# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1760

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1761

---

## [AWS Cognito integration with Kibana](https://discuss.elastic.co/t/aws-cognito-integration-with-kibana/268604)

<div class="topic-metadata">

**Author:** [@diwakar\_singh](https://discuss.elastic.co/u/diwakar_singh)\
**Replies:** 2\
**Last updated:** [March 29, 2021, 12:54pm UTC](https://discuss.elastic.co/t/aws-cognito-integration-with-kibana/268604 "2021-03-29T12:54:38Z")

</div>

Hi, I'm using AWS Cognito as SSO authentication service for Kibana and my other web application. Everything seems to be working fine but there is one issue. After log in through Cognito, Kibana remains logged in as long…

---

## [Where we can see our built in user's passwords in elasticsearch in plain text?](https://discuss.elastic.co/t/where-we-can-see-our-built-in-users-passwords-in-elasticsearch-in-plain-text/268653)

<div class="topic-metadata">

**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\
**Replies:** 1\
**Last updated:** [March 29, 2021, 12:50pm UTC](https://discuss.elastic.co/t/where-we-can-see-our-built-in-users-passwords-in-elasticsearch-in-plain-text/268653 "2021-03-29T12:50:43Z")

</div>

Hii.I want to see my built in user's password in plain text.How can I see this?

---

## [Elastic Search Nest Slow Scroll Speed](https://discuss.elastic.co/t/elastic-search-nest-slow-scroll-speed/268648)

<div class="topic-metadata">

**Author:** [@markanalyzer](https://discuss.elastic.co/u/markanalyzer)\
**Replies:** 4\
**Last updated:** [March 29, 2021, 12:48pm UTC](https://discuss.elastic.co/t/elastic-search-nest-slow-scroll-speed/268648 "2021-03-29T12:48:39Z")

</div>

Hi everyone, Firstly i sorry for my bad english. I have one node in my server. My index stats below this : { "\_shards" : { "total" : 4, "successful" : 4, "failed" : 0 }, "\_all" : { "primaries" : …

---

## [How to ignore "broken pipe" exceptions?](https://discuss.elastic.co/t/how-to-ignore-broken-pipe-exceptions/268463)

<div class="topic-metadata">

**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\
**Replies:** 2\
**Last updated:** [March 29, 2021, 12:30pm UTC](https://discuss.elastic.co/t/how-to-ignore-broken-pipe-exceptions/268463 "2021-03-29T12:30:20Z")

</div>

Hi thanks for the wonderful elastic stack! I am seeing broken pipe errors as follows: However, it seems that it is not a problem. (Please correct me if I am wrong!) Therefore, I hope I can ignore it. But currently I…

---

## [Convert EST to GMT using kibana script field](https://discuss.elastic.co/t/convert-est-to-gmt-using-kibana-script-field/268497)

<div class="topic-metadata">

**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\
**Replies:** 2\
**Last updated:** [March 29, 2021, 12:20pm UTC](https://discuss.elastic.co/t/convert-est-to-gmt-using-kibana-script-field/268497 "2021-03-29T12:20:07Z")

</div>

I have a field of date type(in EST) and I want to convert this to GMT before subtracting from another field using kibana script. below is the script field definition doc\['re.pdz.end'\].value - doc\['test.P\_START\_TIME'\].…

---

## [Data from indices are shown on other indices](https://discuss.elastic.co/t/data-from-indices-are-shown-on-other-indices/268608)

<div class="topic-metadata">

**Author:** [@snobysmake](https://discuss.elastic.co/u/snobysmake)\
**Replies:** 5\
**Last updated:** [March 29, 2021, 12:17pm UTC](https://discuss.elastic.co/t/data-from-indices-are-shown-on-other-indices/268608 "2021-03-29T12:17:34Z")

</div>

I seem to be having a strange problem but quite possibly be a misconfiguration on my side. We are trying to monitor AWS S3 logs which have the following structure s3://bucket/projectA s3://bucket/projectB s3://bucket/p…

---

## [The kibana 7.9 upgrade to 7.11 what will be effect on docker-compose , python 3](https://discuss.elastic.co/t/the-kibana-7-9-upgrade-to-7-11-what-will-be-effect-on-docker-compose-python-3/268298)

<div class="topic-metadata">

**Author:** [@MuskanBeig](https://discuss.elastic.co/u/MuskanBeig)\
**Replies:** 4\
**Last updated:** [March 29, 2021, 11:11am UTC](https://discuss.elastic.co/t/the-kibana-7-9-upgrade-to-7-11-what-will-be-effect-on-docker-compose-python-3/268298 "2021-03-29T11:11:07Z")

</div>

I am planning to upgrade my kibana v 7.9 to v 7.11 just worried about that glibc 2.12 is removed from kibana 7.11 will it effect if my project is build using python 3 i am new to ELK can anyone guide me .

