# Latest **URL:** https://discuss.elastic.co/latest.md?page=1823 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1824 --- ## [Alert Variables in email action - EQL](https://discuss.elastic.co/t/alert-variables-in-email-action-eql/264695)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 5:32pm UTC](https://discuss.elastic.co/t/alert-variables-in-email-action-eql/264695 "2021-02-22T17:32:42Z")
Hello, Can someone please help to add additional field to the alert variable? I have mentioned the Detection EQL rule logic below. sequence with maxspan=5m \[authentication where event.type == "authentication\_failure"\]… --- ## [Kibana Fleet "Another broken 7.11.1 upgrade"](https://discuss.elastic.co/t/kibana-fleet-another-broken-7-11-1-upgrade/264628)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 7\ **Last updated:** [February 22, 2021, 5:19pm UTC](https://discuss.elastic.co/t/kibana-fleet-another-broken-7-11-1-upgrade/264628 "2021-02-22T17:19:53Z")
I'll be honest this is painful so far every upgrade from kibana 7.1 to 7.11.1 has resulting in something going wrong 1 prod cluster and 2 dev clusters. Seems I just have terrible luck. All index's have been default for m… --- ## [Double closing a Transaction in a try-with-resource?](https://discuss.elastic.co/t/double-closing-a-transaction-in-a-try-with-resource/264920)
**Author:** [@b333to](https://discuss.elastic.co/u/b333to)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 5:13pm UTC](https://discuss.elastic.co/t/double-closing-a-transaction-in-a-try-with-resource/264920 "2021-02-22T17:13:53Z")
Hello I have the following WARN log: WARN co.elastic.apm.agent.impl.transaction.AbstractSpan - End has already been called:... And it's coming from this block of code: final Transaction transaction = ElasticApm.start… --- ## [Drill down visualization for json data that contains nested structure](https://discuss.elastic.co/t/drill-down-visualization-for-json-data-that-contains-nested-structure/264173)
**Author:** [@kinnub](https://discuss.elastic.co/u/kinnub)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:52pm UTC](https://discuss.elastic.co/t/drill-down-visualization-for-json-data-that-contains-nested-structure/264173 "2021-02-22T16:52:45Z")
Continuing the discussion from Drill Down Visualization: I am looking for a solution and my use case is similar to the discussion (above link ). Could you please let me know if there is any solution/workaround for it? M… --- ## [Rsyslog to send logs to logstash](https://discuss.elastic.co/t/rsyslog-to-send-logs-to-logstash/264973)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 11\ **Last updated:** [February 22, 2021, 2:41pm UTC](https://discuss.elastic.co/t/rsyslog-to-send-logs-to-logstash/264973 "2021-02-22T14:41:57Z")
Hi, Configured rsyslog to send logs to logstash. But kibana dosen't receive. Please help. OS : Ubuntu 20.04 \ cat /etc/elasticsearch/elasticsearch.yml Elasticsearch performs poorly when the system is swapping t… --- ## [Strings to numerics](https://discuss.elastic.co/t/strings-to-numerics/265090)
**Author:** [@Marc2](https://discuss.elastic.co/u/Marc2)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:46pm UTC](https://discuss.elastic.co/t/strings-to-numerics/265090 "2021-02-22T16:46:23Z")
Hello community! I am new at this and my problem is the following: I am trying to use some .csv files to represent data in Kibana, and to do that i am using the code i found on this web: https://alexmarquardt.com/2020/… --- ## [Heartbeat HTTP Monitor - GET with JSON Body and Response](https://discuss.elastic.co/t/heartbeat-http-monitor-get-with-json-body-and-response/262168)
**Author:** [@bbek](https://discuss.elastic.co/u/bbek)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 4:43pm UTC](https://discuss.elastic.co/t/heartbeat-http-monitor-get-with-json-body-and-response/262168 "2021-02-22T16:43:12Z")
Hello! I'm trying to get heartbeat to perform an HTTP GET , while combining a JSON body with the GET request to the page. My goal is to query an elastic index, take the fields and analyze for up/down accordingly. In t… --- ## [Failed to enable security by setting \[xpack.security.enabled\] to \[true\] in the elasticsearch.yml](https://discuss.elastic.co/t/failed-to-enable-security-by-setting-xpack-security-enabled-to-true-in-the-elasticsearch-yml/264554)
