# Latest **URL:** https://discuss.elastic.co/latest.md?page=1801 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1802 --- ## [Rmdir syscall event and file path](https://discuss.elastic.co/t/rmdir-syscall-event-and-file-path/266015)
**Author:** [@alanoe](https://discuss.elastic.co/u/alanoe)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 2:55am UTC](https://discuss.elastic.co/t/rmdir-syscall-event-and-file-path/266015 "2021-03-05T02:55:08Z")
I'm tracking the rmdir syscall with the following rule: audit\_rules: | -a always,exit -F dir=/sasdata -F arch=b64 -S creat -S open -S openat -S unlink -S unlinkat -S symlink -S symlinkat -S link -S linkat -S renam… --- ## [Dissector mapping, pattern not found (Jfrog artifactory service logs)](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305)
**Author:** [@jchiu](https://discuss.elastic.co/u/jchiu)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 2:23am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305 "2021-03-05T02:23:48Z")
Hello all, I am having a hard time parsing the JFrog's artifactory-service log with "dissect". Even after few searches here, I still couldn't figure out what went wrong... Hope that someone could be kind enough to take… --- ## [Elasticstack Audit Logging](https://discuss.elastic.co/t/elasticstack-audit-logging/266093)
**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 2:01am UTC](https://discuss.elastic.co/t/elasticstack-audit-logging/266093 "2021-03-05T02:01:42Z")
Hello, Is there any audit configuration for elastic stack to know which user change dynamic cluster configuration or add/delete dashboard at kibana ? Thank you --- ## [Visualization in Kibana for Custome field](https://discuss.elastic.co/t/visualization-in-kibana-for-custome-field/265993)
**Author:** [@Subrat\_Dash](https://discuss.elastic.co/u/Subrat_Dash)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 2:00am UTC](https://discuss.elastic.co/t/visualization-in-kibana-for-custome-field/265993 "2021-03-05T02:00:24Z")
HI All, We have application log in JSON format with key value pair and those keys are coming as Fields in Kibana GUI. WIth this field I am able to parse in text filter but those field does not have virtualization option… --- ## [Getting Error While executing the Automatic report of Watcher](https://discuss.elastic.co/t/getting-error-while-executing-the-automatic-report-of-watcher/265742)
**Author:** [@Karrie\_Koo](https://discuss.elastic.co/u/Karrie_Koo)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 2:01am UTC](https://discuss.elastic.co/t/getting-error-while-executing-the-automatic-report-of-watcher/265742 "2021-03-01T02:01:42Z")
I received the following errors when I simulate the watcher: Watch\[inlined\] reporting\[error\_report.pdf\] Error response when trying to trigger reporting generation host\[eapvmc1m\], port\[9400\] method\[POST\], path\[/api/repor… --- ## [Reading zookeeper log files -](https://discuss.elastic.co/t/reading-zookeeper-log-files/266308)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 1:32am UTC](https://discuss.elastic.co/t/reading-zookeeper-log-files/266308 "2021-03-05T01:32:12Z")
I use puppet to maintain \*beat across the fleet. If there is a \*beat module in existence I just rename / replace it from the .disabled version. What I don't see to have is a module for zookeeper. It produces a single fi… --- ## [Isuue while overriding JSON object in document](https://discuss.elastic.co/t/isuue-while-overriding-json-object-in-document/266239)
**Author:** [@pawar.pradeep85](https://discuss.elastic.co/u/pawar.pradeep85)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 12:43pm UTC](https://discuss.elastic.co/t/isuue-while-overriding-json-object-in-document/266239 "2021-03-04T12:43:40Z")
Hello, I want to perform a task which requires below activities: Override "xyz" record with the new "xyz" record completely (avoid update/merging) in the existing document. New "xyz" record structure could be differen… --- ## [Unable to ingest data using different JDBC Drivers in one Conf file](https://discuss.elastic.co/t/unable-to-ingest-data-using-different-jdbc-drivers-in-one-conf-file/266261)
