# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1800

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1801

---

## [.monitoring-es-7-\* with Data fields conflicts](https://discuss.elastic.co/t/monitoring-es-7-with-data-fields-conflicts/265882)

<div class="topic-metadata">

**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\
**Replies:** 1\
**Last updated:** [March 5, 2021, 12:49pm UTC](https://discuss.elastic.co/t/monitoring-es-7-with-data-fields-conflicts/265882 "2021-03-05T12:49:59Z")

</div>

Hi, I've just setup up Metricbeat to start monitoring my ES cluster. I started receiving data from my Metricbeat instance, but on Kibana while trying to see that monitoring data I'm receiving bunch of data types confli…

---

## [Error in scripted field, working with arrays of objects](https://discuss.elastic.co/t/error-in-scripted-field-working-with-arrays-of-objects/265944)

<div class="topic-metadata">

**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\
**Replies:** 1\
**Last updated:** [March 5, 2021, 12:48pm UTC](https://discuss.elastic.co/t/error-in-scripted-field-working-with-arrays-of-objects/265944 "2021-03-05T12:48:07Z")

</div>

Hi I think I have found an error, in the way Kibana/Scripted Fields handles arrays of objects. My example is this. My ES Data: {"@timestamp":"2021-02-28T22:59:38.786Z", "message":"ExclusionsDeparturesArrivalsExeption:…

---

## [Data Table with Document Status Counts by Month](https://discuss.elastic.co/t/data-table-with-document-status-counts-by-month/265849)

<div class="topic-metadata">

**Author:** [@Darwin](https://discuss.elastic.co/u/Darwin)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 12:05pm UTC](https://discuss.elastic.co/t/data-table-with-document-status-counts-by-month/265849 "2021-03-05T12:05:58Z")

</div>

Hi all, I am new to Kibana and am having trouble creating a desired data table. In short, I have an index comprising documents representing order lifecycle, similar to the image shown below: The order documents incl…

---

## [Helm logstash last\_run\_metadata\_path](https://discuss.elastic.co/t/helm-logstash-last-run-metadata-path/266362)

<div class="topic-metadata">

**Author:** [@josemiguelq](https://discuss.elastic.co/u/josemiguelq)\
**Replies:** 0\
**Last updated:** [March 5, 2021, 12:01pm UTC](https://discuss.elastic.co/t/helm-logstash-last-run-metadata-path/266362 "2021-03-05T12:01:46Z")

</div>

How can I define volumes bind for files used by last\_run\_metadata? In logstash.conf file a defined last\_run\_metadata\_path: "{$HOME}/states/.last\_run\_config" and I want this file persistent for any deploy.

---

## [How to use the search after after getting the result using the geolocation sort](https://discuss.elastic.co/t/how-to-use-the-search-after-after-getting-the-result-using-the-geolocation-sort/266359)

<div class="topic-metadata">

**Author:** [@kushal\_sharma](https://discuss.elastic.co/u/kushal_sharma)\
**Replies:** 0\
**Last updated:** [March 5, 2021, 11:41am UTC](https://discuss.elastic.co/t/how-to-use-the-search-after-after-getting-the-result-using-the-geolocation-sort/266359 "2021-03-05T11:41:07Z")

</div>

Hi, I have an index in which I have a point field that holds the geolocation of the place, and I have a user interface on the frontend where the user can move the map and he will get the top 10 nearest location, everyth…

---

## [Setting a Time Zone for a Dashboard](https://discuss.elastic.co/t/setting-a-time-zone-for-a-dashboard/265941)

<div class="topic-metadata">

**Author:** [@Rakesh\_Rayabarapu](https://discuss.elastic.co/u/Rakesh_Rayabarapu)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 11:39am UTC](https://discuss.elastic.co/t/setting-a-time-zone-for-a-dashboard/265941 "2021-03-05T11:39:26Z")

</div>

Hello Team, Greetings for the Day ! I am looking if it is possible to set a time zone when creating a specific visualization/dashboard/canvas Work pad by using advanced json / css in canvas. The purpose for this is so …