**Author:** [@haithem899](https://discuss.elastic.co/u/haithem899)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 4:08pm UTC](https://discuss.elastic.co/t/failed-to-enable-security-by-setting-xpack-security-enabled-to-true-in-the-elasticsearch-yml/264554 "2021-02-22T16:08:48Z")
Hello, I'm trying to enable security by setting \[xpack.security.enabled\] to \[true\] in the elasticsearch.yml but after this action, the elasticsearch service failed to start. have you any idea to rsolve this issue? thank… --- ## [Kafka keeps syslog timestamp in the message](https://discuss.elastic.co/t/kafka-keeps-syslog-timestamp-in-the-message/264902)
**Author:** [@ywsong2](https://discuss.elastic.co/u/ywsong2)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:04pm UTC](https://discuss.elastic.co/t/kafka-keeps-syslog-timestamp-in-the-message/264902 "2021-02-22T16:04:12Z")
Hi, I am having an issue with syslog timestamp when the Filebeat sends system module logs (/var/log/messages and /var/log/secure) through Kafka output. If I send logs straight to Elasticsearch, the default Filebeat's da… --- ## [Mapping use dynamic strict](https://discuss.elastic.co/t/mapping-use-dynamic-strict/264957)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [February 22, 2021, 4:03pm UTC](https://discuss.elastic.co/t/mapping-use-dynamic-strict/264957 "2021-02-22T16:03:07Z")
I am trying to test out this feature but not getting what I want for example PUT \_index\_template/sachin\_quick\_test { "index\_patterns": \["sachin\_quick\_test-\*"\], "template": { "settings": { "number\_of\_shard… --- ## [Endpoint Security Detection Rule Failed](https://discuss.elastic.co/t/endpoint-security-detection-rule-failed/265011)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:00pm UTC](https://discuss.elastic.co/t/endpoint-security-detection-rule-failed/265011 "2021-02-22T16:00:21Z")
Elastic Cloud, 7.11, added a brand new Agent on Windows 10: Why does it fail? --- ## [ILM - Index size doubles during shrink process](https://discuss.elastic.co/t/ilm-index-size-doubles-during-shrink-process/265019)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 3:38pm UTC](https://discuss.elastic.co/t/ilm-index-size-doubles-during-shrink-process/265019 "2021-02-22T15:38:40Z")
Hi - I've noticed the index size when moved from hot to warm phase doubles up before shrinking in size. Just curious to know if this is the expected behavior and if there is a way to avoid the doubling up part of that f… --- ## [401 Unathorized when trying to call the Kibana API](https://discuss.elastic.co/t/401-unathorized-when-trying-to-call-the-kibana-api/263225)
**Author:** [@rbjoergensen](https://discuss.elastic.co/u/rbjoergensen)\ **Replies:** 9\ **Last updated:** [February 22, 2021, 3:35pm UTC](https://discuss.elastic.co/t/401-unathorized-when-trying-to-call-the-kibana-api/263225 "2021-02-22T15:35:48Z")
I am trying to use a generated API key to export my workpads. However no matter what i do i end up getting a 401 unathorized back from Kibana. This happens even when i use the exact curl command from the documentation h… --- ## [Export to CSV on 7.9.3](https://discuss.elastic.co/t/export-to-csv-on-7-9-3/264113)
**Author:** [@Francisco\_Navarro](https://discuss.elastic.co/u/Francisco_Navarro)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 3:11pm UTC](https://discuss.elastic.co/t/export-to-csv-on-7-9-3/264113 "2021-02-22T15:11:38Z")
I'm trying to export the content of an index to CSV using Kibana 7.9.3 I've seen that this is possible on 7.10.0 but I cannot find the button on 7.9.3, is it not available? 7.10 7.9 Best regards! --- ## [How can I index HTML tags](https://discuss.elastic.co/t/how-can-i-index-html-tags/265078)
**Author:** [@peterbe](https://discuss.elastic.co/u/peterbe)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 3:09pm UTC](https://discuss.elastic.co/t/how-can-i-index-html-tags/265078 "2021-02-22T15:09:27Z")
I use the standard tokenizer and I don't use the html\_strip char filter. How can I index HTML tags? In fact, I want to be able to search with and without the \< and \> characters. I.e. a search for \ should match… --- ## [Grok matching multi-lines saving first and last value to separate fields](https://discuss.elastic.co/t/grok-matching-multi-lines-saving-first-and-last-value-to-separate-fields/264958)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 11\ **Last updated:** [February 22, 2021, 3:08pm UTC](https://discuss.elastic.co/t/grok-matching-multi-lines-saving-first-and-last-value-to-separate-fields/264958 "2021-02-22T15:08:30Z")
