# Latest **URL:** https://discuss.elastic.co/latest.md?page=1786 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1787 --- ## [Help with equation in ruby](https://discuss.elastic.co/t/help-with-equation-in-ruby/267172)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 1\ **Last updated:** [March 14, 2021, 2:43pm UTC](https://discuss.elastic.co/t/help-with-equation-in-ruby/267172 "2021-03-14T14:43:14Z")
I'm doing some calculations in ruby and works well when doing basic stuff like subtracting a from b but I have something a little more complex that I just cant get the syntax right or work out the most efficient way to d… --- ## [Multiple Webhook](https://discuss.elastic.co/t/multiple-webhook/267178)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 2:37pm UTC](https://discuss.elastic.co/t/multiple-webhook/267178 "2021-03-14T14:37:58Z")
Hi I want to make an alert(watcher) with multiple action. For example, I need to call more than two hosts(with different path and port) so I need to use my\_webhook according to the bellow page: "actions" : { "my\_we… --- ## [Ingest Pipeline Convert Processor is not converting](https://discuss.elastic.co/t/ingest-pipeline-convert-processor-is-not-converting/267166)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 2\ **Last updated:** [March 14, 2021, 2:37pm UTC](https://discuss.elastic.co/t/ingest-pipeline-convert-processor-is-not-converting/267166 "2021-03-14T14:37:22Z")
I am using Filebeat, Elasticsearch and Kibana 7.10.2 in docker containers I have a working pipeline: PUT /\_ingest/pipeline/test\_grok\_pipeline { "description": "Test grok pattern", "processors": \[ { "grok"… --- ## [How to create geo-point fields from longitude / latitude](https://discuss.elastic.co/t/how-to-create-geo-point-fields-from-longitude-latitude/267179)
**Author:** [@lostsoul352](https://discuss.elastic.co/u/lostsoul352)\ **Replies:** 7\ **Last updated:** [March 14, 2021, 2:33pm UTC](https://discuss.elastic.co/t/how-to-create-geo-point-fields-from-longitude-latitude/267179 "2021-03-14T14:33:25Z")
ELK 7.10. I've used the geoip filter in logstash to get geo data from a remote IP Address. Now I have geo data appearing in elastic. I want to be able to map these on a map chart and I don't understand how to do the … --- ## [Cross Cluster Replication monitoring](https://discuss.elastic.co/t/cross-cluster-replication-monitoring/267184)
**Author:** [@eli.cohen](https://discuss.elastic.co/u/eli.cohen)\ **Replies:** 1\ **Last updated:** [March 14, 2021, 1:46pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-monitoring/267184 "2021-03-14T13:46:10Z")
We use Prometheus and Grafana as a monitoring solution. I would like to know if there is a Prometheus exporter for CCR. If not, then what is the best way to monitor the replication state, replication lag per index and ot… --- ## [Which version is recommended?](https://discuss.elastic.co/t/which-version-is-recommended/267134)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 3\ **Last updated:** [March 14, 2021, 8:58am UTC](https://discuss.elastic.co/t/which-version-is-recommended/267134 "2021-03-14T08:58:39Z")
Which version(s) of Java or OpenJDK is recommended for Elasticsearch 7.11.1 ? --- ## [Conditional setting of values in VEGA (for gantt chart)](https://discuss.elastic.co/t/conditional-setting-of-values-in-vega-for-gantt-chart/266580)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 8:16am UTC](https://discuss.elastic.co/t/conditional-setting-of-values-in-vega-for-gantt-chart/266580 "2021-03-14T08:16:36Z")
I want to create gantt chat display where "end" bar is dependent on the application status. If "status" is "Running" - I want to set endTime to "now()" If "status" is "not Running" - I want to use endTime field from th… --- ## [Table in canvas not showing](https://discuss.elastic.co/t/table-in-canvas-not-showing/267148)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 2\ **Last updated:** [March 14, 2021, 6:34am UTC](https://discuss.elastic.co/t/table-in-canvas-not-showing/267148 "2021-03-14T06:34:30Z")
