# Latest **URL:** https://discuss.elastic.co/latest.md?page=1848 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1849 --- ## [Script query with nested array - is it possible?](https://discuss.elastic.co/t/script-query-with-nested-array-is-it-possible/263772)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 4:34pm UTC](https://discuss.elastic.co/t/script-query-with-nested-array-is-it-possible/263772 "2021-02-09T16:34:22Z")
Hi, i'm having issue filtering by script on a nested array. this is my sample data and mapping: { "id" : "123", "messages" : \[ { "level" : "error",… --- ## [Convert from dynamodb json to regular json on ingest](https://discuss.elastic.co/t/convert-from-dynamodb-json-to-regular-json-on-ingest/263298)
**Author:** [@ryantomaselli](https://discuss.elastic.co/u/ryantomaselli)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 3:48pm UTC](https://discuss.elastic.co/t/convert-from-dynamodb-json-to-regular-json-on-ingest/263298 "2021-02-09T15:48:52Z")
Hey guys; I'm ingesting DynamoDB stream data into Elastic using a function beat. Thing is the data ingested is all DynamoDB JSON rather than regular JSON. The AWS SDK has a method to do the conversion (see https://doc… --- ## [Providing document\_id in function beat for decode\_json\_fields results in effectively no updates to any records](https://discuss.elastic.co/t/providing-document-id-in-function-beat-for-decode-json-fields-results-in-effectively-no-updates-to-any-records/263434)
**Author:** [@ryantomaselli](https://discuss.elastic.co/u/ryantomaselli)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 3:46pm UTC](https://discuss.elastic.co/t/providing-document-id-in-function-beat-for-decode-json-fields-results-in-effectively-no-updates-to-any-records/263434 "2021-02-09T15:46:49Z")
Hey guys; I'm processing records from DynamoDB via a function beat and it's working great, if I specify the source record as the "document\_id" for the "decode\_json\_fields" process Elastic correctly uses this as the ID f… --- ## [Are replicas just for disaster recovery?](https://discuss.elastic.co/t/are-replicas-just-for-disaster-recovery/263745)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 5\ **Last updated:** [February 9, 2021, 3:44pm UTC](https://discuss.elastic.co/t/are-replicas-just-for-disaster-recovery/263745 "2021-02-09T15:44:50Z")
We are using Elasticsearch mainly as cache, for getting fast results. Currently, we have all the default settings which I think is 1 replica per shard. Should I change this setting to 0? Are replicas just for data recov… --- ## [Errors when enabling tls for APM and Elasticsearch kubernetes deployment](https://discuss.elastic.co/t/errors-when-enabling-tls-for-apm-and-elasticsearch-kubernetes-deployment/263758)
**Author:** [@ciarand](https://discuss.elastic.co/u/ciarand)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 3:44pm UTC](https://discuss.elastic.co/t/errors-when-enabling-tls-for-apm-and-elasticsearch-kubernetes-deployment/263758 "2021-02-09T15:44:02Z")
I am trying to set up tls in my kubernetes cluster that is using the elastic operator version 1.2. I was able to set up tls with Elasticsearch but I am having issues with the APM issue and don't what is the correct confi… --- ## [Field change value](https://discuss.elastic.co/t/field-change-value/263738)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 3:20pm UTC](https://discuss.elastic.co/t/field-change-value/263738 "2021-02-09T15:20:30Z")
I want to change the value of the field user.id , so that it only shows the username. In this example, I want to remove the "slu" so that the value only shows "AlbissR" and not "slu\\AlbissR" --- ## [Parsing Json object array](https://discuss.elastic.co/t/parsing-json-object-array/262487)
**Author:** [@jolaniya](https://discuss.elastic.co/u/jolaniya)\ **Replies:** 6\ **Last updated:** [February 9, 2021, 3:19pm UTC](https://discuss.elastic.co/t/parsing-json-object-array/262487 "2021-02-09T15:19:31Z")
Hi, I have trouble with a xml file. I have applied xml filter on that and after that i am getting 2 outputs. message.GeneralInfo message.ReportNode I guess these are json outputs but json filter is not working on th… --- ## [How to run metricbeat in background?](https://discuss.elastic.co/t/how-to-run-metricbeat-in-background/263595)
