# Latest **URL:** https://discuss.elastic.co/latest.md?page=1863 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1864 --- ## [How to search a keyword with spaces inside Kibana KQL?](https://discuss.elastic.co/t/how-to-search-a-keyword-with-spaces-inside-kibana-kql/262912)
**Author:** [@asp0818](https://discuss.elastic.co/u/asp0818)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 11:26pm UTC](https://discuss.elastic.co/t/how-to-search-a-keyword-with-spaces-inside-kibana-kql/262912 "2021-02-01T23:26:03Z")
Hi, I'm trying to narrow down my search for the iphone with OS 14. However there is space in between. How can I extract this from the field type? Mozilla/5.0 (iPhone; CPU iPhone OS 14\_1 like Mac OS X) Thanks! --- ## [Question in elastic search to get specific records with specific date and time range](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/262804)
**Author:** [@Kin\_Wan](https://discuss.elastic.co/u/Kin_Wan)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 11:11pm UTC](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/262804 "2021-02-01T23:11:39Z")
I would like to grep all the records that match "successLoginID" between 2021-01-07 to 2021-01-13 with time range from 09:00 to 18:00 but no records found with the below code. Can advise what's the problem? Thanks. GET… --- ## [ECK Cluster Freezes when network fails for one node](https://discuss.elastic.co/t/eck-cluster-freezes-when-network-fails-for-one-node/262856)
**Author:** [@Raz\_Harush](https://discuss.elastic.co/u/Raz_Harush)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 11:08pm UTC](https://discuss.elastic.co/t/eck-cluster-freezes-when-network-fails-for-one-node/262856 "2021-02-01T23:08:25Z")
Hi, Lastely we have been doing a couple of tests to ES clusters over K8s. Unfortunately, one of our tests didn’t go as we anticipated A little bit of practical information about our cluster: The deployment of ECK is… --- ## [Elasticsearch NEST upgrade strategies](https://discuss.elastic.co/t/elasticsearch-nest-upgrade-strategies/262873)
**Author:** [@MS\_Maverick](https://discuss.elastic.co/u/MS_Maverick)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 5:35pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-upgrade-strategies/262873 "2021-02-01T17:35:05Z")
Hi, We have multiple ETL jobs and multiple microservices which talk with Elasticsearch. We use NEST client to library for this. With rapid upgrades to Elasticsearch and new versions coming in rapid succession, we have t… --- ## [Elastic.Apm and NETFramework 4.8](https://discuss.elastic.co/t/elastic-apm-and-netframework-4-8/262896)
**Author:** [@phat\_vapes69](https://discuss.elastic.co/u/phat_vapes69)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 8:27pm UTC](https://discuss.elastic.co/t/elastic-apm-and-netframework-4-8/262896 "2021-02-01T20:27:41Z")
Hello there, I have been trying to search for a solution to this issue and cannot seem to find any assistance online. When using Elastic.Apm 1.7.1 with netframework 4.8, during our build I am unable to successfully ins… --- ## [Are users and roles functionality available in the free version?](https://discuss.elastic.co/t/are-users-and-roles-functionality-available-in-the-free-version/262905)
**Author:** [@paul0](https://discuss.elastic.co/u/paul0)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 9:39pm UTC](https://discuss.elastic.co/t/are-users-and-roles-functionality-available-in-the-free-version/262905 "2021-02-01T21:39:32Z")
We're currently running an instance of Kibana internally (v7.8.0). Previously, I know the user/roles features were only available via XPack and the paid license. Is this still the case? If it isn't, is there any docs abo… --- ## [SIEM Rule Failures](https://discuss.elastic.co/t/siem-rule-failures/260409)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 5\ **Last updated:** [February 1, 2021, 9:39pm UTC](https://discuss.elastic.co/t/siem-rule-failures/260409 "2021-02-01T21:39:14Z")
Hello Everyone, We are on Elastic 7.9 and are mainly using it as a SIEM, suddenly all of the SIEM rules start to fail and not just some but all of them. --- ## [Group buckets by another fields keyword](https://discuss.elastic.co/t/group-buckets-by-another-fields-keyword/261940)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 9:34pm UTC](https://discuss.elastic.co/t/group-buckets-by-another-fields-keyword/261940 "2021-02-01T21:34:24Z")
Hi, I want to visualize a Bar Chart with Vega. I have Houses and Rooms. (Rooms can have different colors) Each house(1, 2, 3, ...) has several rooms (1, 2, 3, ...). The house and room fields are from type number. … --- ## [Bool OR term quey does not match any document](https://discuss.elastic.co/t/bool-or-term-quey-does-not-match-any-document/262908)