Hello everyone, as the caption indicates I am trying to match multiple-lines of logs of which I would like to save first occurence of timestamp to separate field than last occurence of the timestamp. I am using codec mu… --- ## [Elastic machine learning on a different node but same server](https://discuss.elastic.co/t/elastic-machine-learning-on-a-different-node-but-same-server/264314)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 5\ **Last updated:** [February 22, 2021, 3:03pm UTC](https://discuss.elastic.co/t/elastic-machine-learning-on-a-different-node-but-same-server/264314 "2021-02-22T15:03:50Z")
Hi, I'm thinking about running two containers: elasticsearch master/data/ingest/ node -\> container A elasticsearch machine learning -\> container B but they must run on the same server. I think there might be two appr… --- ## [Kibana Date Histogram restricting date on graph](https://discuss.elastic.co/t/kibana-date-histogram-restricting-date-on-graph/264098)
**Author:** [@Ganesh\_Rao\_B](https://discuss.elastic.co/u/Ganesh_Rao_B)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 3:01pm UTC](https://discuss.elastic.co/t/kibana-date-histogram-restricting-date-on-graph/264098 "2021-02-22T15:01:01Z")
I am using Kibana visualization 'vertical bar'. In Vertical bar on x-axis i am using Date histogram and x axis minimum interval is given monthly . Data is shown in Vertical bar but its overlapped ,because X axis is shown… --- ## [Facet - Authors field with more names with separated values](https://discuss.elastic.co/t/facet-authors-field-with-more-names-with-separated-values/265017)
**Author:** [@Andrea\_Epifani](https://discuss.elastic.co/u/Andrea_Epifani)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:53pm UTC](https://discuss.elastic.co/t/facet-authors-field-with-more-names-with-separated-values/265017 "2021-02-22T14:53:42Z")
Hi, i have indexed my documents with this fields: title (text) description (text) authors (text) authors contains one or more names separated with comma. Is there a method to create facet with the single name and no… --- ## [TSVB Time filter question](https://discuss.elastic.co/t/tsvb-time-filter-question/264095)
**Author:** [@Vincent\_Vanclef](https://discuss.elastic.co/u/Vincent_Vanclef)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:50pm UTC](https://discuss.elastic.co/t/tsvb-time-filter-question/264095 "2021-02-22T14:50:48Z")
I've tried finding some documentation on it, but how does the TSVB visualization calculcate its aggregation? Especially a simple "count". It shows way too high data count compared to the total documents: I am just try… --- ## [Aggregations: sort by mutliple terms](https://discuss.elastic.co/t/aggregations-sort-by-mutliple-terms/265081)
**Author:** [@Douglas\_Leister](https://discuss.elastic.co/u/Douglas_Leister)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 2:38pm UTC](https://discuss.elastic.co/t/aggregations-sort-by-mutliple-terms/265081 "2021-02-22T14:38:04Z")
I have a mapping of businesses, for which I am using an aggregation to calculate average ratings for the businesses grouped by business id. Sorting the aggregation by business id or average rating works fine. My issue… --- ## [Colourful bullets in Discover section](https://discuss.elastic.co/t/colourful-bullets-in-discover-section/265062)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 2:35pm UTC](https://discuss.elastic.co/t/colourful-bullets-in-discover-section/265062 "2021-02-22T14:35:56Z")
Can we show the following image like bullets for particular entries? For example, I have a field to show the 'Priority' of a log such as HIGH, CRITICAL, LOW. I want to show a red bullet when priority is CRITICAL, orange … --- ## [Reading from specific index under alias](https://discuss.elastic.co/t/reading-from-specific-index-under-alias/265079)