I'm new to canvas so my question might be stupid. I'm trying to add metricbeat data to a table using essql. In the preview data section, I can see my data but the table's empty. Here's the expression I'm using: filters… --- ## [Can't launch Elasticsearch](https://discuss.elastic.co/t/cant-launch-elasticsearch/267168)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 1:20am UTC](https://discuss.elastic.co/t/cant-launch-elasticsearch/267168 "2021-03-14T01:20:56Z")
My JAVA\_HOME code in .profile export JAVA\_HOME=/usr/lib/jvm/java-1.11.0-openjdk-amd64 export PATH=$JAVA\_HOME/bin:$PATH And when I try to launch: \[elasticsearch-7.11.1\] ./bin/elasticsearch Exception in thread "main" j… --- ## [Elasticsearch suddenly unavailable](https://discuss.elastic.co/t/elasticsearch-suddenly-unavailable/267153)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 1\ **Last updated:** [March 13, 2021, 7:32pm UTC](https://discuss.elastic.co/t/elasticsearch-suddenly-unavailable/267153 "2021-03-13T19:32:40Z")
After some time, the service suddenly doesn't work... org.elasticsearch.cluster.block.ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]; I'm using a single node instance, ES 7… --- ## [Detection engine](https://discuss.elastic.co/t/detection-engine/266490)
**Author:** [@Liora](https://discuss.elastic.co/u/Liora)\ **Replies:** 5\ **Last updated:** [March 13, 2021, 6:26pm UTC](https://discuss.elastic.co/t/detection-engine/266490 "2021-03-13T18:26:18Z")
Hi everyone, how can i please enable the Detections feature in Kibana? Who is the user with the mentioned privileges? Thank you --- ## [Show field value as icon/svg](https://discuss.elastic.co/t/show-field-value-as-icon-svg/267050)
**Author:** [@SKiD](https://discuss.elastic.co/u/SKiD)\ **Replies:** 3\ **Last updated:** [March 13, 2021, 6:01pm UTC](https://discuss.elastic.co/t/show-field-value-as-icon-svg/267050 "2021-03-13T18:01:55Z")
Hey, I read some stuff about showing images in Kibana in the Discovery screen. Now I was curious and tested some things out. I was able to show URLs as picture, that worked great, but what I wasn't able to do is showing… --- ## [GeoIP - how to only show users who are or have logged on from multiple locations](https://discuss.elastic.co/t/geoip-how-to-only-show-users-who-are-or-have-logged-on-from-multiple-locations/266817)
**Author:** [@FinT](https://discuss.elastic.co/u/FinT)\ **Replies:** 3\ **Last updated:** [March 13, 2021, 5:50pm UTC](https://discuss.elastic.co/t/geoip-how-to-only-show-users-who-are-or-have-logged-on-from-multiple-locations/266817 "2021-03-13T17:50:35Z")
elastic stack 6.5.1. This question can be applied to any similar query to filter events. I have visualised users (donut) who have logged in remotely. The inner ring shows users, the outer shows countries. Due to the lar… --- ## [ECK Storage Recommendations](https://discuss.elastic.co/t/eck-storage-recommendations/237430)
**Author:** [@robinhood\_lko](https://discuss.elastic.co/u/robinhood_lko)\ **Replies:** 5\ **Last updated:** [March 13, 2021, 5:26pm UTC](https://discuss.elastic.co/t/eck-storage-recommendations/237430 "2021-03-13T17:26:19Z")
Dear All, We are planning to deploy storage sol on ECK cluster, internal build k8s platform. Storage solution provided by our team does not support dynamic provisioning currently. So we are left with following approach… --- ## [Elasticsearch on-premise licensing](https://discuss.elastic.co/t/elasticsearch-on-premise-licensing/266821)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [March 13, 2021, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-on-premise-licensing/266821 "2021-03-13T16:21:18Z")
Hi all, I have a question regarding Elasticsearch licensing. I got a license for an on-premise Elasticsearch deployment that says max\_nodes=12. I know I can apply it to an Elasticsearch cluster comprised of up to 12 d… --- ## [Grok Debugger in Dev tools Parses differently than logstash](https://discuss.elastic.co/t/grok-debugger-in-dev-tools-parses-differently-than-logstash/266602)