**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\ **Replies:** 11\ **Last updated:** [February 9, 2021, 3:17pm UTC](https://discuss.elastic.co/t/how-to-run-metricbeat-in-background/263595 "2021-02-09T15:17:17Z")
Hi Team, I am trying to install Metricbeat 7.10.1 Linux version on my Linux machine but I am unable to run the metricbeat in the Background. Can any one help me on this so that i can run this beat in background itself … --- ## [Can I join an elasticsearch index with geojson to form one index to use as point to point map?](https://discuss.elastic.co/t/can-i-join-an-elasticsearch-index-with-geojson-to-form-one-index-to-use-as-point-to-point-map/263073)
**Author:** [@Mahlatse\_Wiwi](https://discuss.elastic.co/u/Mahlatse_Wiwi)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 3:08pm UTC](https://discuss.elastic.co/t/can-i-join-an-elasticsearch-index-with-geojson-to-form-one-index-to-use-as-point-to-point-map/263073 "2021-02-09T15:08:12Z")
I have an index "index\_travels" which has a field "travel\_from" and "travel\_to". These fields are not geofields. However, I have imported a geojson file "Wards" that has a field "wardID" which is the same as "travel\_fro… --- ## [Elasticsearch 6.8 ignores my field mappings](https://discuss.elastic.co/t/elasticsearch-6-8-ignores-my-field-mappings/262816)
**Author:** [@logben](https://discuss.elastic.co/u/logben)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 3:03pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-ignores-my-field-mappings/262816 "2021-02-09T15:03:57Z")
Hello! I have field mappings for an index like { "index\_patterns": \["logstash-iis2-\*"\], "version":100, "settings":{ "number\_of\_replicas":0, "number\_of\_shards":1, "index.refresh\_interval":"30s" }, "m… --- ## [Elasticstack security](https://discuss.elastic.co/t/elasticstack-security/263747)
**Author:** [@PRODIPTO](https://discuss.elastic.co/u/PRODIPTO)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 2:47pm UTC](https://discuss.elastic.co/t/elasticstack-security/263747 "2021-02-09T14:47:01Z")
Hi I am using a basic license and trying to enable security on a single node ELK cluster . to enable security i have added the below lines in elasticsearch.yml xpack.security.enabled: true discovery.type: single-node I… --- ## [Kibana, timelion not visualizing as expected](https://discuss.elastic.co/t/kibana-timelion-not-visualizing-as-expected/263652)
**Author:** [@sguerrero](https://discuss.elastic.co/u/sguerrero)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 2:45pm UTC](https://discuss.elastic.co/t/kibana-timelion-not-visualizing-as-expected/263652 "2021-02-09T14:45:46Z")
Kibana version: v 7.6.2 Browser: Firefox OS: Centos7 Hello, I'm facing something estrange working with timelion. I expect to see all my visualizations like this: The circle can be red, green or yellow and it only … --- ## [java.lang.IllegalStateException: node \[LKTUQfgPSeClvaOfA8oIdg\] is not available](https://discuss.elastic.co/t/java-lang-illegalstateexception-node-lktuqfgpseclvaofa8oidg-is-not-available/263750)
**Author:** [@praffuln](https://discuss.elastic.co/u/praffuln)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 2:37pm UTC](https://discuss.elastic.co/t/java-lang-illegalstateexception-node-lktuqfgpseclvaofa8oidg-is-not-available/263750 "2021-02-09T14:37:44Z")
I am using Scroll API Elastic search (https://www.elastic.co/guide/en/elasticsearch/client/java-rest/master/java-rest-high-search-scroll.html). Java code is exactly same as describe in link. This code is giving below ex… --- ## [Show an Scripted Value in a Visualization](https://discuss.elastic.co/t/show-an-scripted-value-in-a-visualization/263630)
**Author:** [@Juan\_Montoya](https://discuss.elastic.co/u/Juan_Montoya)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 2:32pm UTC](https://discuss.elastic.co/t/show-an-scripted-value-in-a-visualization/263630 "2021-02-09T14:32:52Z")
Hi, I'm creating a dashboard and now I need to show the unitary value of the products, this value must be dynamical along the time, the unitary value must be calculated adding all the prices and adding all the units to … --- ## [Filebeat autodiscover+kubernetes module or add\_kubernetes\_metadata processor?](https://discuss.elastic.co/t/filebeat-autodiscover-kubernetes-module-or-add-kubernetes-metadata-processor/263662)
