# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1764

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1765

---

## [Encrypting HTTP client communications](https://discuss.elastic.co/t/encrypting-http-client-communications/268230)

<div class="topic-metadata">

**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\
**Replies:** 1\
**Last updated:** [March 26, 2021, 2:37am UTC](https://discuss.elastic.co/t/encrypting-http-client-communications/268230 "2021-03-26T02:37:44Z")

</div>

According to elasticsearch reference \[7.12\] , as I understood, we can encrypt HTTP client communications with any of the following .p12 certificates: First option : use the same certificate which I have used for encryp…

---

## [I want to combine field](https://discuss.elastic.co/t/i-want-to-combine-field/268300)

<div class="topic-metadata">

**Author:** [@BlackCat](https://discuss.elastic.co/u/BlackCat)\
**Replies:** 2\
**Last updated:** [March 26, 2021, 1:46am UTC](https://discuss.elastic.co/t/i-want-to-combine-field/268300 "2021-03-26T01:46:38Z")

</div>

I want to new create "Message" field by "Thread" + "Loglevel" + "Content". Please teach me how to do it. Raw log. \[13172\] \[INFO\] 2021-03-25 09:18:21.150 +0900 : Java class name: org.apache.catalina.startup.Bootstrap; …

---

## [Kibana alert on index threshold](https://discuss.elastic.co/t/kibana-alert-on-index-threshold/268221)

<div class="topic-metadata">

**Author:** [@sireesha\_m](https://discuss.elastic.co/u/sireesha_m)\
**Replies:** 7\
**Last updated:** [March 26, 2021, 12:53am UTC](https://discuss.elastic.co/t/kibana-alert-on-index-threshold/268221 "2021-03-26T00:53:18Z")

</div>

I have created an index 'foo'. I created an alert of type index threshold to send emails when any info is written in this index. But I see that the alert has not changed to 'active' state. It stays in 'ok' and I see no …

---

## [Beats on ppc64le](https://discuss.elastic.co/t/beats-on-ppc64le/268213)

<div class="topic-metadata">

**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\
**Replies:** 1\
**Last updated:** [March 26, 2021, 12:25am UTC](https://discuss.elastic.co/t/beats-on-ppc64le/268213 "2021-03-26T00:25:31Z")

</div>

Hi, I am trying to install beats on ppc64le on Redhat OS on production server. I have tried rpm 32, 64 bit also tried aarch64 bit package but getting error : Package metricbeat is intended for different architecture. …

---

## [Write queue size in elasticsearch 6.8.5](https://discuss.elastic.co/t/write-queue-size-in-elasticsearch-6-8-5/268311)

<div class="topic-metadata">

**Author:** [@Bengagi\_Foued](https://discuss.elastic.co/u/Bengagi_Foued)\
**Replies:** 1\
**Last updated:** [March 25, 2021, 11:56pm UTC](https://discuss.elastic.co/t/write-queue-size-in-elasticsearch-6-8-5/268311 "2021-03-25T23:56:21Z")

</div>

settings : thread\_pool.write.queue\_size: 500 , default value is 200 exception thrown : failed to execute pipeline for a bulk request org.elasticsearch.common.util.concurrent.EsRejectedExecutionException: rejected execut…

---

## [Getting to geo\_point types for maps](https://discuss.elastic.co/t/getting-to-geo-point-types-for-maps/268405)

<div class="topic-metadata">

**Author:** [@snobysmake](https://discuss.elastic.co/u/snobysmake)\
**Replies:** 2\
**Last updated:** [March 25, 2021, 11:54pm UTC](https://discuss.elastic.co/t/getting-to-geo-point-types-for-maps/268405 "2021-03-25T23:54:02Z")

</div>

I'm trying to create a template before creating the index so that we can get to display location on maps. We have multiple AWS Load Balancer and want to look from where traffic is coming from. We use ElasticSearch Vers…

---

## [Configuring Monitoring for MongoDB instance](https://discuss.elastic.co/t/configuring-monitoring-for-mongodb-instance/268376)

