# Latest **URL:** https://discuss.elastic.co/latest.md?page=1790 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1791 --- ## [Logstash - Nested fields?](https://discuss.elastic.co/t/logstash-nested-fields/266851)
**Author:** [@SaraC](https://discuss.elastic.co/u/SaraC)\ **Replies:** 6\ **Last updated:** [March 11, 2021, 10:51am UTC](https://discuss.elastic.co/t/logstash-nested-fields/266851 "2021-03-11T10:51:20Z")
Hi, I have the following sample of log: { "@timestamp": "2021-03-10T17:30:58.899Z", "@version": "1", "Actor": \[ { "ID": "Microsoft Intune", "Type": 1 }, { … --- ## [New template doesn't works Geoip](https://discuss.elastic.co/t/new-template-doesnt-works-geoip/266801)
**Author:** [@hoff](https://discuss.elastic.co/u/hoff)\ **Replies:** 5\ **Last updated:** [March 11, 2021, 9:25am UTC](https://discuss.elastic.co/t/new-template-doesnt-works-geoip/266801 "2021-03-11T09:25:04Z")
Hi, I need to create geoip map but in my mapping field location is float type. I have some issue with create new template. I want to change field type from float to geo\_point. When I try to put new template and delete o… --- ## [Recursive search query for all leaf nodes(childs)](https://discuss.elastic.co/t/recursive-search-query-for-all-leaf-nodes-childs/266791)
**Author:** [@Paresh\_Vaniya](https://discuss.elastic.co/u/Paresh_Vaniya)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 10:35am UTC](https://discuss.elastic.co/t/recursive-search-query-for-all-leaf-nodes-childs/266791 "2021-03-11T10:35:04Z")
Hi All, I need help for getting all the leaf nodes details using elasticsearch query. If I have search for root node id and it contains childEntities then it should get all the child id and its name in result. I have t… --- ## [Graph Relations not displayed](https://discuss.elastic.co/t/graph-relations-not-displayed/266775)
**Author:** [@Pruthvi\_Raj\_Venkates](https://discuss.elastic.co/u/Pruthvi_Raj_Venkates)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 10:27am UTC](https://discuss.elastic.co/t/graph-relations-not-displayed/266775 "2021-03-11T10:27:26Z")
Hi Team, I have installed Elastic Search elasticsearch-7.11.1 and Kibana on Windows 10 machine. I was exploring graph functionality using a Trial license wherein I am trying to view the relationships among the different… --- ## [Different ILM alias based on fields like indeces](https://discuss.elastic.co/t/different-ilm-alias-based-on-fields-like-indeces/266919)
**Author:** [@abev](https://discuss.elastic.co/u/abev)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 10:13am UTC](https://discuss.elastic.co/t/different-ilm-alias-based-on-fields-like-indeces/266919 "2021-03-11T10:13:42Z")
hey guys, I’m trying to send different logs to different ILM aliases I’ve found it here for indexes: https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#indices-option-es and here for ILM: h… --- ## [How to remove custom metadata fields from users and roles](https://discuss.elastic.co/t/how-to-remove-custom-metadata-fields-from-users-and-roles/266646)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 5\ **Last updated:** [March 11, 2021, 9:17am UTC](https://discuss.elastic.co/t/how-to-remove-custom-metadata-fields-from-users-and-roles/266646 "2021-03-11T09:17:35Z")
Hi, I am running a 7.10 Stack with Security enabled and I am currently playing around with the ElasticSearch REST API for creating users, roles and so on. The usecase here is to add advanced information to the security … --- ## [What is included in Cloud by Elastic?](https://discuss.elastic.co/t/what-is-included-in-cloud-by-elastic/266911)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 9:07am UTC](https://discuss.elastic.co/t/what-is-included-in-cloud-by-elastic/266911 "2021-03-11T09:07:20Z")
Here are some useful links: Elastic Cloud Feature Matrix. It tells exactly what you could expect on cloud by elastic and the required license level for a given feature. You can check the pricing using the Pricing Calc… --- ## [Elastic Cloud SaaS on AWS](https://discuss.elastic.co/t/elastic-cloud-saas-on-aws/266899)