**Author:** [@offero](https://discuss.elastic.co/u/offero)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 2:32pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-kubernetes-module-or-add-kubernetes-metadata-processor/263662 "2021-02-09T14:32:40Z")
I just set up a new helm chart to use add\_kubernetes\_metadata processor, which seemed to be the way to get k8s annotations based on my googling. But, in the process of trying to figure out which fields are being added, I… --- ## [Problem to get xml response with http\_poller plugin](https://discuss.elastic.co/t/problem-to-get-xml-response-with-http-poller-plugin/263749)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 2:32pm UTC](https://discuss.elastic.co/t/problem-to-get-xml-response-with-http-poller-plugin/263749 "2021-02-09T14:32:39Z")
Hi all, I want to load data from an api rest (response xml) using logstash 7.9.0 this is my config file: input { http\_poller { urls =\> { method =\> get url1 =\> "https://\*\*\*\*\*\*\*/rest/1.0/geography"… --- ## [Can We Bind Default Dashboard to custom Index pattern?](https://discuss.elastic.co/t/can-we-bind-default-dashboard-to-custom-index-pattern/263719)
**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 2:08pm UTC](https://discuss.elastic.co/t/can-we-bind-default-dashboard-to-custom-index-pattern/263719 "2021-02-09T14:08:08Z")
Hi Team, Can we Bind Default Beats Dashboards to Custom index pattern through logstash ?? Actually I am trying to Bind the Default Dashboards to custom Index pattern but Unfortunately I am unable to find anything on I… --- ## [Date, Scripted Fields](https://discuss.elastic.co/t/date-scripted-fields/263341)
**Author:** [@Rajasekhar\_Muthamset](https://discuss.elastic.co/u/Rajasekhar_Muthamset)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 1:49pm UTC](https://discuss.elastic.co/t/date-scripted-fields/263341 "2021-02-09T13:49:06Z")
Hello All, I'm getting data as below from my application ....."extraParams":\[{"name":"Item","value":"item1"},{"name":"DateTime","value":"0001519156380000"},.... I would like the data of the field value as Date instead… --- ## [How to kill filebeat (docker) process?](https://discuss.elastic.co/t/how-to-kill-filebeat-docker-process/263561)
**Author:** [@skime](https://discuss.elastic.co/u/skime)\ **Replies:** 5\ **Last updated:** [February 9, 2021, 1:36pm UTC](https://discuss.elastic.co/t/how-to-kill-filebeat-docker-process/263561 "2021-02-09T13:36:54Z")
Hello, how can I kill filebeat process that was started on docker? Linux situation by "top" command: I have restarted docker daemon, and it don't want to start - probably because of the filebeat, last log from docker … --- ## [Proximity with intervals query question](https://discuss.elastic.co/t/proximity-with-intervals-query-question/263730)
**Author:** [@Daantie](https://discuss.elastic.co/u/Daantie)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 1:12pm UTC](https://discuss.elastic.co/t/proximity-with-intervals-query-question/263730 "2021-02-09T13:12:28Z")
Hi all! I'm trying to understand the inner workings of intervals query and I'm confused and hope that anyone can explain this to me a bit. So I have encountered this piece of data (mind the bold words for the query later… --- ## [Logstash - Elastichsearch Output - ILM](https://discuss.elastic.co/t/logstash-elastichsearch-output-ilm/263700)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 9:15am UTC](https://discuss.elastic.co/t/logstash-elastichsearch-output-ilm/263700 "2021-02-09T09:15:26Z")
Good day, I'm trying to establish an Index Lifecycle Management for my indices by using the elasticsearch output in Logstash. This is the elasticsearch output plugin config: output { if "tomcat" in \[type\] { elas… --- ## [Heartbeat timeout](https://discuss.elastic.co/t/heartbeat-timeout/262509)
**Author:** [@rckvanwijk](https://discuss.elastic.co/u/rckvanwijk)\ **Replies:** 5\ **Last updated:** [February 9, 2021, 1:18pm UTC](https://discuss.elastic.co/t/heartbeat-timeout/262509 "2021-02-09T13:18:14Z")
Hi there, we've got several heartbeats running for the uptime monitoring aspect. Usually it works fine but sometimes the uptime says the applications are down (while our second tool and our manual tests say they are not… --- ## [Filebeat logs not being published to Elastic](https://discuss.elastic.co/t/filebeat-logs-not-being-published-to-elastic/263605)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 5\ **Last updated:** [February 9, 2021, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-logs-not-being-published-to-elastic/263605 "2021-02-09T13:11:19Z")