<div class="topic-metadata">

**Author:** [@amitv-elasticsearch](https://discuss.elastic.co/u/amitv-elasticsearch)\
**Replies:** 0\
**Last updated:** [March 25, 2021, 3:39pm UTC](https://discuss.elastic.co/t/configuring-monitoring-for-mongodb-instance/268376 "2021-03-25T15:39:29Z")

</div>

Hi Team , I want to configure the alert mechanism for our mongoDB instance which is running on seperate linux server on default port. I need to configure if the mongo db service is not working on linux server we should…

---

## [Functionbeat Kinesis Record Deaggregation (contribution)](https://discuss.elastic.co/t/functionbeat-kinesis-record-deaggregation-contribution/268420)

<div class="topic-metadata">

**Author:** [@jpaskhay](https://discuss.elastic.co/u/jpaskhay)\
**Replies:** 0\
**Last updated:** [March 25, 2021, 11:47pm UTC](https://discuss.elastic.co/t/functionbeat-kinesis-record-deaggregation-contribution/268420 "2021-03-25T23:47:26Z")

</div>

Hey there, Our team would like to make use of Kinesis record aggregation to save on AWS costs (high throughput of \<1KiB size logs), but it appears FunctionBeat does not currently handle the Kinesis aggregate record form…

---

## [Canvas with live data on website](https://discuss.elastic.co/t/canvas-with-live-data-on-website/268354)

<div class="topic-metadata">

**Author:** [@Rosie](https://discuss.elastic.co/u/Rosie)\
**Replies:** 1\
**Last updated:** [March 25, 2021, 10:18pm UTC](https://discuss.elastic.co/t/canvas-with-live-data-on-website/268354 "2021-03-25T22:18:18Z")

</div>

Hi all, I would like to add a canvas on our public website, so people can consult the latest and live data. Is this possible in Kibana Canvas? Best wishes, Rosie

---

## [Can't Remove Broken Runner](https://discuss.elastic.co/t/cant-remove-broken-runner/268414)

<div class="topic-metadata">

**Author:** [@theron](https://discuss.elastic.co/u/theron)\
**Replies:** 0\
**Last updated:** [March 25, 2021, 9:32pm UTC](https://discuss.elastic.co/t/cant-remove-broken-runner/268414 "2021-03-25T21:32:38Z")

</div>

I made a very minor typo which has placed one of my training instances in a broken state which I have been unable to recover. I am taking the "Installing and Scaling ECE" training. When I went to add the third instance…

---

## [Call Elasticsearch queries from Custom Kibana Plugin](https://discuss.elastic.co/t/call-elasticsearch-queries-from-custom-kibana-plugin/268179)

<div class="topic-metadata">

**Author:** [@theonlycatonice](https://discuss.elastic.co/u/theonlycatonice)\
**Replies:** 8\
**Last updated:** [March 25, 2021, 8:55pm UTC](https://discuss.elastic.co/t/call-elasticsearch-queries-from-custom-kibana-plugin/268179 "2021-03-25T20:55:56Z")

</div>

Good day, I have searched high and low for an example that works in 2021 (ES 7.11) on how to implement ES querying from a Custom Kibana Plugin. The use case is there are config files stored in an index that we would like…

---

## [Logviewing - filebeat - Timestamp](https://discuss.elastic.co/t/logviewing-filebeat-timestamp/268375)

<div class="topic-metadata">

**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Replies:** 2\
**Last updated:** [March 25, 2021, 8:34pm UTC](https://discuss.elastic.co/t/logviewing-filebeat-timestamp/268375 "2021-03-25T20:34:50Z")

</div>

Hello there, I am exploring ELK capabilities for log viewing. I understand how to ingest log data into elasticsearch through filebeat and viewing from Kibana. but I noticed that if I select timestamp while creating ind…

---

## [Performance and storage of the dense\_vector type](https://discuss.elastic.co/t/performance-and-storage-of-the-dense-vector-type/265850)

