# Latest **URL:** https://discuss.elastic.co/latest.md?page=1783 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1784 --- ## [Show date with correct timezone in Kibana alert emails](https://discuss.elastic.co/t/show-date-with-correct-timezone-in-kibana-alert-emails/267159)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 10:58am UTC](https://discuss.elastic.co/t/show-date-with-correct-timezone-in-kibana-alert-emails/267159 "2021-03-16T10:58:10Z")
Hello, In Elastic SIEM alert emails, we can use {{date}} as date in email alerts. But the problem is that date is in GMT and my timezone is GMT+1. Is there a way to be able to show the correct date in Kibana alert email… --- ## [Process Rejection Question](https://discuss.elastic.co/t/process-rejection-question/267325)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 10:52am UTC](https://discuss.elastic.co/t/process-rejection-question/267325 "2021-03-16T10:52:36Z")
Hi, we're operating an ELK cluster on a single host. The current setup includes: 3 node ( 1 master-nodata, 2 master-data) containers 2 logstash containers (for app and for container logs) 2 kibana containers(1 for adm… --- ## [Rollup: Deleted index but cannot stop/delete job](https://discuss.elastic.co/t/rollup-deleted-index-but-cannot-stop-delete-job/265930)
**Author:** [@tg295](https://discuss.elastic.co/u/tg295)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 10:48am UTC](https://discuss.elastic.co/t/rollup-deleted-index-but-cannot-stop-delete-job/265930 "2021-03-16T10:48:06Z")
I have a rollup job in state "Indexing". I cannot stop nor delete the job - stopping is not an option and deleting brings up the following error: 400: Bad Request. Could not delete job \[index-blah\] because indexer state… --- ## [Filter in Kibana Visualization on values with spaces in it](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288)
**Author:** [@Philbert](https://discuss.elastic.co/u/Philbert)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 10:36am UTC](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288 "2021-03-16T10:36:59Z")
We use Kibana to analyse the HTTP logs of on our CDN. One important field is the user agent. From the user agent I can see which device was requesting an HTTP request from the CDN. I would like to gather statistics on … --- ## [Logstash](https://discuss.elastic.co/t/logstash/267348)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 10:35am UTC](https://discuss.elastic.co/t/logstash/267348 "2021-03-16T10:35:52Z")
why my logstash don't send log to elastic? I have made a logstash's ip and elasticsearch's ip at /etc/hosts in logstash's server and i made a "output-elasticsearch.conf" at /etc/logstash/conf.d in logstash's server w… --- ## [Elasticsearch security use ldap how to config role](https://discuss.elastic.co/t/elasticsearch-security-use-ldap-how-to-config-role/267347)
**Author:** [@taoyantu](https://discuss.elastic.co/u/taoyantu)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-security-use-ldap-how-to-config-role/267347 "2021-03-16T10:30:18Z")
hello master ,please help me ,i use the elasticsearch realms ldap ,the elasticsearch.yml like realms: ldap: ldap1: follow\_referrals:false order: 10 url: "xxxxx" bind\_dn: "xxxx" bind\_pasword: "xxxx" user\_search: … --- ## [Problem adding company certificate in Elasticsearch](https://discuss.elastic.co/t/problem-adding-company-certificate-in-elasticsearch/267344)
**Author:** [@Andrea92](https://discuss.elastic.co/u/Andrea92)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 9:46am UTC](https://discuss.elastic.co/t/problem-adding-company-certificate-in-elasticsearch/267344 "2021-03-16T09:46:14Z")
Buenos días a tod@s, Tengo un problema con el certificado de mi empresa. Cuando le incorporo la ruta a las variables de docker de Elasticsearch para que los lea y los compruebe pero me dice que el certificado de interca… --- ## [Creating a transform with must\_not bool not working as expected](https://discuss.elastic.co/t/creating-a-transform-with-must-not-bool-not-working-as-expected/267330)