**Author:** [@nfored](https://discuss.elastic.co/u/nfored)\ **Replies:** 1\ **Last updated:** [March 13, 2021, 3:10pm UTC](https://discuss.elastic.co/t/grok-debugger-in-dev-tools-parses-differently-than-logstash/266602 "2021-03-13T15:10:31Z")
I can copy and paste a the log from kibana discover into the debugger, then open up the .conf file copy and past the grok from there, and press simulate. Ever single time without fail it works, but Its only partly workin… --- ## [How to split array json into multiple fields](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 3\ **Last updated:** [March 13, 2021, 2:39pm UTC](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112 "2021-03-13T14:39:27Z")
Hi All, I have a array json which am getting from http end point "summary": { "result": \[ { "status": { "offlineCount": 0, "warningCount": 0, "onlineCount": 1… --- ## [Kibana Data Visualization With Multiple Instances](https://discuss.elastic.co/t/kibana-data-visualization-with-multiple-instances/267076)
**Author:** [@gokhungok](https://discuss.elastic.co/u/gokhungok)\ **Replies:** 1\ **Last updated:** [March 13, 2021, 1:30pm UTC](https://discuss.elastic.co/t/kibana-data-visualization-with-multiple-instances/267076 "2021-03-13T13:30:44Z")
Hello we're searching some data visualization tools and Kibana is one of the best tools for our requirements for now. But we need to clarify one case; We'll use Kibana as feature for one of our products and this product… --- ## [Processing old newsgroup messages](https://discuss.elastic.co/t/processing-old-newsgroup-messages/267147)
**Author:** [@Jack\_Judge](https://discuss.elastic.co/u/Jack_Judge)\ **Replies:** 0\ **Last updated:** [March 13, 2021, 11:33am UTC](https://discuss.elastic.co/t/processing-old-newsgroup-messages/267147 "2021-03-13T11:33:15Z")
Hi, I'm working on a project to index millions of newsgroups messages dating from the early 80s to the present day. The messages are supplied as individual files. I'm using logstash in "read" mode with the multiline code… --- ## [Get logs from my ip only in Paketbeat](https://discuss.elastic.co/t/get-logs-from-my-ip-only-in-paketbeat/267145)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [March 13, 2021, 10:25am UTC](https://discuss.elastic.co/t/get-logs-from-my-ip-only-in-paketbeat/267145 "2021-03-13T10:25:11Z")
Hi, Can anybody tell how can I set a condition in packetbeat.yml to get traffic from my ip only and not from different subnets? In other words the destination.ip: should be only my ip and any other ip in the subnet. I'… --- ## [Configuring logstash for multiple input (port and log file path)](https://discuss.elastic.co/t/configuring-logstash-for-multiple-input-port-and-log-file-path/267140)
**Author:** [@asan](https://discuss.elastic.co/u/asan)\ **Replies:** 0\ **Last updated:** [March 13, 2021, 6:03am UTC](https://discuss.elastic.co/t/configuring-logstash-for-multiple-input-port-and-log-file-path/267140 "2021-03-13T06:03:13Z")
Hi I've Configured three of my network devices to write their logs in separated file in /var/log and also i configured my Logstash to read these file as input and it's working well and i could create index for them and … --- ## [Elastic-Agent system logs stops](https://discuss.elastic.co/t/elastic-agent-system-logs-stops/267135)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [March 13, 2021, 4:19am UTC](https://discuss.elastic.co/t/elastic-agent-system-logs-stops/267135 "2021-03-13T04:19:52Z")
Hi, In de default integration 'system' you can add 'system syslog logs' to collect. I added a few logs here. That's working. But every 2 days or so this logging stops. A workaround is to edit the interation, change not… --- ## [Get the documents with max of @version based on document\_id](https://discuss.elastic.co/t/get-the-documents-with-max-of-version-based-on-document-id/266877)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 1\ **Last updated:** [March 13, 2021, 3:47am UTC](https://discuss.elastic.co/t/get-the-documents-with-max-of-version-based-on-document-id/266877 "2021-03-13T03:47:00Z")