**Author:** [@AJ18](https://discuss.elastic.co/u/AJ18)\ **Replies:** 3\ **Last updated:** [March 11, 2021, 9:03am UTC](https://discuss.elastic.co/t/elastic-cloud-saas-on-aws/266899 "2021-03-11T09:03:45Z")
Are all features of ELK+ Beats in Elastic Cloud available in the SaaS cloud solution on AWS? Is Elastic Agent supported by Elastic SaaS cloud solution? --- ## [Java APM Agent Micrometer Integration not handling TimeGauge as desired](https://discuss.elastic.co/t/java-apm-agent-micrometer-integration-not-handling-timegauge-as-desired/265833)
**Author:** [@bplies](https://discuss.elastic.co/u/bplies)\ **Replies:** 3\ **Last updated:** [March 11, 2021, 9:00am UTC](https://discuss.elastic.co/t/java-apm-agent-micrometer-integration-not-handling-timegauge-as-desired/265833 "2021-03-11T09:00:48Z")
Kibana version: 7.10.0 Elasticsearch version: 7.10.0 APM Server version: 7.10.0 APM Agent language and version: Java 1.20.0 Browser version: N/A Original install method (e.g. download page, yum, deb, from source, e… --- ## [\[RUM\] Enrich document with HTTP request headers](https://discuss.elastic.co/t/rum-enrich-document-with-http-request-headers/266844)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 9:00am UTC](https://discuss.elastic.co/t/rum-enrich-document-with-http-request-headers/266844 "2021-03-11T09:00:34Z")
Kibana version: 7.11.0 Elasticsearch version: 7.11.0 APM Server version: 7.11.0 APM Agent language and version: RUM JS library To respect user privacy, our front load-balancers inject geoip data (X-Geo-Country ..) wi… --- ## [Match rule not working](https://discuss.elastic.co/t/match-rule-not-working/266666)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 6\ **Last updated:** [March 11, 2021, 8:51am UTC](https://discuss.elastic.co/t/match-rule-not-working/266666 "2021-03-11T08:51:25Z")
Hello, I am trying to add a threat intelligence in my SIEM, I downloaded the database of malware hashes, and I am using auditbeat file integrity to detect malware, and then I created a rmatch rule like that: and the… --- ## [Drop kubernetes metadata](https://discuss.elastic.co/t/drop-kubernetes-metadata/266885)
**Author:** [@Nurlan199206](https://discuss.elastic.co/u/Nurlan199206)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 5:52am UTC](https://discuss.elastic.co/t/drop-kubernetes-metadata/266885 "2021-03-11T05:52:42Z")
i'm trying drop some unneccesary fields, but i still see metadata i follow this docs: https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html "ecs": { "version": "1.1.0" }, "host": { … --- ## [Getting Alerts and Actions to work](https://discuss.elastic.co/t/getting-alerts-and-actions-to-work/266086)
**Author:** [@Ilai\_Velocity](https://discuss.elastic.co/u/Ilai_Velocity)\ **Replies:** 3\ **Last updated:** [March 11, 2021, 8:37am UTC](https://discuss.elastic.co/t/getting-alerts-and-actions-to-work/266086 "2021-03-11T08:37:49Z")
Hey guys, I got a few questions that I encountered when trying to setup alerts and actions. We're on the Elasticsearch as a Service (Managed) solution. Question 1 - I'm following https://www.elastic.co/guide/en/kiban… --- ## [Filebeat low throughput and slow log files read](https://discuss.elastic.co/t/filebeat-low-throughput-and-slow-log-files-read/266905)
**Author:** [@aksadvance](https://discuss.elastic.co/u/aksadvance)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 8:31am UTC](https://discuss.elastic.co/t/filebeat-low-throughput-and-slow-log-files-read/266905 "2021-03-11T08:31:46Z")
Filebeat log transfer latency We have observed the high latency on Filebeat while publishing the logs to Logstash, this latency is more than 2 hours. We are using the below setup for log transfer. Filebeat (11 nodes) -\>… --- ## [Elastic 7.10.2: no way to automatically create the first index. Manually kickstart ILM still mandatory?](https://discuss.elastic.co/t/elastic-7-10-2-no-way-to-automatically-create-the-first-index-manually-kickstart-ilm-still-mandatory/266811)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 8:30am UTC](https://discuss.elastic.co/t/elastic-7-10-2-no-way-to-automatically-create-the-first-index-manually-kickstart-ilm-still-mandatory/266811 "2021-03-11T08:30:21Z")
Dear experts, I am running Elastic 7.10.2. I would like to manage a first index with syntax filebeat-7.10.2-postfix-2021.03.10-000001. Thanks to ILM rollover mechanism next one would be filebeat-7.10.2-postfix-2021.03.1… --- ## [Can't find Logstash /bin directory](https://discuss.elastic.co/t/cant-find-logstash-bin-directory/266902)