**Author:** [@b\_bal](https://discuss.elastic.co/u/b_bal)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 2:35pm UTC](https://discuss.elastic.co/t/reading-from-specific-index-under-alias/265079 "2021-02-22T14:35:17Z")
Hello! I have different indices named myindex-. Every night a new index is created(with a different number), so we use an alias(myalias) to keep track of the index that contains the most recent documents. Under that al… --- ## [Return score in reference UI](https://discuss.elastic.co/t/return-score-in-reference-ui/265014)
**Author:** [@pakwai122](https://discuss.elastic.co/u/pakwai122)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:34pm UTC](https://discuss.elastic.co/t/return-score-in-reference-ui/265014 "2021-02-22T14:34:43Z")
in Query Tester, documents will show the document score. How can I get this information back into reference UI? --- ## [Help me understand Elasticsearch structure](https://discuss.elastic.co/t/help-me-understand-elasticsearch-structure/264859)
**Author:** [@butaminas](https://discuss.elastic.co/u/butaminas)\ **Replies:** 5\ **Last updated:** [February 22, 2021, 2:31pm UTC](https://discuss.elastic.co/t/help-me-understand-elasticsearch-structure/264859 "2021-02-22T14:31:57Z")
I'm new to Elasticsearch and I've been reading and playing around with it a lot lately but I still can't understand one thing and am hoping to find the answer here. From my understanding, Elasticsearch is not something … --- ## [Elasticsearch not starting after UID and GID change](https://discuss.elastic.co/t/elasticsearch-not-starting-after-uid-and-gid-change/265054)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 2:31pm UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-after-uid-and-gid-change/265054 "2021-02-22T14:31:23Z")
Hello! I have a cluster of 2 nodes and I wanted to do the snapshot by setting up the NFS server and a directory as the repository. I had read that all nodes should have the same UID and GID. Thus, I changed them using co… --- ## [Data is showing wrong when i add some nested fields](https://discuss.elastic.co/t/data-is-showing-wrong-when-i-add-some-nested-fields/263748)
**Author:** [@Juan\_Alvarez](https://discuss.elastic.co/u/Juan_Alvarez)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:30pm UTC](https://discuss.elastic.co/t/data-is-showing-wrong-when-i-add-some-nested-fields/263748 "2021-02-22T14:30:48Z")
hello, i need help to visualiza the next json: { "\_index": "signaturetrace", "\_type": "\_doc", "\_id": "pFVCUHcBaUOzInAquLbu", "\_version": 17, "\_score": null, "\_source": { "contractId": "baeb4e31-56a8-4b4e-32a3-08d856… --- ## [Cors in Kibana](https://discuss.elastic.co/t/cors-in-kibana/264575)
**Author:** [@seba\_galban](https://discuss.elastic.co/u/seba_galban)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 2:27pm UTC](https://discuss.elastic.co/t/cors-in-kibana/264575 "2021-02-22T14:27:33Z")
Hi Everyone, We have a problem when we want to get the cookie from Kibana 7.10.0. We have two scenarios: If we don´t use the credentials: true, In the header response we have the set-cookie attribute but the browser… --- ## [Stringo Lab - data analysis with kibana - password protected -need help to reset](https://discuss.elastic.co/t/stringo-lab-data-analysis-with-kibana-password-protected-need-help-to-reset/264710)
**Author:** [@fperrotta](https://discuss.elastic.co/u/fperrotta)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 2:26pm UTC](https://discuss.elastic.co/t/stringo-lab-data-analysis-with-kibana-password-protected-need-help-to-reset/264710 "2021-02-22T14:26:08Z")
Hi, My lab web interface is password protected but I can not remember the password for elastic user. Can anyone from elastic please reset it? Thanks a lot. --- ## [Logstash mutate rename](https://discuss.elastic.co/t/logstash-mutate-rename/265043)
**Author:** [@Jokie74](https://discuss.elastic.co/u/Jokie74)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:25pm UTC](https://discuss.elastic.co/t/logstash-mutate-rename/265043 "2021-02-22T14:25:08Z")
hello dear community, I have a question about the "mutate rename" filter option. In my logstash filter I have this: mutate { rename =\> { "\[fields\]\[host\]\[name\]" =\> "\[host\]\[name\]" … [Previous page](https://discuss.elastic.co/latest.md?page=1822) [Next page](https://discuss.elastic.co/latest.md?page=1824)