**Author:** [@ronaldom](https://discuss.elastic.co/u/ronaldom)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 4:21pm UTC](https://discuss.elastic.co/t/unable-to-ingest-data-using-different-jdbc-drivers-in-one-conf-file/266261 "2021-03-04T16:21:31Z")
Hello, I am currently doing a proof of concept where I try to pull data from 2 different databases (SQL and Snowflake). I don't see any error in the logs when running the conf file and logstash never seem to complete eve… --- ## [Elastalert spike rule not getting any hits](https://discuss.elastic.co/t/elastalert-spike-rule-not-getting-any-hits/266306)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 12:57am UTC](https://discuss.elastic.co/t/elastalert-spike-rule-not-getting-any-hits/266306 "2021-03-05T00:57:27Z")
Hello, I have a scenario to identify if any spike on incoming work items. There is a huge spike around 57000 for works arrived when compared to a max range of 27000 last 3 months as shown below. I tried to use a spi… --- ## [Kibana instance with multi node elastic cluster](https://discuss.elastic.co/t/kibana-instance-with-multi-node-elastic-cluster/266297)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 11:53pm UTC](https://discuss.elastic.co/t/kibana-instance-with-multi-node-elastic-cluster/266297 "2021-03-04T23:53:42Z")
Hi Elastic 7.11.1 Lets' say I have 3 node elastic cluster and I would like to access this cluster through kibana. node-1 node-2 node-3 How should I proceed, I mean, should I: install kibana on each of these 3 serv… --- ## [ILM based on disk space / FIFO indices](https://discuss.elastic.co/t/ilm-based-on-disk-space-fifo-indices/266301)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 11:42pm UTC](https://discuss.elastic.co/t/ilm-based-on-disk-space-fifo-indices/266301 "2021-03-04T23:42:33Z")
Hi, Im wondering if there is option to save Elastic from getting above 90% disk space.. I have ILM policy set to rollover new index every 50 GIGA and Delete phase for 30 Days. i have 10 Tera disk space on my Cluster... … --- ## [Setting a long custom \_id value when inserting into Elastic search](https://discuss.elastic.co/t/setting-a-long-custom-id-value-when-inserting-into-elastic-search/266300)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 11:42pm UTC](https://discuss.elastic.co/t/setting-a-long-custom-id-value-when-inserting-into-elastic-search/266300 "2021-03-04T23:42:18Z")
I'm reading data with filebeat, sending to logstash and it ends up in ES. One issue we have is sometimes Filebeat re-reads files leading to duplicate entries in Elastic Search. One idea was to create a custom \_id value… --- ## [How to combine alerts in one?](https://discuss.elastic.co/t/how-to-combine-alerts-in-one/266046)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 13\ **Last updated:** [March 4, 2021, 11:09pm UTC](https://discuss.elastic.co/t/how-to-combine-alerts-in-one/266046 "2021-03-04T23:09:57Z")
For example, i have infected PC in my network, and it sends many requests to C2 malware domain. So, i setup detection rule for this C2C domain and now i have got 100500 alerts from only 1 IP of infected PC. How to combin… --- ## [Found differences in mapping. Can I simply update the mapping?](https://discuss.elastic.co/t/found-differences-in-mapping-can-i-simply-update-the-mapping/266278)
**Author:** [@Lennart\_Wong](https://discuss.elastic.co/u/Lennart_Wong)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 11:04pm UTC](https://discuss.elastic.co/t/found-differences-in-mapping-can-i-simply-update-the-mapping/266278 "2021-03-04T23:04:10Z")
Hello! I am very new to Elasticsearch and was tasked to add a new cluster and put it to work. Any help is much appreciated! My company has a few existing ES cluster. After I added the new cluster and the indexes, I a… --- ## [Sort by string in kibana's discover (search)](https://discuss.elastic.co/t/sort-by-string-in-kibanas-discover-search/266284)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 5\ **Last updated:** [March 4, 2021, 10:15pm UTC](https://discuss.elastic.co/t/sort-by-string-in-kibanas-discover-search/266284 "2021-03-04T22:15:43Z")