---

## [Dynamic index names](https://discuss.elastic.co/t/dynamic-index-names/268645)

<div class="topic-metadata">

**Author:** [@neilt](https://discuss.elastic.co/u/neilt)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 10:36am UTC](https://discuss.elastic.co/t/dynamic-index-names/268645 "2021-03-29T10:36:02Z")

</div>

I've lifted the below pattern from the logstash docs and modified for my use case. Deffo have a field service.region in my log messages that is populated with values dev1 dev2 or sit. But i am not seeing the indexes wi…

---

## [London Information Retrieval Meetup March (with special guests!)](https://discuss.elastic.co/t/london-information-retrieval-meetup-march-with-special-guests/268643)

<div class="topic-metadata">

**Author:** [@lizbiella](https://discuss.elastic.co/u/lizbiella)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 10:21am UTC](https://discuss.elastic.co/t/london-information-retrieval-meetup-march-with-special-guests/268643 "2021-03-29T10:21:04Z")

</div>

Hello folks, Don't miss the next London Information Retrieval Meetup (ONLINE), that will take place tomorrow, the 30th of March, starting at 6:15 PM (GMT+1). This time, we are going to have two amazing talks: Talk 1 …

---

## [Kibana 8.0 compilation on aarm64 error](https://discuss.elastic.co/t/kibana-8-0-compilation-on-aarm64-error/268139)

<div class="topic-metadata">

**Author:** [@Abbi\_Satdea](https://discuss.elastic.co/u/Abbi_Satdea)\
**Replies:** 3\
**Last updated:** [March 29, 2021, 10:18am UTC](https://discuss.elastic.co/t/kibana-8-0-compilation-on-aarm64-error/268139 "2021-03-29T10:18:49Z")

</div>

Hi, I am trying to compile kibana on raspberry pi. It all seems to go well until it hits a wall. Here are the logs:

---

## [Cannot read field \\"outputs\\" because \\"this.fst\\" is null](https://discuss.elastic.co/t/cannot-read-field-outputs-because-this-fst-is-null/267060)

<div class="topic-metadata">

**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Replies:** 6\
**Last updated:** [March 29, 2021, 10:08am UTC](https://discuss.elastic.co/t/cannot-read-field-outputs-because-this-fst-is-null/267060 "2021-03-29T10:08:02Z")

</div>

Hi everyone. I've got a very strange problem: when I used dsl like: GET index/\_search { "query": { "bool": { "must": \[ { "match\_phrase": { "name": "some words here" } …

---

## [Index Search Percentege (\_sql or \_search)](https://discuss.elastic.co/t/index-search-percentege-sql-or-search/268546)

<div class="topic-metadata">

**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\
**Replies:** 1\
**Last updated:** [March 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/index-search-percentege-sql-or-search/268546 "2021-03-29T09:52:33Z")

</div>

Hi Everyone, I'd like to get the total percentage of \_doc for each Server in a \_search or \_sql API request. In both options I can get total docs for the server and the total of all docs, Now I need a way to do calcula…

---

## [Winlogbeat high cpu usage](https://discuss.elastic.co/t/winlogbeat-high-cpu-usage/267625)

<div class="topic-metadata">

**Author:** [@PD98](https://discuss.elastic.co/u/PD98)\
**Replies:** 3\
**Last updated:** [March 29, 2021, 9:49am UTC](https://discuss.elastic.co/t/winlogbeat-high-cpu-usage/267625 "2021-03-29T09:49:54Z")

</div>

Hi, I have installed winlogbeat on my windows server. However it is causing high cpu usage. I am also attaching an image of the same. Any help would be appreciated. Thanks

---

## [Google Workspace Filebeat SAML issue](https://discuss.elastic.co/t/google-workspace-filebeat-saml-issue/266859)

<div class="topic-metadata">

**Author:** [@Hanse00](https://discuss.elastic.co/u/Hanse00)\
**Replies:** 2\
**Last updated:** [March 29, 2021, 9:40am UTC](https://discuss.elastic.co/t/google-workspace-filebeat-saml-issue/266859 "2021-03-29T09:40:33Z")

</div>

Hi everyone, I believe I've discovered a bug in the Google Workspace module for Filebeat. Posting here first per the instructions on GitHub. When using the Google Workspace module, all sub-modules but SAML logging (Adm…

---

## [Multiple max aggs for last months](https://discuss.elastic.co/t/multiple-max-aggs-for-last-months/268639)

<div class="topic-metadata">

**Author:** [@pbroek](https://discuss.elastic.co/u/pbroek)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 9:18am UTC](https://discuss.elastic.co/t/multiple-max-aggs-for-last-months/268639 "2021-03-29T09:18:27Z")