---

## [\[0\] "\_dateparsefailure"](https://discuss.elastic.co/t/0-dateparsefailure/266226)

<div class="topic-metadata">

**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Replies:** 4\
**Last updated:** [March 5, 2021, 11:38am UTC](https://discuss.elastic.co/t/0-dateparsefailure/266226 "2021-03-05T11:38:09Z")

</div>

I want to replace timestamp with my field timestamp. I have tried but getting error so kindly share solution for this problem. "message" =\> "8/12/2020 0:00,jack,jazz,your recent attemt failed.,"9000.00 have been Debited…

---

## [Alerting elastic cloud kibana: Filter tresholds in alerts](https://discuss.elastic.co/t/alerting-elastic-cloud-kibana-filter-tresholds-in-alerts/266250)

<div class="topic-metadata">

**Author:** [@avanlieshout](https://discuss.elastic.co/u/avanlieshout)\
**Replies:** 3\
**Last updated:** [March 5, 2021, 11:33am UTC](https://discuss.elastic.co/t/alerting-elastic-cloud-kibana-filter-tresholds-in-alerts/266250 "2021-03-05T11:33:01Z")

</div>

Hi all, Is there a way to add a filter to alerting? As een example we we don’t want group per “action\_name” with one condition as below, but uphold different conditions for different “action\_name”’s (action\_1 \> 100, ac…

---

## [Watcher webhook url has no port](https://discuss.elastic.co/t/watcher-webhook-url-has-no-port/266279)

<div class="topic-metadata">

**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 11:07am UTC](https://discuss.elastic.co/t/watcher-webhook-url-has-no-port/266279 "2021-03-05T11:07:16Z")

</div>

I have an api endpoint that does not have a port. I can hit the endpoint with java but the webhook requires a port. Is there a work around for this issue?

---

## [Elastic does not reindex all indicies while using a wildcard](https://discuss.elastic.co/t/elastic-does-not-reindex-all-indicies-while-using-a-wildcard/266336)

<div class="topic-metadata">

**Author:** [@konart](https://discuss.elastic.co/u/konart)\
**Replies:** 4\
**Last updated:** [March 5, 2021, 10:30am UTC](https://discuss.elastic.co/t/elastic-does-not-reindex-all-indicies-while-using-a-wildcard/266336 "2021-03-05T10:30:34Z")

</div>

Hi! I'm trying to reindex our indicies for them to use updated mappings. Here is the query: { "source": { "index": "cards\_\*" }, "dest": { "index": "cards\_temp" …

---

## [Filebeat 7.3.1 - Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified](https://discuss.elastic.co/t/filebeat-7-3-1-exiting-setup-template-name-and-setup-template-pattern-have-to-be-set-if-index-name-is-modified/266204)

<div class="topic-metadata">

**Author:** [@dcenaculo](https://discuss.elastic.co/u/dcenaculo)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 9:52am UTC](https://discuss.elastic.co/t/filebeat-7-3-1-exiting-setup-template-name-and-setup-template-pattern-have-to-be-set-if-index-name-is-modified/266204 "2021-03-05T09:52:50Z")

</div>

Hi, I'm using Elastic Stack 7.3.1 and Filebeat 7.3.1. Now, when I try to start the filebeat, the following message appears: PS C:\\filebeat-7.3.1-windows-x86\_64\> .\\filebeat.exe Exiting: setup.template.name and setup.tem…

---

## [Mapping all Bools as String](https://discuss.elastic.co/t/mapping-all-bools-as-string/265583)

<div class="topic-metadata">

**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\
**Replies:** 1\
**Last updated:** [March 5, 2021, 9:35am UTC](https://discuss.elastic.co/t/mapping-all-bools-as-string/265583 "2021-03-05T09:35:22Z")

</div>

When my logstash starts it sends a template to ES where I set the mappings for various fields. I'm getting a lot of conflicts on a lot of fields(150+) that I do not have individual mappings for. These are dynamic as th…

---

## [How to add field to every element from an array with logstash ruby](https://discuss.elastic.co/t/how-to-add-field-to-every-element-from-an-array-with-logstash-ruby/266257)