When I go to Kiban's discover and add fields I can sort on date field or Number field but I can't on string. is this by design or I have to change some setting to enable this I am using version 7.10.1 --- ## [Kibana - Visualize Metric](https://discuss.elastic.co/t/kibana-visualize-metric/266201)
**Author:** [@cvasilak](https://discuss.elastic.co/u/cvasilak)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 9:56pm UTC](https://discuss.elastic.co/t/kibana-visualize-metric/266201 "2021-03-04T21:56:40Z")
hey all, apologies but currently I am new to Elastic and Kibana and need some guidance. I have a custom app that puts an index that contains a 'payload' field which is a String and stored as-is. That 'payload' field is … --- ## [maxClauseCount error on Multi Match after Upgrade to 7.10.1](https://discuss.elastic.co/t/maxclausecount-error-on-multi-match-after-upgrade-to-7-10-1/266160)
**Author:** [@dwhite44](https://discuss.elastic.co/u/dwhite44)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 9:39pm UTC](https://discuss.elastic.co/t/maxclausecount-error-on-multi-match-after-upgrade-to-7-10-1/266160 "2021-03-04T21:39:20Z")
We are in the process of upgrading from Elasticsearch 6.5.4 to 7.10.1. We have some searches that worked fine against 6.5.4 but are getting "failed to create query: maxClauseCount is set to 1024" errors against 7.10.1. H… --- ## [Metricbeat Jolokia module - same jolokia.agent.id for multiple agents](https://discuss.elastic.co/t/metricbeat-jolokia-module-same-jolokia-agent-id-for-multiple-agents/266291)
**Author:** [@igorid70](https://discuss.elastic.co/u/igorid70)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 9:22pm UTC](https://discuss.elastic.co/t/metricbeat-jolokia-module-same-jolokia-agent-id-for-multiple-agents/266291 "2021-03-04T21:22:39Z")
Hi I use jolokia module with auto-discovery while the metrics are scrapped from multiple agents. The metrics are properly exported to Elasticsearch, however if I have a few agents from which I collect the same metrics a… --- ## [Index all data from treshold watcher](https://discuss.elastic.co/t/index-all-data-from-treshold-watcher/266222)
**Author:** [@tomaszgorka](https://discuss.elastic.co/u/tomaszgorka)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 11:20am UTC](https://discuss.elastic.co/t/index-all-data-from-treshold-watcher/266222 "2021-03-04T11:20:41Z")
Hi, I have a treshold alert on my data. The data is simply an integer "age" and "phone", and varchars of name and surname, and a date "time". I made a condition that checks if the age is below 18 in the data from last w… --- ## [Annotations and notification](https://discuss.elastic.co/t/annotations-and-notification/266283)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 9:09pm UTC](https://discuss.elastic.co/t/annotations-and-notification/266283 "2021-03-04T21:09:06Z")
Annotation due having opened dashboard can somehow make notification, like sound or something? --- ## [Condition format for pipelines in Kibana](https://discuss.elastic.co/t/condition-format-for-pipelines-in-kibana/265985)
**Author:** [@maria\_k](https://discuss.elastic.co/u/maria_k)\ **Replies:** 0\ **Last updated:** [March 2, 2021, 4:34pm UTC](https://discuss.elastic.co/t/condition-format-for-pipelines-in-kibana/265985 "2021-03-02T16:34:43Z")
Hi! I'm trying to create a pipeline in Kibana (Stack Management -\> Ingest Node pipelines). I'm creating the pipeline with JSON processor, and it works well until I'm adding a condition to it. I've got error when I trie… --- ## [Error while generating a kibana(7.11.1) plugin](https://discuss.elastic.co/t/error-while-generating-a-kibana-7-11-1-plugin/265935)
**Author:** [@Saurabh\_Patil](https://discuss.elastic.co/u/Saurabh_Patil)\ **Replies:** 5\ **Last updated:** [March 4, 2021, 8:58pm UTC](https://discuss.elastic.co/t/error-while-generating-a-kibana-7-11-1-plugin/265935 "2021-03-04T20:58:01Z")
Hello, I am trying to create a custom kibana, I am following the steps. I have downloaded the kibana-master as zip. I have yarn installed on my system also node.js(14.16.0) as per kibana requirements. When I am runni… --- ## [Drilldowns on TSVB](https://discuss.elastic.co/t/drilldowns-on-tsvb/266259)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 8:57pm UTC](https://discuss.elastic.co/t/drilldowns-on-tsvb/266259 "2021-03-04T20:57:38Z")