**Author:** [@Muhammad\_Suleman](https://discuss.elastic.co/u/Muhammad_Suleman)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 8:06am UTC](https://discuss.elastic.co/t/cant-find-logstash-bin-directory/266902 "2021-03-11T08:06:22Z")
I did install my ElK stack with the help of docker compose on my bare metal window server 2019. I can't find my logstash bin directory for running my logstash. Thanks, --- ## [No transaction data sent to APM Server](https://discuss.elastic.co/t/no-transaction-data-sent-to-apm-server/266779)
**Author:** [@georgepopovici](https://discuss.elastic.co/u/georgepopovici)\ **Replies:** 11\ **Last updated:** [March 11, 2021, 7:34am UTC](https://discuss.elastic.co/t/no-transaction-data-sent-to-apm-server/266779 "2021-03-11T07:34:01Z")
Kibana version: 7.11.1 Elasticsearch version: 7.11.1 APM Server version: { "build\_date": "2021-02-15T12:37:48Z", "build\_sha": "e77061bb3aaedae5ae8dd0ca193eb662513aedde", "version": "7.11.0" } APM Agent language… --- ## [Raw message output](https://discuss.elastic.co/t/raw-message-output/266895)
**Author:** [@st1988](https://discuss.elastic.co/u/st1988)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 7:21am UTC](https://discuss.elastic.co/t/raw-message-output/266895 "2021-03-11T07:21:22Z")
Hi, I currently have an issue where I am sending Syslog to Logstash and then forwarding to ELK and via syslog to a SIEM. The SIEM however is struggling to understand the log as think it is being sent in a format its not … --- ## [Create user role with Kibana visualization permissions](https://discuss.elastic.co/t/create-user-role-with-kibana-visualization-permissions/266125)
**Author:** [@Chinmaya\_Panigrahi](https://discuss.elastic.co/u/Chinmaya_Panigrahi)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 7:03am UTC](https://discuss.elastic.co/t/create-user-role-with-kibana-visualization-permissions/266125 "2021-03-11T07:03:09Z")
Hi, I want to create a user with role which will have permission to access certain visualizations of certain dashboards. I want to know what should be the cURL command to achieve this. --- ## [Elasticsearch stopped working on kubernetes](https://discuss.elastic.co/t/elasticsearch-stopped-working-on-kubernetes/266891)
**Author:** [@Naomi](https://discuss.elastic.co/u/Naomi)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 6:35am UTC](https://discuss.elastic.co/t/elasticsearch-stopped-working-on-kubernetes/266891 "2021-03-11T06:35:05Z")
I have an elastic cluster on kubernetes. containing 3 master pods 2 data pods and 2 clients. everything worked fine until I installed it on environment which containing 6 kubenrtes nodes 3 Master and 3 none. now I keep g… --- ## [Агрессивный merge сегментов ES](https://discuss.elastic.co/t/merge-es/266829)
**Author:** [@GreenX](https://discuss.elastic.co/u/GreenX)\ **Replies:** 3\ **Last updated:** [March 11, 2021, 6:14am UTC](https://discuss.elastic.co/t/merge-es/266829 "2021-03-11T06:14:34Z")
День добрый! В продолжение темы про "НЕ идеальный" подсчет \_score: Я попробовал настроить более агрессивный merge в ES, но не особо получилось. Из всех крутилов в: https://github.com/elastic/elasticsearch/blob/7.10/s… --- ## [Control DropDown in Kibana](https://discuss.elastic.co/t/control-dropdown-in-kibana/266769)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 5:21am UTC](https://discuss.elastic.co/t/control-dropdown-in-kibana/266769 "2021-03-11T05:21:51Z")
I am not getting month-day. Month August and Total days 31 but I am only getting random 5 days. --- ## [Week over Week Percentage Change for Metric Field](https://discuss.elastic.co/t/week-over-week-percentage-change-for-metric-field/266810)
**Author:** [@Rakesh\_Rayabarapu](https://discuss.elastic.co/u/Rakesh_Rayabarapu)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 5:06am UTC](https://discuss.elastic.co/t/week-over-week-percentage-change-for-metric-field/266810 "2021-03-11T05:06:42Z")
Hello Team, Please help me to get Table visualization with Category Field, Current Week Metric, Previous Week, % change as columns. --- ## [Installing logstash-output-kusto plugin thru logstash container deployment](https://discuss.elastic.co/t/installing-logstash-output-kusto-plugin-thru-logstash-container-deployment/266684)