<div class="topic-metadata">

**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\
**Replies:** 4\
**Last updated:** [March 5, 2021, 9:33am UTC](https://discuss.elastic.co/t/how-to-add-field-to-every-element-from-an-array-with-logstash-ruby/266257 "2021-03-05T09:33:35Z")

</div>

Hi I have an array such like this: "step": \[ "\> MESSAGE AUTOMATE 03/08/2020 18:39:01 : POUR LA JOURNEE DU 20200731 L'ETAPE UNIP A PRIS 00H00", "\> MESSAGE AUTOMATE 03/08/2020 18:39:01 : POUR LA JOURNEE DU 20…

---

## [How to convert apache server uptime in seconds to minutes](https://discuss.elastic.co/t/how-to-convert-apache-server-uptime-in-seconds-to-minutes/266212)

<div class="topic-metadata">

**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 9:30am UTC](https://discuss.elastic.co/t/how-to-convert-apache-server-uptime-in-seconds-to-minutes/266212 "2021-03-05T09:30:44Z")

</div>

how to convert apache server uptime in seconds to minutes

---

## [Docker limits and JVM heap setting](https://discuss.elastic.co/t/docker-limits-and-jvm-heap-setting/266339)

<div class="topic-metadata">

**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\
**Replies:** 0\
**Last updated:** [March 5, 2021, 9:07am UTC](https://discuss.elastic.co/t/docker-limits-and-jvm-heap-setting/266339 "2021-03-05T09:07:10Z")

</div>

Hello People, quick question (confirmation). I've got a server with 32 GB ram and 4vcpcu for one elk node (v7.11.1). If I set this in docker-compose (v.2.4): mem\_limit: 24G mem\_reservation: 4G cpus: 4 And …

---

## [Filebeat 7.9.1 can't ship message to Logstash 7.9.1](https://discuss.elastic.co/t/filebeat-7-9-1-cant-ship-message-to-logstash-7-9-1/266338)

<div class="topic-metadata">

**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\
**Replies:** 0\
**Last updated:** [March 5, 2021, 9:04am UTC](https://discuss.elastic.co/t/filebeat-7-9-1-cant-ship-message-to-logstash-7-9-1/266338 "2021-03-05T09:04:11Z")

</div>

Hi, i have installed Filebeat v7.9.1 on my Windows server and the logstash i am shipping the message is in 7.9.1 as well. However, when i ran the filebeat it seems to not get successful connection to the logstash. Previo…

---

## [Enquiry about sampling in elasticsearch](https://discuss.elastic.co/t/enquiry-about-sampling-in-elasticsearch/266092)

<div class="topic-metadata">

**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\
**Replies:** 0\
**Last updated:** [March 3, 2021, 11:10am UTC](https://discuss.elastic.co/t/enquiry-about-sampling-in-elasticsearch/266092 "2021-03-03T11:10:49Z")

</div>

As we want to reduce the amount log indexing into ES nodes, i would like to know if filebeat or logstash has filters to do sampling? For example, can the filebeat push only 1 of every 5 lines from the log files to logsta…

---

## [Comment stocker le resultat d'une aggregation dans un autre index](https://discuss.elastic.co/t/comment-stocker-le-resultat-dune-aggregation-dans-un-autre-index/266256)

<div class="topic-metadata">

**Author:** [@Corben\_Dallas](https://discuss.elastic.co/u/Corben_Dallas)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 8:33am UTC](https://discuss.elastic.co/t/comment-stocker-le-resultat-dune-aggregation-dans-un-autre-index/266256 "2021-03-05T08:33:25Z")

</div>

Bonjour, afin d'éviter de refaire les mêmes queries, je voudrais stocker les résultat d'une agrégation dans un autre index. exemple des compteurs journaliers mais petite surprises, en 7.9 il n y a pas de moyen simple…

---

## [Message not fully read (response) for request AND incompatible wire format](https://discuss.elastic.co/t/message-not-fully-read-response-for-request-and-incompatible-wire-format/266209)