How use drilldowns on TSVB visualization? I created drilldown to another dashboard and I have no idea how use it, how jump to this another dashboard? --- ## [Adnnotations on TSVB](https://discuss.elastic.co/t/adnnotations-on-tsvb/266265)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 3\ **Last updated:** [March 4, 2021, 8:27pm UTC](https://discuss.elastic.co/t/adnnotations-on-tsvb/266265 "2021-03-04T20:27:24Z")
Can I change order on adnnotaions on TSVB? Sometimes when I have 2 notifications at the same time I cant see details on one of them. This is not possible somehow to make order? Do I need manually change all adnnotations … --- ## [Version Conflict Engine Exception](https://discuss.elastic.co/t/version-conflict-engine-exception/266286)
**Author:** [@edubcn](https://discuss.elastic.co/u/edubcn)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 8:13pm UTC](https://discuss.elastic.co/t/version-conflict-engine-exception/266286 "2021-03-04T20:13:15Z")
Hi. It is the first time I am using Elastic Search technology and I don't know how to face the following issue. \[6c48d578-2f5f-4d7c-9cd1-2dd356906801\_application\_unique\_id/B8Q4QxraQSW026dKuKd8Jg\]\[\[6c48d578-2f5f-4d7c-9c… --- ## [Them-based search](https://discuss.elastic.co/t/them-based-search/266161)
**Author:** [@Amer\_Enaya](https://discuss.elastic.co/u/Amer_Enaya)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 7:38pm UTC](https://discuss.elastic.co/t/them-based-search/266161 "2021-03-04T19:38:08Z")
How can I build them-based search for grocery shopping for example if the customer searches for breakfast the app will show list of products tagged with breakfast only and if he searches for night-film-snacks it will dis… --- ## [Duplicate node on Kibana UI with elasticsearch 6.8.10](https://discuss.elastic.co/t/duplicate-node-on-kibana-ui-with-elasticsearch-6-8-10/266210)
**Author:** [@Guneetbh](https://discuss.elastic.co/u/Guneetbh)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 7:31pm UTC](https://discuss.elastic.co/t/duplicate-node-on-kibana-ui-with-elasticsearch-6-8-10/266210 "2021-03-04T19:31:06Z")
Kibana UI is showing duplicate node with status offline, when the elasticsearch 6.8.10 node restarted. It disappeared after 30 mins and new one came online, started copying shards from 0. There is warning in logs- 20… --- ## [Interpolation in string should be happening but isn't](https://discuss.elastic.co/t/interpolation-in-string-should-be-happening-but-isnt/266275)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 6:59pm UTC](https://discuss.elastic.co/t/interpolation-in-string-should-be-happening-but-isnt/266275 "2021-03-04T18:59:22Z")
I have the following document that went through logstash (v7.10.2): and message was constructed with the snippet: mutate { add\_field =\> { "message" =\> "%{\[http\]\[request\]\[method\]} %{\[url\]\[domain\]}%{\[url\]\[ori… --- ## [Precise/Regex Search](https://discuss.elastic.co/t/precise-regex-search/266141)
**Author:** [@pesc](https://discuss.elastic.co/u/pesc)\ **Replies:** 4\ **Last updated:** [March 4, 2021, 6:50pm UTC](https://discuss.elastic.co/t/precise-regex-search/266141 "2021-03-04T18:50:26Z")
Hi I'm running AppSearch for a research product. I store some IPv6 addresses in it: like 2a02:168:2132::1 2a02:168:2132::2 2a02:168:be04::42 Now the problem is. If I try to search for 2a02:168:2132 it retu… --- ## [Logstash CSV filter - \_dateparsefailure from string to date](https://discuss.elastic.co/t/logstash-csv-filter-dateparsefailure-from-string-to-date/266189)
**Author:** [@pmaganti](https://discuss.elastic.co/u/pmaganti)\ **Replies:** 2\ **Last updated:** [March 4, 2021, 6:06pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-dateparsefailure-from-string-to-date/266189 "2021-03-04T18:06:57Z")
Hello, I am trying to set a field from CSV as @timestamp and is failing with a tag \_dateparsefailure. Following is the config. input { beats { port =\> 5044 } } filter { csv { separator =\> "," autodet… [Previous page](https://discuss.elastic.co/latest.md?page=1800) [Next page](https://discuss.elastic.co/latest.md?page=1802)