<div class="topic-metadata">

**Author:** [@Jacek\_Wolkowicz](https://discuss.elastic.co/u/Jacek_Wolkowicz)\
**Replies:** 2\
**Last updated:** [March 25, 2021, 8:20pm UTC](https://discuss.elastic.co/t/performance-and-storage-of-the-dense-vector-type/265850 "2021-03-25T20:20:53Z")

</div>

While testing the dense\_vector type for 'indexing' of deep n-n embeddings, I came up with a very confusing outcome. I have been testing the impact and performance of the following part of the mapping: { ... 'embeddi…

---

## [How to create hyperlink in Kibana Canvas data table](https://discuss.elastic.co/t/how-to-create-hyperlink-in-kibana-canvas-data-table/267583)

<div class="topic-metadata">

**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\
**Replies:** 8\
**Last updated:** [March 25, 2021, 7:45pm UTC](https://discuss.elastic.co/t/how-to-create-hyperlink-in-kibana-canvas-data-table/267583 "2021-03-25T19:45:16Z")

</div>

Hi, all. I am trying to create hyperlinks in Kibana's Canvas data table. I have already defined the fields with Url format in the Index Patterns page(some users suggested that the keyword version of the fields be define…

---

## [Aggs returning more Cardinality than Source documents](https://discuss.elastic.co/t/aggs-returning-more-cardinality-than-source-documents/268142)

<div class="topic-metadata">

**Author:** [@LeeBear](https://discuss.elastic.co/u/LeeBear)\
**Replies:** 3\
**Last updated:** [March 25, 2021, 6:57pm UTC](https://discuss.elastic.co/t/aggs-returning-more-cardinality-than-source-documents/268142 "2021-03-25T18:57:08Z")

</div>

I am running: { "size": 0, "track\_total\_hits": true, "query": { "bool": { "must": \[ {"match": {"prgx\_email\_join": {"query": "attachmentChild" } } } \] } }, "aggs": { "attachment\_count" : { "cardi…

---

## [Elastic APM Rails not sending request data](https://discuss.elastic.co/t/elastic-apm-rails-not-sending-request-data/268403)

<div class="topic-metadata">

**Author:** [@Doug\_DeBold](https://discuss.elastic.co/u/Doug_DeBold)\
**Replies:** 0\
**Last updated:** [March 25, 2021, 6:54pm UTC](https://discuss.elastic.co/t/elastic-apm-rails-not-sending-request-data/268403 "2021-03-25T18:54:04Z")

</div>

Kibana version: 7.11.1 Elasticsearch version: 1.11.1 APM Server version: 7.10.2 APM Agent language and version: Ruby, elastic-apm @ 3.13.0 Browser version: N/A Original install method (e.g. download page, yum, deb, …

---

## [Remove multiple similar prefix events from a json variable](https://discuss.elastic.co/t/remove-multiple-similar-prefix-events-from-a-json-variable/268402)

<div class="topic-metadata">

**Author:** [@rgreen](https://discuss.elastic.co/u/rgreen)\
**Replies:** 1\
**Last updated:** [March 25, 2021, 6:46pm UTC](https://discuss.elastic.co/t/remove-multiple-similar-prefix-events-from-a-json-variable/268402 "2021-03-25T18:46:01Z")

</div>

How can I remove multiple events from a json variable with a prefix such as "customer\_" ? I have used the json plugin to pull the data into a variable json { source =\> "message" target =\> "\[@metadata\]\[json\]" } Now i a…

---

## [Thread Pools/Hot Thread Help](https://discuss.elastic.co/t/thread-pools-hot-thread-help/268266)

<div class="topic-metadata">

**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\
**Replies:** 5\
**Last updated:** [March 25, 2021, 6:40pm UTC](https://discuss.elastic.co/t/thread-pools-hot-thread-help/268266 "2021-03-25T18:40:00Z")

</div>

I am trying to get additional information on thread pools/hot threads. I am currently looking for any documentation that may give some more detailed information on what these terms/stats mean in the out put. If I run t…

