "query\_string": { "query": "\*http://localhost:8000/v3/a… --- ## [Unable to configure the filebeat with open distro for elasticsearch](https://discuss.elastic.co/t/unable-to-configure-the-filebeat-with-open-distro-for-elasticsearch/268799)
**Author:** [@shai](https://discuss.elastic.co/u/shai)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 7:43am UTC](https://discuss.elastic.co/t/unable-to-configure-the-filebeat-with-open-distro-for-elasticsearch/268799 "2021-03-31T07:43:01Z")
hi team, unable to configure filebeat with open distro for elasticsearch. Please tell me where should be change according to open distro for elastic search --- ## [Index template creation: can we parameterize the shards and replica](https://discuss.elastic.co/t/index-template-creation-can-we-parameterize-the-shards-and-replica/268811)
**Author:** [@raja\_augstin](https://discuss.elastic.co/u/raja_augstin)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 7:36am UTC](https://discuss.elastic.co/t/index-template-creation-can-we-parameterize-the-shards-and-replica/268811 "2021-03-31T07:36:04Z")
can't we parameterize index shards and replicas in index template. { "index\_template\_1": { "index\_patterns": \[ "\*" \], "settings": { "index": { "analysis": { "analyzer": { "index\_edgeNGram\_analyzer": { "filter"… --- ## [How to find the time difference between two documents (rows in sql) in an index (table in sql) with same Id](https://discuss.elastic.co/t/how-to-find-the-time-difference-between-two-documents-rows-in-sql-in-an-index-table-in-sql-with-same-id/268782)
**Author:** [@imganeshr](https://discuss.elastic.co/u/imganeshr)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-find-the-time-difference-between-two-documents-rows-in-sql-in-an-index-table-in-sql-with-same-id/268782 "2021-03-31T07:12:13Z")
Hello Everyone, I am new to Elastic Search and Kibana Query Language. I would like to find the time difference between the two documents which have the id as common between them as like below. TimeStamp … --- ## [Wont be able to generate .csv file](https://discuss.elastic.co/t/wont-be-able-to-generate-csv-file/268798)
**Author:** [@Kaustubh20](https://discuss.elastic.co/u/Kaustubh20)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 7:01am UTC](https://discuss.elastic.co/t/wont-be-able-to-generate-csv-file/268798 "2021-03-31T07:01:42Z")
Hi , i am using kibana version 6.4 and Wont be able to generate .csv file. sometimes it work automatically and sometimes not. It showing me error that field format is not a constructor. Please suggest me --- ## [How to create Tile maps visualization in kibana using tile map service?](https://discuss.elastic.co/t/how-to-create-tile-maps-visualization-in-kibana-using-tile-map-service/268789)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 6:54am UTC](https://discuss.elastic.co/t/how-to-create-tile-maps-visualization-in-kibana-using-tile-map-service/268789 "2021-03-31T06:54:23Z")
Hello.I am using Kibana version 7.12.0. I want to create Tile map visualization using tile map service for my logs.It ask's three things i.e "Url","Attribution text","Attribution link".What things we have to specify here… --- ## [Aggregate data using filebeat](https://discuss.elastic.co/t/aggregate-data-using-filebeat/267907)
**Author:** [@szabgab](https://discuss.elastic.co/u/szabgab)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 6:53am UTC](https://discuss.elastic.co/t/aggregate-data-using-filebeat/267907 "2021-03-31T06:53:09Z")
I have a log file that looks like this: TIMESTAMP FIELD VALUE e.g. 100 load 1 100 mem 23 100 free 7 103 load 2 103 mem 17 103 free 9 ... I would like to aggregate the lines with the same … --- ## [Indexing performance degraded in Elasticsearch 7.10](https://discuss.elastic.co/t/indexing-performance-degraded-in-elasticsearch-7-10/267938)
**Author:** [@shamzeer](https://discuss.elastic.co/u/shamzeer)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 6:28am UTC](https://discuss.elastic.co/t/indexing-performance-degraded-in-elasticsearch-7-10/267938 "2021-03-31T06:28:01Z")
Hi, As per the blog below, there is considerable improvement made in Elasticsearch 7.10 in data storage needs. https://www.elastic.co/blog/save-space-and-money-with-improved-storage-efficiency-in-elasticsearch-7-10. I… --- ## [OpenSource Framework Solution](https://discuss.elastic.co/t/opensource-framework-solution/268865)
**Author:** [@maheshballa](https://discuss.elastic.co/u/maheshballa)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 6:20am UTC](https://discuss.elastic.co/t/opensource-framework-solution/268865 "2021-03-31T06:20:05Z")
Hello All, We are developing an open source Diagnostic solutions which works on Oracle products. During this process, we have enough logs generated, and we want to use ELK (Open Source) for visualization and analysis o… --- ## [How to increase the number of filebeat servers in stages](https://discuss.elastic.co/t/how-to-increase-the-number-of-filebeat-servers-in-stages/268853)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 3:44am UTC](https://discuss.elastic.co/t/how-to-increase-the-number-of-filebeat-servers-in-stages/268853 "2021-03-31T03:44:45Z")