Hi All, I have certain documents in my index with each document having a document\_id as primary key with the combination of "Campaign" and "Camp Line" which will be %{Campaign}%{Camp Line} Every Document has @version. … --- ## [ILM change index settings between phases](https://discuss.elastic.co/t/ilm-change-index-settings-between-phases/267128)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 10:42pm UTC](https://discuss.elastic.co/t/ilm-change-index-settings-between-phases/267128 "2021-03-12T22:42:58Z")
Hello, is it possible to change index settings between phases? I have a issue with moving index to warm phase and then shrink with index settings index.routing.allocation.total\_shards\_per\_node = 1. Because of shrink ac… --- ## [This node does not have the remote\_cluster\_client role](https://discuss.elastic.co/t/this-node-does-not-have-the-remote-cluster-client-role/266294)
**Author:** [@dylan0911](https://discuss.elastic.co/u/dylan0911)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 9:01pm UTC](https://discuss.elastic.co/t/this-node-does-not-have-the-remote-cluster-client-role/266294 "2021-03-12T21:01:53Z")
Hi all, Been going through the doc, the topics and github. Can't seem to find an answer tho this one. I have 2 clusters running in 2 different regions and wanted to test CCR. Both of them are running on 7.11.1. I was a… --- ## [Can we use more master nodes instead of 'coordinating only'](https://discuss.elastic.co/t/can-we-use-more-master-nodes-instead-of-coordinating-only/266123)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 15\ **Last updated:** [March 12, 2021, 8:28pm UTC](https://discuss.elastic.co/t/can-we-use-more-master-nodes-instead-of-coordinating-only/266123 "2021-03-12T20:28:13Z")
Hi, We have an issue that is supposed to be resolved by adding 'coordinating only' nodes: But on AWS (it might be a special case due to the fact that we are using internal company system built on top of AWS for secur… --- ## [Connecting to logstash with Basic Authentication](https://discuss.elastic.co/t/connecting-to-logstash-with-basic-authentication/267121)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 8:28pm UTC](https://discuss.elastic.co/t/connecting-to-logstash-with-basic-authentication/267121 "2021-03-12T20:28:01Z")
Hello, I am using HTTP input plugin in logstash config. I have been always sending data to logstash over HTTP POST method by using logstash API like this; curl -XPOST http://\:9605 -d '{"my": "data"}' also … --- ## ['when not' not working](https://discuss.elastic.co/t/when-not-not-working/267114)
**Author:** [@elbadar](https://discuss.elastic.co/u/elbadar)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 7:08pm UTC](https://discuss.elastic.co/t/when-not-not-working/267114 "2021-03-12T19:08:25Z")
Hi guys, trying to push all log messages that contain 'Failed' or 'ERROR', but doesn't seem to like my syntax. I have looked at the syntax quite a bit but can't seem to nail it down. Didn't find any examples of "when not… --- ## [Problem Posting to Kibana Shared Objects API](https://discuss.elastic.co/t/problem-posting-to-kibana-shared-objects-api/266595)
**Author:** [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 7:00pm UTC](https://discuss.elastic.co/t/problem-posting-to-kibana-shared-objects-api/266595 "2021-03-12T19:00:38Z")
Hello there - I'm trying to use the Saved Objects "import" feature, but I keep getting 415 response codes. I used the export feature to export a dashboard to a ndjson file and then I try to push that same dashboard back … --- ## [Changed Cluster Name - Licensing Not Working Now](https://discuss.elastic.co/t/changed-cluster-name-licensing-not-working-now/267002)
**Author:** [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 6:52pm UTC](https://discuss.elastic.co/t/changed-cluster-name-licensing-not-working-now/267002 "2021-03-12T18:52:59Z")
Hello there, I had a cluster which was running fine, but it was called simply "elasticsearch". I wanted to give it a more specific name, so I applied that to my helm chart (elasticsearch-dev) and restarted all of the da… [Previous page](https://discuss.elastic.co/latest.md?page=1785) [Next page](https://discuss.elastic.co/latest.md?page=1787)