</div>

Hi, I am struggling with the query to search for 2 max values, mag and depth, over the last day or so. I have read in the topics here but cannot find the solution. Any help is appreciated. This portion works, but if …

---

## [Measuring reaction to detection](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362)

<div class="topic-metadata">

**Author:** [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\
**Replies:** 4\
**Last updated:** [March 29, 2021, 8:49am UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362 "2021-03-29T08:49:48Z")

</div>

Hi! I want to know whether there is a functionality in Elastic Security to monitor reaction time to detection for example to count SLA. Is there smth called internal index from which I can get fields that will show me w…

---

## [Heartbeat failed to start on adding new monitor](https://discuss.elastic.co/t/heartbeat-failed-to-start-on-adding-new-monitor/267343)

<div class="topic-metadata">

**Author:** [@Unni\_Kuttan](https://discuss.elastic.co/u/Unni_Kuttan)\
**Replies:** 1\
**Last updated:** [March 29, 2021, 8:45am UTC](https://discuss.elastic.co/t/heartbeat-failed-to-start-on-adding-new-monitor/267343 "2021-03-29T08:45:02Z")

</div>

Upon adding a new monitor(of type tcp) to heartbeat.yml, the heartbeat service stopped . Tried to start heartbeat from CLI , thrown the error Exiting: could not create monitor: error unpacking monitor plugin config: …

---

## [Alert when specific Windows Service is down](https://discuss.elastic.co/t/alert-when-specific-windows-service-is-down/268635)

<div class="topic-metadata">

**Author:** [@kbalys](https://discuss.elastic.co/u/kbalys)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 8:25am UTC](https://discuss.elastic.co/t/alert-when-specific-windows-service-is-down/268635 "2021-03-29T08:25:03Z")

</div>

Hi, I am using metric beats 7.11.2 and I am reporting the Windows Services from Windows module. I receive a state for about ~150 windows services. I would like to have an alert when a given subset of them filtered by n…

---

## [Filter by display name](https://discuss.elastic.co/t/filter-by-display-name/268583)

<div class="topic-metadata">

**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\
**Replies:** 1\
**Last updated:** [March 29, 2021, 8:04am UTC](https://discuss.elastic.co/t/filter-by-display-name/268583 "2021-03-29T08:04:14Z")

</div>

Is this possible to filder by display name (which I made in indexPatterns)? or somehow do something simillar like filter for values which don't have display name for "that" field? it would be great for finding "unknown" …

---

## [Invalid value "persisted", Options are : \["memory","persisted"\] in 7.9.2 logstash](https://discuss.elastic.co/t/invalid-value-persisted-options-are-memory-persisted-in-7-9-2-logstash/268633)

<div class="topic-metadata">

**Author:** [@Kshema](https://discuss.elastic.co/u/Kshema)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 7:01am UTC](https://discuss.elastic.co/t/invalid-value-persisted-options-are-memory-persisted-in-7-9-2-logstash/268633 "2021-03-29T07:01:52Z")

</div>

In 7.9.2 version of logstash, when logstash is run using pipelines.yml, an error occurs saying "Invalid value \\"persisted#\\". Options are : \\"persisted\\", \\"memory\\" ". The error occurs in settings.rb file validate(val…

---

## [Jdk upgrade for ES v7.x](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524)

<div class="topic-metadata">

**Author:** [@sb116](https://discuss.elastic.co/u/sb116)\
**Replies:** 3\
**Last updated:** [March 29, 2021, 6:49am UTC](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524 "2021-03-29T06:49:45Z")

</div>

is there a way to upgrade embedded jdk from 15.x to 15.0.2/3 for ES v7.x?

---

## [Getting attached error when trying to access from Kibana dashboard](https://discuss.elastic.co/t/getting-attached-error-when-trying-to-access-from-kibana-dashboard/268631)

<div class="topic-metadata">

**Author:** [@nani\_V](https://discuss.elastic.co/u/nani_V)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 6:39am UTC](https://discuss.elastic.co/t/getting-attached-error-when-trying-to-access-from-kibana-dashboard/268631 "2021-03-29T06:39:24Z")

</div>

---

## [Why the speed of geoDistanceQuery is not increasing？](https://discuss.elastic.co/t/why-the-speed-of-geodistancequery-is-not-increasing/268627)

<div class="topic-metadata">

**Author:** [@Sakura1996](https://discuss.elastic.co/u/Sakura1996)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 5:55am UTC](https://discuss.elastic.co/t/why-the-speed-of-geodistancequery-is-not-increasing/268627 "2021-03-29T05:55:31Z")

</div>

Hi ,I tested the geoDistanceQuery performance locally then found that it cost similar time to query 500,000 data or 2,000,000 data even through different amounts of data returned. geo-query filter distance is 100km…