We are currently trying to increase the number of servers we log using filebeat and logstash in stages. Filebeat can be installed on a new logging server, and logstash can send logs to the installed server. logstash is… --- ## [For an I/O block on a machine in the ES cluster, how can I set it so that ES returns a 504 timeout and then tries to poll the node to retry](https://discuss.elastic.co/t/for-an-i-o-block-on-a-machine-in-the-es-cluster-how-can-i-set-it-so-that-es-returns-a-504-timeout-and-then-tries-to-poll-the-node-to-retry/268857)
**Author:** [@serug](https://discuss.elastic.co/u/serug)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 2:59am UTC](https://discuss.elastic.co/t/for-an-i-o-block-on-a-machine-in-the-es-cluster-how-can-i-set-it-so-that-es-returns-a-504-timeout-and-then-tries-to-poll-the-node-to-retry/268857 "2021-03-31T02:59:28Z")
I have a question to ask . The scenario is that one of the machines in my ES(6.7) cluster is blocked by I/O, which causes the ES request to be blocked as well, thus causing the thread pool resource depletion. I would li… --- ## [Logontime logofftime](https://discuss.elastic.co/t/logontime-logofftime/268719)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 2:58am UTC](https://discuss.elastic.co/t/logontime-logofftime/268719 "2021-03-31T02:58:29Z")
hello, I'm currently using winlogbeat for window server monitoring. how to i know logon and logoff time an user on windows server? here's the example of splunk's report --- ## [Default index template for streams](https://discuss.elastic.co/t/default-index-template-for-streams/268847)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 0\ **Last updated:** [March 30, 2021, 11:52pm UTC](https://discuss.elastic.co/t/default-index-template-for-streams/268847 "2021-03-30T23:52:52Z")
Is there a way to create a default index template for the newer streams from the Elastic Agent for example. I am wanting to set the replica count to 0 for all streams. This was pretty easy to do for the legacy templates … --- ## [Attaching a drill down to a table panel](https://discuss.elastic.co/t/attaching-a-drill-down-to-a-table-panel/268691)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 1:50am UTC](https://discuss.elastic.co/t/attaching-a-drill-down-to-a-table-panel/268691 "2021-03-31T01:50:52Z")
Kibana 7 I have a table visualisation with with a total column and two Unique counts. I now want to be able to drill down into the cells to see a further level of detail for each of those cells. Signature … --- ## [Snapshot Failures in elastic cloud 's elastic search](https://discuss.elastic.co/t/snapshot-failures-in-elastic-cloud-s-elastic-search/268846)
**Author:** [@saelastic](https://discuss.elastic.co/u/saelastic)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 1:19am UTC](https://discuss.elastic.co/t/snapshot-failures-in-elastic-cloud-s-elastic-search/268846 "2021-03-31T01:19:22Z")
Our current elastic stack is not healthy by snapshot failures. We have about 800 primary shards and all of them fail with the same error during snapshot as below. Could some one help us understand the error in depth tha… --- ## [User system Kibana](https://discuss.elastic.co/t/user-system-kibana/268747)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 1:16am UTC](https://discuss.elastic.co/t/user-system-kibana/268747 "2021-03-31T01:16:48Z")
Is it the system in Kibana that runs the service has a system user: kibana? --- ## [Trouble getting ILM to work for externally created index](https://discuss.elastic.co/t/trouble-getting-ilm-to-work-for-externally-created-index/268766)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 0\ **Last updated:** [March 30, 2021, 9:59am UTC](https://discuss.elastic.co/t/trouble-getting-ilm-to-work-for-externally-created-index/268766 "2021-03-30T09:59:33Z")
Hello, I am using a kafka service from a supplier called Aiven, they have a connector which can push logs to elasticsearch. They push the logs into a daily index called: kafka-YYYY-MM-DD . Now I tried to create an inde… --- ## [Track user logged into Kibana and track their activities](https://discuss.elastic.co/t/track-user-logged-into-kibana-and-track-their-activities/268779)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 1:14am UTC](https://discuss.elastic.co/t/track-user-logged-into-kibana-and-track-their-activities/268779 "2021-03-31T01:14:28Z")