**Author:** [@vigneshr35](https://discuss.elastic.co/u/vigneshr35)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 9:26am UTC](https://discuss.elastic.co/t/creating-a-transform-with-must-not-bool-not-working-as-expected/267330 "2021-03-16T09:26:32Z")
Hi everyone, I am trying to create a transform and facing some issues with using the must\_not for a specific condition I have. Here are the details: Source index sample document: { "app.status": "COMPLETED", "@ti… --- ## [Received plaintext http traffic on an https channel, closing connection Netty4HttpChannel](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel-closing-connection-netty4httpchannel/266957)
**Author:** [@Andrea92](https://discuss.elastic.co/u/Andrea92)\ **Replies:** 9\ **Last updated:** [March 16, 2021, 9:26am UTC](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel-closing-connection-netty4httpchannel/266957 "2021-03-16T09:26:04Z")
Buenas tardes, Soy nueva en estos foros, pero he visto que la mayoría de los problemas que me he encontrado con ELK los he podido solucionar gracias a este foro. Pero este problema lo llevo arrastrando ya más de 1 mes … --- ## [High CPU (cgroup) usage/utilization](https://discuss.elastic.co/t/high-cpu-cgroup-usage-utilization/258964)
**Author:** [@NejcK](https://discuss.elastic.co/u/NejcK)\ **Replies:** 19\ **Last updated:** [March 16, 2021, 8:34am UTC](https://discuss.elastic.co/t/high-cpu-cgroup-usage-utilization/258964 "2021-03-16T08:34:09Z")
Hi. We have only one node in our cluster (hosted on Elastic cloud, v7.10.0) with Kibana (for filebeat and metricbeat) and everything was working fine until about last week. I'm pretty new to all this, but I've set up al… --- ## [Edit field "action"](https://discuss.elastic.co/t/edit-field-action/267291)
**Author:** [@lele15](https://discuss.elastic.co/u/lele15)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 8:33am UTC](https://discuss.elastic.co/t/edit-field-action/267291 "2021-03-16T08:33:08Z")
Hi, i'm new on ES and i have a problem with csv ingestion. I want to edit data on ES when a field has a specific value. Like: Id,Name,Operation 1,Jack,Edit 2,,Delete I want something like this in my Logstash config… --- ## [Reference the count of a field name in metrics](https://discuss.elastic.co/t/reference-the-count-of-a-field-name-in-metrics/266061)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 16\ **Last updated:** [March 16, 2021, 8:03am UTC](https://discuss.elastic.co/t/reference-the-count-of-a-field-name-in-metrics/266061 "2021-03-16T08:03:35Z")
I would like to have calculation like you see in the image. How to solve that? I was trying: { "script" : { "lang": "painless", "inline": "\_value \* params.manualSeconds / params.correction / params.fa… --- ## [Why does an enrich policy get executed on the master node?](https://discuss.elastic.co/t/why-does-an-enrich-policy-get-executed-on-the-master-node/263241)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 29\ **Last updated:** [March 16, 2021, 7:56am UTC](https://discuss.elastic.co/t/why-does-an-enrich-policy-get-executed-on-the-master-node/263241 "2021-03-16T07:56:36Z")
I'm trying to create a geo\_match enrich policy based on a not-so-big source index (10GB). The match field is a geo\_shape and there are about half a dozen single-term enrich fields. So nothing extraordinary. When the ind… --- ## [Elasticsearch : Return the value of a field in the latest document created each day for the last one month](https://discuss.elastic.co/t/elasticsearch-return-the-value-of-a-field-in-the-latest-document-created-each-day-for-the-last-one-month/267327)
**Author:** [@Bengagi\_Foued](https://discuss.elastic.co/u/Bengagi_Foued)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 7:51am UTC](https://discuss.elastic.co/t/elasticsearch-return-the-value-of-a-field-in-the-latest-document-created-each-day-for-the-last-one-month/267327 "2021-03-16T07:51:10Z")
I have a collection with documents updating everyday. Can someone provide me some suggestion for returning the value of a field in the latest document for each day for the last one month my document is like the one bello… --- ## [Sophos central endpoint alerts logs](https://discuss.elastic.co/t/sophos-central-endpoint-alerts-logs/267323)