---

## [Slack integration for Workplace Search](https://discuss.elastic.co/t/slack-integration-for-workplace-search/268451)

<div class="topic-metadata">

**Author:** [@Lukasz\_Kuczynski](https://discuss.elastic.co/u/Lukasz_Kuczynski)\
**Replies:** 2\
**Last updated:** [March 29, 2021, 5:47am UTC](https://discuss.elastic.co/t/slack-integration-for-workplace-search/268451 "2021-03-29T05:47:43Z")

</div>

Currently I am exploring how Workplace Search is integrating different sources and have problem with Slack. I have carefully followed instruction set from https://www.elastic.co/guide/en/workplace-search/7.10/workplace…

---

## [Research topic related to Elasticsearch](https://discuss.elastic.co/t/research-topic-related-to-elasticsearch/268560)

<div class="topic-metadata">

**Author:** [@Yashasvi\_Raj\_Pant](https://discuss.elastic.co/u/Yashasvi_Raj_Pant)\
**Replies:** 4\
**Last updated:** [March 29, 2021, 5:37am UTC](https://discuss.elastic.co/t/research-topic-related-to-elasticsearch/268560 "2021-03-29T05:37:02Z")

</div>

Can anybody suggest to me any research topic related to Elasticsearch for the master thesis?

---

## [Writing Kafka message headers using Logstash's Kafka output plugin](https://discuss.elastic.co/t/writing-kafka-message-headers-using-logstashs-kafka-output-plugin/268625)

<div class="topic-metadata">

**Author:** [@vigneshr35](https://discuss.elastic.co/u/vigneshr35)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 5:25am UTC](https://discuss.elastic.co/t/writing-kafka-message-headers-using-logstashs-kafka-output-plugin/268625 "2021-03-29T05:25:04Z")

</div>

Hi All, I am looking to use Logstash's Kafka output plugin. This plugin allows us to post message to Kafka topic, but I don't see any configuration in the documentation that allows to post kafka message headers. Thank …

---

## [Logsash pipeline terminating before timeout duration of aggregation filter plugin](https://discuss.elastic.co/t/logsash-pipeline-terminating-before-timeout-duration-of-aggregation-filter-plugin/268112)

<div class="topic-metadata">

**Author:** [@vigneshr35](https://discuss.elastic.co/u/vigneshr35)\
**Replies:** 2\
**Last updated:** [March 29, 2021, 5:06am UTC](https://discuss.elastic.co/t/logsash-pipeline-terminating-before-timeout-duration-of-aggregation-filter-plugin/268112 "2021-03-29T05:06:23Z")

</div>

Hi All, I am having a logstash pipeline that has an elasticsearch plugin for input and aggregation filter plugin. The aggregation filter plugin has a timeout duration of 15 seconds. Refer to the filter plugin configurat…

---

## [Relationship between two indexes?](https://discuss.elastic.co/t/relationship-between-two-indexes/268477)

<div class="topic-metadata">

**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Replies:** 2\
**Last updated:** [March 29, 2021, 4:45am UTC](https://discuss.elastic.co/t/relationship-between-two-indexes/268477 "2021-03-29T04:45:17Z")

</div>

I have two different Indexes and having key common. It is possible to create relationship between them. I made a visualization from both indexes. I want to merge both into one dashboard and analysis data on the basis of …

---

## [Logstash aggregation to get total memory available at a timestamp](https://discuss.elastic.co/t/logstash-aggregation-to-get-total-memory-available-at-a-timestamp/268431)

<div class="topic-metadata">

**Author:** [@D\_R](https://discuss.elastic.co/u/D_R)\
**Replies:** 2\
**Last updated:** [March 29, 2021, 4:26am UTC](https://discuss.elastic.co/t/logstash-aggregation-to-get-total-memory-available-at-a-timestamp/268431 "2021-03-29T04:26:50Z")

</div>

Hi, I am new to logstash filters. My input files looks something like below ''' { "@version" =\> "1", "collectd\_type" =\> "memory", "host" =\> "ubuntues", "type\_instance" =\> "slab\_unrecl", "plugin" =\> "memory", "va…

---

## [Aggregate records type based on a field type - but allow for searching with normal filters](https://discuss.elastic.co/t/aggregate-records-type-based-on-a-field-type-but-allow-for-searching-with-normal-filters/268623)

<div class="topic-metadata">

**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 4:23am UTC](https://discuss.elastic.co/t/aggregate-records-type-based-on-a-field-type-but-allow-for-searching-with-normal-filters/268623 "2021-03-29T04:23:58Z")

</div>

Hey all, I might be overcomplicating this (most likely!). I have a huge data set. Within that data set there are 'organisations' these appear nested within the main record as an array, as there will be multiple of the…

[Previous page](https://discuss.elastic.co/latest.md?page=1759)

[Next page](https://discuss.elastic.co/latest.md?page=1761)