Hi All, For the monitoring purpose, we need to do the analysis on below two points in Kibana Which all users logged in to Kibana What all activities they performed/which all query they executed. Can somebody please h… --- ## [How to add a field with description for a specific Windows Event ID?](https://discuss.elastic.co/t/how-to-add-a-field-with-description-for-a-specific-windows-event-id/268617)
**Author:** [@nael\_uchiha](https://discuss.elastic.co/u/nael_uchiha)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 12:22am UTC](https://discuss.elastic.co/t/how-to-add-a-field-with-description-for-a-specific-windows-event-id/268617 "2021-03-31T00:22:43Z")
Hello, I need to add some fields and descriptions for a Windows Event ID. For example, for winlog.event\_id = 1111 create a field named rule.description: Our descroption Thank you for your help! --- ## [How to set @timestamp in Filebeat?](https://discuss.elastic.co/t/how-to-set-timestamp-in-filebeat/268804)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 12:14am UTC](https://discuss.elastic.co/t/how-to-set-timestamp-in-filebeat/268804 "2021-03-31T00:14:06Z")
Hi thanks for the wonderful elastic stack! I need to set @timestamp in Filebeat. I have seen this and this. But they seems to be outdated and no updates :frowning: --- ## [Running RUM over HTTPS](https://discuss.elastic.co/t/running-rum-over-https/268035)
**Author:** [@macaulaysouza](https://discuss.elastic.co/u/macaulaysouza)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 11:24pm UTC](https://discuss.elastic.co/t/running-rum-over-https/268035 "2021-03-30T23:24:21Z")
I'm configuring a new APM server and I already have a Ruby Agent running on my backend. Now I'm trying to setup a frontend monitor and I came across with RUM JS. All my application runs over HTTPS so becuase of that, I'… --- ## [How to break long condition in logstash config](https://discuss.elastic.co/t/how-to-break-long-condition-in-logstash-config/268709)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 10:34pm UTC](https://discuss.elastic.co/t/how-to-break-long-condition-in-logstash-config/268709 "2021-03-30T22:34:11Z")
I have a filter section that removes a field if the event matches with regex. So my if condition is very long. if \[type\] == "something" { if \[displayName\] =~ /(\[M-m\]as|MAS)\[\\d\]\*/ or \[displayName\] =~ /(\[E-e\]lk|ELK)/ … --- ## [How to add hostname value in email subject or body](https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820)
**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 10:21pm UTC](https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820 "2021-03-30T22:21:40Z")
Hi, I would like to add 'hostname' in email subject or body whenever i get 'Failed authentication error' in log messages. I have created an index and it has data for 3 servers. So whenever we see auth error in logs, i w… --- ## [Logstash doesn't log to elastic](https://discuss.elastic.co/t/logstash-doesnt-log-to-elastic/268025)
**Author:** [@ShadwDrgn](https://discuss.elastic.co/u/ShadwDrgn)\ **Replies:** 5\ **Last updated:** [March 30, 2021, 9:43pm UTC](https://discuss.elastic.co/t/logstash-doesnt-log-to-elastic/268025 "2021-03-30T21:43:02Z")
I've been trying to troubleshoot this for quite some time and have managed to find out the following: filebeat logs everything seemingly fine turning on logstash after deleting the indexes i'm logging to SEEMINGLY wor… --- ## [Kibana showing different Packetbeat data](https://discuss.elastic.co/t/kibana-showing-different-packetbeat-data/268834)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 8:16pm UTC](https://discuss.elastic.co/t/kibana-showing-different-packetbeat-data/268834 "2021-03-30T20:16:50Z")
Hi Guys, I have two version of Elasticsearch x Kibana (Version 7.6 and version 7.12) When i am analysing data in Kibana, using Discover, the information is showed in different ways for each ES/Kibana version. Example: … --- ## [Поиск по полю message](https://discuss.elastic.co/t/message/268757)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 8:06pm UTC](https://discuss.elastic.co/t/message/268757 "2021-03-30T20:06:13Z")
При загрузке нового индекса через Logstash перестали видиться настройки поля message Mapping у поля есть Куда копать не пойму... --- ## [Filebeat as a UDP Syslog Listener Dropping Alot of Logs](https://discuss.elastic.co/t/filebeat-as-a-udp-syslog-listener-dropping-alot-of-logs/267132)
**Author:** [@sudont](https://discuss.elastic.co/u/sudont)\ **Replies:** 24\ **Last updated:** [March 30, 2021, 8:04pm UTC](https://discuss.elastic.co/t/filebeat-as-a-udp-syslog-listener-dropping-alot-of-logs/267132 "2021-03-30T20:04:24Z")
So we've been using a single filebeat as a listener for a GOOD amount of Juniper SRX firewalls (like 50 or so) and it's been working really well. We recently did a test and ran a script that fires 10 firewall logs on an… [Previous page](https://discuss.elastic.co/latest.md?page=1755) [Next page](https://discuss.elastic.co/latest.md?page=1757)