**Author:** [@omkarg81](https://discuss.elastic.co/u/omkarg81)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 3:47am UTC](https://discuss.elastic.co/t/installing-logstash-output-kusto-plugin-thru-logstash-container-deployment/266684 "2021-03-11T03:47:26Z")
Could someone please provide guidance on how we can install additional plugins like logstash-output-kusto using a command like bin/logstash-plugin install logstash-output-kusto inside a logstash container? Any example c… --- ## [Filebeat 7.10.1 and 7.11.0 not able to send the logs from windows servers to logstash and getting stuck at \[Api Webserver\] agent - Successfully started Logstash API endpoint {:port=\>9600}](https://discuss.elastic.co/t/filebeat-7-10-1-and-7-11-0-not-able-to-send-the-logs-from-windows-servers-to-logstash-and-getting-stuck-at-api-webserver-agent-successfully-started-logstash-api-endpoint-port-9600/266420)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 8\ **Last updated:** [March 11, 2021, 3:06am UTC](https://discuss.elastic.co/t/filebeat-7-10-1-and-7-11-0-not-able-to-send-the-logs-from-windows-servers-to-logstash-and-getting-stuck-at-api-webserver-agent-successfully-started-logstash-api-endpoint-port-9600/266420 "2021-03-11T03:06:26Z")
I installed filebeat v7.10.1 on a windows 2016 server. I am trying to send a log file from that server to logstash server and I am using the beats plugin to parse the data. When I am running the beats config file it get… --- ## [Watherでインデックスサイズを監視する](https://discuss.elastic.co/t/wather/266638)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 2:53am UTC](https://discuss.elastic.co/t/wather/266638 "2021-03-11T02:53:13Z")
とあるインデックスのサイズを定期的に監視し、閾値を超過したら通知するような仕組みを作りたいです。 watcherでインデックスを定期的に監視し、一定の容量を超過したら通知するように出来ないかと考えているのですが、watcherの監視設定で特定のインデックスのサイズを取得することは可能なのでしょうか？ --- ## [Missing columns in Kibana generated CSV](https://discuss.elastic.co/t/missing-columns-in-kibana-generated-csv/266865)
**Author:** [@noah.solomon](https://discuss.elastic.co/u/noah.solomon)\ **Replies:** 4\ **Last updated:** [March 11, 2021, 12:52am UTC](https://discuss.elastic.co/t/missing-columns-in-kibana-generated-csv/266865 "2021-03-11T00:52:56Z")
Hi, I'm using Kibana 7.10. I'm generating a CSV from a saved search in the Kibana UI. The generated CSV doesn't contain all of the columns that are in the index that I'm viewing. The columns that are added to the CSV ar… --- ## [Grok... is it just me or is it really that difficult?](https://discuss.elastic.co/t/grok-is-it-just-me-or-is-it-really-that-difficult/266872)
**Author:** [@louis12356](https://discuss.elastic.co/u/louis12356)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 12:15am UTC](https://discuss.elastic.co/t/grok-is-it-just-me-or-is-it-really-that-difficult/266872 "2021-03-11T00:15:50Z")
Hey, for some days now i try to figure out how to properly use grok to filter my logfiles. I use the classic? setup with filebeat as the input of logstash and elasticsearch and kibana for visualizing. So far i managed… --- ## [Color each individual column in vega](https://discuss.elastic.co/t/color-each-individual-column-in-vega/266863)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 11:07pm UTC](https://discuss.elastic.co/t/color-each-individual-column-in-vega/266863 "2021-03-10T23:07:58Z")
Hi Vega experts, i need help on coloring my Vega Chart, i have a chart with multi series duration and i want to give each column a different color, i mean for example start1 to end1 color blue, start2 to end2 color red a… --- ## [ES7 Multiply scores from boolean queries](https://discuss.elastic.co/t/es7-multiply-scores-from-boolean-queries/266130)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 10:31pm UTC](https://discuss.elastic.co/t/es7-multiply-scores-from-boolean-queries/266130 "2021-03-10T22:31:11Z")
Hey Is it possible in some way to multiply the scores of two boolean queries? I now BoolQuery.Should can add the scores together, but not multiply. Another possibility is function scores, but here I can only provide a… [Previous page](https://discuss.elastic.co/latest.md?page=1789) [Next page](https://discuss.elastic.co/latest.md?page=1791)