**Author:** [@Ana\_11](https://discuss.elastic.co/u/Ana_11)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 6:45am UTC](https://discuss.elastic.co/t/sophos-central-endpoint-alerts-logs/267323 "2021-03-16T06:45:16Z")
Hi I want to ingest sophos intercept x endpoint logs to elasticsearch. Through API im getting the alerts on syslog but the sophos filebeat module does not support alerts as it says it support only firewall logs. can u t… --- ## [Could'nt set case\_insensitive option in Nest](https://discuss.elastic.co/t/couldnt-set-case-insensitive-option-in-nest/267227)
**Author:** [@Sangeetha-Murugesan](https://discuss.elastic.co/u/Sangeetha-Murugesan)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 8:00am UTC](https://discuss.elastic.co/t/couldnt-set-case-insensitive-option-in-nest/267227 "2021-03-15T08:00:25Z")
Hi, I am using ElasticSearch version 7.11. My TermQuery only returns case-sensitive matching results,to avoid that I set case\_insensitive as true in DSL term query like below and it returns data as expected. { "qu… --- ## [Rally in kubernetes with docker image](https://discuss.elastic.co/t/rally-in-kubernetes-with-docker-image/267234)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 6:02am UTC](https://discuss.elastic.co/t/rally-in-kubernetes-with-docker-image/267234 "2021-03-16T06:02:06Z")
Hi Elastic Team, I would like to perform benchmark Testing for Elasticsearch, I have few questions regarding this: Can we use rally as a Kubernetes Deployment. https://github.com/elastic/rally/tree/master/docker - I… --- ## [Filebeat is overwriting the pipeline specified in Elastic on start](https://discuss.elastic.co/t/filebeat-is-overwriting-the-pipeline-specified-in-elastic-on-start/266825)
**Author:** [@JamblaInc](https://discuss.elastic.co/u/JamblaInc)\ **Replies:** 7\ **Last updated:** [March 15, 2021, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-is-overwriting-the-pipeline-specified-in-elastic-on-start/266825 "2021-03-15T14:54:19Z")
I am using Filebeat to collect CloudWatch logs and I have modified the ingest node pipeline to extract and index some more information from the logs. However, when Filebeat has restarted the extra processors that I added… --- ## [Logstash Json Parse Error](https://discuss.elastic.co/t/logstash-json-parse-error/267058)
**Author:** [@Anu6006](https://discuss.elastic.co/u/Anu6006)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 4:30am UTC](https://discuss.elastic.co/t/logstash-json-parse-error/267058 "2021-03-16T04:30:36Z")
Hi Team, I'm trying to get NSG Flow logs through Azure Blob Storage plugin version: logstash-input-azureblob (0.9.13). logstash-codec-json (3.0.5) I am trying to save my Logstash output in JSON format. But it is sho… --- ## [パスワード変更の禁止](https://discuss.elastic.co/t/topic/264210)
**Author:** [@syogo](https://discuss.elastic.co/u/syogo)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 3:31am UTC](https://discuss.elastic.co/t/topic/264210 "2021-03-16T03:31:11Z")
\[kibana\_dashboard\_only\_user\]を持っているAというアカウントでログインしたとき，図のAccountSettingsページに移動させないためにはどうしたらいいですか？最終的にパスワード変更ができないようにしたいです．また，リバースプロキシでNGINXを使用しています．versinは6.8.13であり，ライセンスはBasicです． --- ## [Elasticsearch as source of Apache Flink?](https://discuss.elastic.co/t/elasticsearch-as-source-of-apache-flink/267317)
**Author:** [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 3:15am UTC](https://discuss.elastic.co/t/elasticsearch-as-source-of-apache-flink/267317 "2021-03-16T03:15:46Z")
With es-hadoop plugin, we can regard Elasticsearch as source of Hadoop/Spark. Do we have any plugin helping Elasticsearch as source of Apache Flink? --- ## [\[Highlight\] Highlight query doesn't work properly in should query](https://discuss.elastic.co/t/highlight-highlight-query-doesnt-work-properly-in-should-query/267314)
**Author:** [@kwang\_hee\_Han](https://discuss.elastic.co/u/kwang_hee_Han)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 2:34am UTC](https://discuss.elastic.co/t/highlight-highlight-query-doesnt-work-properly-in-should-query/267314 "2021-03-16T02:34:52Z")
GET naver\_article/\_search { "size": 100, "query" : { "function\_score": { "functions": \[ { "weight": 1.8, "gauss": { "format\_date": { "scale": "1d" … --- ## [Artifacts.elastic.co intermittently fails (404, "no longer has a Release file.")](https://discuss.elastic.co/t/artifacts-elastic-co-intermittently-fails-404-no-longer-has-a-release-file/266151)