---

## [Suricata](https://discuss.elastic.co/t/suricata/268366)

<div class="topic-metadata">

**Author:** [@Travolta](https://discuss.elastic.co/u/Travolta)\
**Replies:** 4\
**Last updated:** [March 25, 2021, 6:23pm UTC](https://discuss.elastic.co/t/suricata/268366 "2021-03-25T18:23:58Z")

</div>

Добрый день. Не так давно начал изучать эластик. Есть сервер с Suricata и отдельный сервер ELK + Logstash + Kibana + Filebeat. Никак не могу разобраться как логи с суриката отправлять на сервер эластика. Подскажите, пож…

---

## [How to split index by field value?](https://discuss.elastic.co/t/how-to-split-index-by-field-value/268055)

<div class="topic-metadata">

**Author:** [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\
**Replies:** 9\
**Last updated:** [March 25, 2021, 6:15pm UTC](https://discuss.elastic.co/t/how-to-split-index-by-field-value/268055 "2021-03-25T18:15:07Z")

</div>

I have a VM. There are 2 similiar apps (docker apps) inside it, staging and development. They use 1 filebeat to push log to logstash. On these log, I have field container.labels.com\_docker\_compose\_project. I want to crea…

---

## [Should I run multiple pipelines with http input or a single one?](https://discuss.elastic.co/t/should-i-run-multiple-pipelines-with-http-input-or-a-single-one/268337)

<div class="topic-metadata">

**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\
**Replies:** 1\
**Last updated:** [March 25, 2021, 5:53pm UTC](https://discuss.elastic.co/t/should-i-run-multiple-pipelines-with-http-input-or-a-single-one/268337 "2021-03-25T17:53:48Z")

</div>

I have a 16GB machine solely dedicated for running logstash. I will be using the http input. I will have different sources whose data will be stored in different indices. I have a choice of running separate pipelines f…

---

## [How to connect Sybase Sql Anywhere 9 with logstash](https://discuss.elastic.co/t/how-to-connect-sybase-sql-anywhere-9-with-logstash/268390)

<div class="topic-metadata">

**Author:** [@AltC](https://discuss.elastic.co/u/AltC)\
**Replies:** 1\
**Last updated:** [March 25, 2021, 5:45pm UTC](https://discuss.elastic.co/t/how-to-connect-sybase-sql-anywhere-9-with-logstash/268390 "2021-03-25T17:45:24Z")

</div>

I'm new to using Elasticsearh components, and I'm having trouble connecting the Sybase SqlAnywhere database to LogStash. Below the configuration file to connect LogStash to SqlAnywhere is showing an error, I have already…

---

## [Create a new node](https://discuss.elastic.co/t/create-a-new-node/267782)

<div class="topic-metadata">

**Author:** [@Weathmious](https://discuss.elastic.co/u/Weathmious)\
**Replies:** 7\
**Last updated:** [March 25, 2021, 4:49pm UTC](https://discuss.elastic.co/t/create-a-new-node/267782 "2021-03-25T16:49:20Z")

</div>

Hello I currently have my elasticsearch service that has only one node, and I would like to do a second one (on the same server), but I really can’t figure out how to do it. The goal would be to add a "hot" node and a …

---

## [Sleeping for \[3m\] after modifying repository](https://discuss.elastic.co/t/sleeping-for-3m-after-modifying-repository/268370)

<div class="topic-metadata">

**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\
**Replies:** 6\
**Last updated:** [March 25, 2021, 4:41pm UTC](https://discuss.elastic.co/t/sleeping-for-3m-after-modifying-repository/268370 "2021-03-25T16:41:56Z")

</div>

We started receiving the Sleeping for \[3m\] after modifying repository .... because it contains snapshots older than version \[7.6.0\] in production after upgrading from 7.5.2 to 7.10.2, so we created new repos and started …

---

## [Can logstash parse same type of multiple log files?](https://discuss.elastic.co/t/can-logstash-parse-same-type-of-multiple-log-files/268024)