<div class="topic-metadata">

**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Replies:** 7\
**Last updated:** [March 5, 2021, 8:29am UTC](https://discuss.elastic.co/t/message-not-fully-read-response-for-request-and-incompatible-wire-format/266209 "2021-03-05T08:29:53Z")

</div>

Hello, I am trying ELasticsearch from code source (8.0.0) , and I am getting these warninigs: java.lang.IllegalStateException: Message not fully read (response) for requestId \[542\], handler \[org.elasticsearch.transpor…

---

## [HELP with query =\> Doc with array of 2 values Return 2 hits](https://discuss.elastic.co/t/help-with-query-doc-with-array-of-2-values-return-2-hits/266325)

<div class="topic-metadata">

**Author:** [@Peter4](https://discuss.elastic.co/u/Peter4)\
**Replies:** 1\
**Last updated:** [March 5, 2021, 8:11am UTC](https://discuss.elastic.co/t/help-with-query-doc-with-array-of-2-values-return-2-hits/266325 "2021-03-05T08:11:24Z")

</div>

Hi I need help writing query. doc in ES is { A: "A", B: \["1","2"\] } result from query should be: hits(2x) { A:"A" , B: "1"} { A:"A" , B: "2" } is this possible?

---

## [How to increase speed when using es-hadoop bulk data from hdfs to elasticsearch?](https://discuss.elastic.co/t/how-to-increase-speed-when-using-es-hadoop-bulk-data-from-hdfs-to-elasticsearch/266329)

<div class="topic-metadata">

**Author:** [@Chuckiefan](https://discuss.elastic.co/u/Chuckiefan)\
**Replies:** 0\
**Last updated:** [March 5, 2021, 7:55am UTC](https://discuss.elastic.co/t/how-to-increase-speed-when-using-es-hadoop-bulk-data-from-hdfs-to-elasticsearch/266329 "2021-03-05T07:55:13Z")

</div>

When I use es-hadoop to run a MapReduce bulk data from hdfs to elasticsearch ,the number of reducer is 1 as default. Is there any way to increase the speed of it ?

---

## [Get events for Elasticsearch cluster health degraded , but cluster is green](https://discuss.elastic.co/t/get-events-for-elasticsearch-cluster-health-degraded-but-cluster-is-green/266322)

<div class="topic-metadata">

**Author:** [@oldthreefeng](https://discuss.elastic.co/u/oldthreefeng)\
**Replies:** 0\
**Last updated:** [March 5, 2021, 6:55am UTC](https://discuss.elastic.co/t/get-events-for-elasticsearch-cluster-health-degraded-but-cluster-is-green/266322 "2021-03-05T06:55:40Z")

</div>

the es version is 6.8.8 $ k get events -n sls-prod LAST SEEN TYPE REASON OBJECT MESSAGE 44m Warning Unhealthy elasticsearch/elastic Elasticsearch cluster health degraded but …

---

## [Logstash CIDR Filter : create new field with matched network](https://discuss.elastic.co/t/logstash-cidr-filter-create-new-field-with-matched-network/266282)

<div class="topic-metadata">

**Author:** [@Nybble](https://discuss.elastic.co/u/Nybble)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 6:22am UTC](https://discuss.elastic.co/t/logstash-cidr-filter-create-new-field-with-matched-network/266282 "2021-03-05T06:22:03Z")

</div>

Hello, I'm currently using the Logstash CIDR filter to tag private and public IP. Now, I want to use this plugin with a list of all the networks used within my company and add a field or a tag with network information …

---

## [Can't get filebeat 7.x syslogs into elasticsearch](https://discuss.elastic.co/t/cant-get-filebeat-7-x-syslogs-into-elasticsearch/265739)

<div class="topic-metadata">

**Author:** [@Aholzheimer](https://discuss.elastic.co/u/Aholzheimer)\
**Replies:** 3\
**Last updated:** [March 5, 2021, 6:00am UTC](https://discuss.elastic.co/t/cant-get-filebeat-7-x-syslogs-into-elasticsearch/265739 "2021-03-05T06:00:46Z")