**Author:** [@tedder](https://discuss.elastic.co/u/tedder)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 1:32am UTC](https://discuss.elastic.co/t/artifacts-elastic-co-intermittently-fails-404-no-longer-has-a-release-file/266151 "2021-03-16T01:32:18Z")
It seems that there are transient failures with artifacts.elastic.co, perhaps servers that are out of sync. We sometimes see this when running apt-get -q update: bad $ sudo apt-get -q update ... Ign:5 https://artifacts… --- ## [How can I check event.field value from a file?](https://discuss.elastic.co/t/how-can-i-check-event-field-value-from-a-file/267292)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 1:27am UTC](https://discuss.elastic.co/t/how-can-i-check-event-field-value-from-a-file/267292 "2021-03-16T01:27:19Z")
How can I check if the event.field\_name value is present in the file? If yes, drop the event otherwise send the event to elasticsearch. Note: The field\_name could have multiple values in that file, and I want to check i… --- ## [How to stop Elastic Endpoint](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [March 15, 2021, 11:40pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283 "2021-03-15T23:40:05Z")
Hello, I am testing elastic Endpoint, I have installed it in a windows server machine, and when I try to install a malware in my machine it blocks it as expected so it works perfectly, The only problem is that I am not … --- ## [Elasticsearch to Google sheets](https://discuss.elastic.co/t/elasticsearch-to-google-sheets/267173)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 10:10pm UTC](https://discuss.elastic.co/t/elasticsearch-to-google-sheets/267173 "2021-03-15T22:10:26Z")
Hi All, Is there any direct way to export data from the Elasticsearch index to Googlesheets (not from google sheets to elasticsearch) based on a defined iterval without using any ETL tool or script? Something like G-conn… --- ## [Elastic Common Schema Fields for Reverse Proxies](https://discuss.elastic.co/t/elastic-common-schema-fields-for-reverse-proxies/267074)
**Author:** [@learnerbyheart](https://discuss.elastic.co/u/learnerbyheart)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 9:10pm UTC](https://discuss.elastic.co/t/elastic-common-schema-fields-for-reverse-proxies/267074 "2021-03-15T21:10:46Z")
Hello, we are currently migrating our NGINX logging format to the Elastic Common Schema. For some NGINX logging values I cannot find any fitting fields. In our case we use NGINX as a reverse proxy in Kubernetes. Most of… --- ## [Filebeat to parse json array](https://discuss.elastic.co/t/filebeat-to-parse-json-array/267301)
**Author:** [@vantoryc](https://discuss.elastic.co/u/vantoryc)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 9:00pm UTC](https://discuss.elastic.co/t/filebeat-to-parse-json-array/267301 "2021-03-15T21:00:08Z")
Hi, We are currently using filebeats to send logs to our Graylog. So far it has worked out fine for as as the logs were single line. Now we want to add logs from another folder but the logs are are multiline json array… --- ## [Send value aggregation.payload with kibana watcher](https://discuss.elastic.co/t/send-value-aggregation-payload-with-kibana-watcher/267124)
**Author:** [@Eyler\_Rodrigues](https://discuss.elastic.co/u/Eyler_Rodrigues)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 8:53pm UTC](https://discuss.elastic.co/t/send-value-aggregation-payload-with-kibana-watcher/267124 "2021-03-12T20:53:47Z")
Dear, I need help to resolve a question related to the watcher. I created a script with an aggregation and based on a value it sends a message to a webhook. The result of my script is an example below: "aggregations": … --- ## [Detecting date from string input](https://discuss.elastic.co/t/detecting-date-from-string-input/267305)
**Author:** [@macctown](https://discuss.elastic.co/u/macctown)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 7:58pm UTC](https://discuss.elastic.co/t/detecting-date-from-string-input/267305 "2021-03-15T19:58:10Z")
Hi I'm trying to find a way to get possible "date" information from user input string. Input - a string that may contain date information, for example: "UK basketball", "US sports 2019", "sports 2019/12/23" After sendi… [Previous page](https://discuss.elastic.co/latest.md?page=1782) [Next page](https://discuss.elastic.co/latest.md?page=1784)