<div class="topic-metadata">

**Author:** [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\
**Replies:** 4\
**Last updated:** [March 25, 2021, 4:40pm UTC](https://discuss.elastic.co/t/can-logstash-parse-same-type-of-multiple-log-files/268024 "2021-03-25T16:40:11Z")

</div>

Hello, I have a question regarding the multiple log files (of similar type) parsing by logstash. Scenario :- My application generate log files every day,(2 log files in a day) by the name of intranet-YYYY-MM-DD-PORT.l…

---

## [Is there a way to export the CSV Formatted report of a dashboard (visualization) in Kibana programmatically?](https://discuss.elastic.co/t/is-there-a-way-to-export-the-csv-formatted-report-of-a-dashboard-visualization-in-kibana-programmatically/268294)

<div class="topic-metadata">

**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\
**Replies:** 3\
**Last updated:** [March 25, 2021, 3:55pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-export-the-csv-formatted-report-of-a-dashboard-visualization-in-kibana-programmatically/268294 "2021-03-25T15:55:23Z")

</div>

Hi Experts, I have created a visualization with required fields using Data Table visualization. It gives Export: Raw and Formatted options at the left bottom. How can I export(download) using API or programmatically o…

---

## [Match all in js sdk does not return values, while curl does](https://discuss.elastic.co/t/match-all-in-js-sdk-does-not-return-values-while-curl-does/268322)

<div class="topic-metadata">

**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Replies:** 7\
**Last updated:** [March 25, 2021, 3:47pm UTC](https://discuss.elastic.co/t/match-all-in-js-sdk-does-not-return-values-while-curl-does/268322 "2021-03-25T15:47:27Z")

</div>

Hi elastic wizards. I have strange issue with elasticsearch (7.11). I have an index called "test\_index", and when I query it using curl and "match\_all" it returns a value, but when I use the node js client, it does not…

---

## [ElasticSearch Split API - excessive use of disk space](https://discuss.elastic.co/t/elasticsearch-split-api-excessive-use-of-disk-space/268326)

<div class="topic-metadata">

**Author:** [@Landong.Zuo](https://discuss.elastic.co/u/Landong.Zuo)\
**Replies:** 3\
**Last updated:** [March 25, 2021, 3:47pm UTC](https://discuss.elastic.co/t/elasticsearch-split-api-excessive-use-of-disk-space/268326 "2021-03-25T15:47:49Z")

</div>

Hello, I've installed ElasticSearch 7.11.2 on a 3 node cluster on AWS EC2 linux 2. I need to split a big index (100GB on disk, 1 primary shard and 1 replica shard) to 6 primary shards and 6 replica shards using the spl…

---

## [Log viewing - ELK](https://discuss.elastic.co/t/log-viewing-elk/268106)

<div class="topic-metadata">

**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Replies:** 4\
**Last updated:** [March 25, 2021, 3:31pm UTC](https://discuss.elastic.co/t/log-viewing-elk/268106 "2021-03-25T15:31:54Z")

</div>

Hello there, I have set up the following configuration in filebeat config file but it is not picking up the second input. not sure why filebeat.inputs: type: log enabled: true paths: C:\\ELK7.9.2\\Logs\*.log type: …

---

## [Logstash cannot run one of the pipelines](https://discuss.elastic.co/t/logstash-cannot-run-one-of-the-pipelines/268369)

<div class="topic-metadata">

**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\
**Replies:** 0\
**Last updated:** [March 25, 2021, 3:04pm UTC](https://discuss.elastic.co/t/logstash-cannot-run-one-of-the-pipelines/268369 "2021-03-25T15:04:01Z")

</div>

Hello, One of the logstash pipelines is not working and I can run the pipeline in the debug mode because it is centrally managed in kibana UI. How can debug the config? How can I look for errors?

[Previous page](https://discuss.elastic.co/latest.md?page=1763)

[Next page](https://discuss.elastic.co/latest.md?page=1765)