</div>

Hi, I'm wondering if anyone else has had this problem. I am in the process up upgrading filebeat on our CentOS 7 servers. They are running filebeat version 6.8 and our ELK stack is 7.10.1. We are planning to upgrade t…

---

## [Watcher Assistance (ii)](https://discuss.elastic.co/t/watcher-assistance-ii/265261)

<div class="topic-metadata">

**Author:** [@PinkElephant](https://discuss.elastic.co/u/PinkElephant)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 5:45am UTC](https://discuss.elastic.co/t/watcher-assistance-ii/265261 "2021-03-05T05:45:07Z")

</div>

Hey, Trying to use some code I found in the docs, and am met with an error. { "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { "indices": ".moni…

---

## [Unable to use Top hit for ip address in pie chart](https://discuss.elastic.co/t/unable-to-use-top-hit-for-ip-address-in-pie-chart/266054)

<div class="topic-metadata">

**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Replies:** 2\
**Last updated:** [March 5, 2021, 5:44am UTC](https://discuss.elastic.co/t/unable-to-use-top-hit-for-ip-address-in-pie-chart/266054 "2021-03-05T05:44:05Z")

</div>

Hi all, I'm trying to give a pie chart in kibana for ip address to monitor the up/down status of a device. SO many times, device ip may be down, but currently it is up. SO i want to give top hit of ip ordered by time…

---

## [Curate Unable to connect to Elasticsearch cluster](https://discuss.elastic.co/t/curate-unable-to-connect-to-elasticsearch-cluster/266171)

<div class="topic-metadata">

**Author:** [@Bjen\_Shah](https://discuss.elastic.co/u/Bjen_Shah)\
**Replies:** 4\
**Last updated:** [March 5, 2021, 4:43am UTC](https://discuss.elastic.co/t/curate-unable-to-connect-to-elasticsearch-cluster/266171 "2021-03-05T04:43:28Z")

</div>

$ curator\_cli --version curator\_cli, version 5.8.3 $ curator\_cli --loglevel DEBUG --use\_ssl --host 'https://test01.elk.com' --certificate '/etc/pki/www/pams-ca.pem' --port 9200 show\_indices 2021-03-03 16:22:08,053 DEBUG…

---

## [Can I define color range in Object](https://discuss.elastic.co/t/can-i-define-color-range-in-object/266095)

<div class="topic-metadata">

**Author:** [@ChrisaT](https://discuss.elastic.co/u/ChrisaT)\
**Replies:** 1\
**Last updated:** [March 5, 2021, 4:17am UTC](https://discuss.elastic.co/t/can-i-define-color-range-in-object/266095 "2021-03-05T04:17:06Z")

</div>

Hi, im having issues with visualisations and defining colour ranges. Although I can override the colour via the legend in the visualisation adding this into a Canvas ignores the colours I set. It reverts to the default g…

---

## [Default analyser in annotated text](https://discuss.elastic.co/t/default-analyser-in-annotated-text/266313)

<div class="topic-metadata">

**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\
**Replies:** 0\
**Last updated:** [March 5, 2021, 4:05am UTC](https://discuss.elastic.co/t/default-analyser-in-annotated-text/266313 "2021-03-05T04:05:41Z")

</div>

What is the default analyser used in annotated text?is it standard analyser?how do I find it? Can we use a different analyser for annotated text?

---

## [How to find whether the field in elasticSearch is sortable and analysed](https://discuss.elastic.co/t/how-to-find-whether-the-field-in-elasticsearch-is-sortable-and-analysed/265106)

<div class="topic-metadata">

**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\
**Replies:** 8\
**Last updated:** [March 5, 2021, 4:00am UTC](https://discuss.elastic.co/t/how-to-find-whether-the-field-in-elasticsearch-is-sortable-and-analysed/265106 "2021-03-05T04:00:16Z")

</div>

How to find whether the field in elasticSearch is sortable and analysed

[Previous page](https://discuss.elastic.co/latest.md?page=1799)

[Next page](https://discuss.elastic.co/latest.md?page=1801)