I am sending csv data from filebeat to elastic search following this guide: I have created an ingest pipeline, tested it with the \_simulate api, and everything looks fine. This is my filebeat configuration: fil… --- ## [Moving from daily to weekly indices, advice needed](https://discuss.elastic.co/t/moving-from-daily-to-weekly-indices-advice-needed/263710)
**Author:** [@MichelV](https://discuss.elastic.co/u/MichelV)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 12:52pm UTC](https://discuss.elastic.co/t/moving-from-daily-to-weekly-indices-advice-needed/263710 "2021-02-09T12:52:29Z")
After running into the 1000/1000 shards issue, I need to reduce the number of shards in use preferably without needing to remove to many old indices. Currently the configuration is set to daily indices, so we decided to … --- ## [Logstash filter with separator " \_"](https://discuss.elastic.co/t/logstash-filter-with-separator/263675)
**Author:** [@vik1](https://discuss.elastic.co/u/vik1)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 12:47pm UTC](https://discuss.elastic.co/t/logstash-filter-with-separator/263675 "2021-02-09T12:47:45Z")
Hello, I am using logstash to collect data from FortiGate. I have one special field to check the number of connections per day. This "vpn" field looks like sz\_forti, szec\_forti. I need to take the first characters before… --- ## [Kibana services not running in ubuntu 18.04](https://discuss.elastic.co/t/kibana-services-not-running-in-ubuntu-18-04/263680)
**Author:** [@Abhiranjan\_Singh](https://discuss.elastic.co/u/Abhiranjan_Singh)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 12:40pm UTC](https://discuss.elastic.co/t/kibana-services-not-running-in-ubuntu-18-04/263680 "2021-02-09T12:40:42Z")
Kibana services not running in ubuntu 18.04, earlier it was working fine since i have updated , it is not working now , getting below error at Module.require (internal/modules/cjs/loader.js:637:17)"} {"type":"log","@ti… --- ## [KIbana reporting problem](https://discuss.elastic.co/t/kibana-reporting-problem/263410)
**Author:** [@Ged](https://discuss.elastic.co/u/Ged)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 11:58am UTC](https://discuss.elastic.co/t/kibana-reporting-problem/263410 "2021-02-09T11:58:10Z")
Hi Team, I've problem when generating CSV report based on search result. I've two Kibanas (7.8.0) connected to one Elasticsearch cluster so I've added the same xpack.reporting.encryptionKey in both instances as describ… --- ## [Heartbeat monitoring](https://discuss.elastic.co/t/heartbeat-monitoring/263329)
**Author:** [@tech](https://discuss.elastic.co/u/tech)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 11:44am UTC](https://discuss.elastic.co/t/heartbeat-monitoring/263329 "2021-02-09T11:44:04Z")
Hi, Is there a way to monitor up time for spot instances --- ## [Its always necesary to use throttling in watcher alerts?](https://discuss.elastic.co/t/its-always-necesary-to-use-throttling-in-watcher-alerts/263409)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 11:42am UTC](https://discuss.elastic.co/t/its-always-necesary-to-use-throttling-in-watcher-alerts/263409 "2021-02-09T11:42:01Z")
Hi, Im using this schedule in my watcher alert "trigger" : { "schedule" : { "daily" : { "at" : "17:00" } } } so I was wandering if it is necesary to use throttling in the watchers. --- ## [Kibana Alert on missing process](https://discuss.elastic.co/t/kibana-alert-on-missing-process/263495)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 11:36am UTC](https://discuss.elastic.co/t/kibana-alert-on-missing-process/263495 "2021-02-09T11:36:15Z")
Hi, I've a question about setting up an alert on a missing process on several hosts I'm monitoring. I've setup a Metric threshold alert with instances on hostnames, which should do the job, but I don't think, this aler… [Previous page](https://discuss.elastic.co/latest.md?page=1847) [Next page](https://discuss.elastic.co/latest.md?page=1849)