**Author:** [@JackMaarek](https://discuss.elastic.co/u/JackMaarek)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 9:18pm UTC](https://discuss.elastic.co/t/bool-or-term-quey-does-not-match-any-document/262908 "2021-02-01T21:18:58Z")
Hello guys, I am trying to dive into DDD architecture by implement CQRS and event sourcing pattern into my app. The app is a simple blog api with article management and user authentication. I'm using elastic to store my… --- ## [Api Key](https://discuss.elastic.co/t/api-key/262907)
**Author:** [@ukuleleplayer](https://discuss.elastic.co/u/ukuleleplayer)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 9:03pm UTC](https://discuss.elastic.co/t/api-key/262907 "2021-02-01T21:03:19Z")
I'm trying to see if there's a way to replace the cloud.auth variable in the auditbeat.yml file with an api-key. Is there any way to do this? --- ## [Filter in ids query](https://discuss.elastic.co/t/filter-in-ids-query/262902)
**Author:** [@yish-yish](https://discuss.elastic.co/u/yish-yish)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 8:40pm UTC](https://discuss.elastic.co/t/filter-in-ids-query/262902 "2021-02-01T20:40:29Z")
Hi elastic wizards. I have in my code base an ids query, and I need to add filtering capabilities to the query i.e. in addition to the ids filter, I need to be able to add additional term based filters. Is there a way … --- ## [ES Cannot Index Monitoring Indices](https://discuss.elastic.co/t/es-cannot-index-monitoring-indices/262695)
**Author:** [@lnorman](https://discuss.elastic.co/u/lnorman)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 8:57pm UTC](https://discuss.elastic.co/t/es-cannot-index-monitoring-indices/262695 "2021-02-01T20:57:48Z")
I am trying to turn on stack monitoring, however, metricbeat keeps logging something that starts like this: WARN \[elasticsearch\] elasticsearch/client.go:408 Cannot index event publisher.Event and in… --- ## [Elastic SIEM alerts + auditbeats - only few are working fine](https://discuss.elastic.co/t/elastic-siem-alerts-auditbeats-only-few-are-working-fine/262810)
**Author:** [@Orion](https://discuss.elastic.co/u/Orion)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 8:16pm UTC](https://discuss.elastic.co/t/elastic-siem-alerts-auditbeats-only-few-are-working-fine/262810 "2021-02-01T20:16:21Z")
Hello, first post in the forum, since using free Elastic licence, would like to seek for some support in the discussion board. Currently I'm experimenting on SIEM \> Detections module, have Elastic stack installed on one… --- ## [Allowing multiple mappings in Elastic Search 6](https://discuss.elastic.co/t/allowing-multiple-mappings-in-elastic-search-6/262864)
**Author:** [@Jack4](https://discuss.elastic.co/u/Jack4)\ **Replies:** 5\ **Last updated:** [February 1, 2021, 8:14pm UTC](https://discuss.elastic.co/t/allowing-multiple-mappings-in-elastic-search-6/262864 "2021-02-01T20:14:44Z")
Hi All, I am upgrading from Elastic 5.6.16 to 6.8.13 and it's complaining about "Rejecting mapping update to...as the final mapping would have more than 1 type" Without switching to single mapping, is there a workarou… --- ## [Adding A New Field in Elasticsearch Ingest Pipeline](https://discuss.elastic.co/t/adding-a-new-field-in-elasticsearch-ingest-pipeline/262891)
**Author:** [@PRODIPTO](https://discuss.elastic.co/u/PRODIPTO)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 7:55pm UTC](https://discuss.elastic.co/t/adding-a-new-field-in-elasticsearch-ingest-pipeline/262891 "2021-02-01T19:55:39Z")
Hi I am working on a migration activity where we are moving from a OSS version of Elastic Stack to Platinum version. We were using Logstash in the OSS cluster to parse the logs but in the Platinum cluster we are going t… --- ## [Snapshots are failing](https://discuss.elastic.co/t/snapshots-are-failing/262769)
**Author:** [@SteveHodges](https://discuss.elastic.co/u/SteveHodges)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 7:52pm UTC](https://discuss.elastic.co/t/snapshots-are-failing/262769 "2021-02-01T19:52:46Z")
After a network outage, the elasticsearch snapshot is failing. After I restored the connection to the NAS I am getting errors when I try to take a snapshot. The error is access\_denied\_exception Here is the command I r… --- ## [Elastic search( 7.10.0 ) stops working after we query from kibana](https://discuss.elastic.co/t/elastic-search-7-10-0-stops-working-after-we-query-from-kibana/262736)
**Author:** [@Subhom\_Dutta](https://discuss.elastic.co/u/Subhom_Dutta)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 7:52pm UTC](https://discuss.elastic.co/t/elastic-search-7-10-0-stops-working-after-we-query-from-kibana/262736 "2021-02-01T19:52:30Z")
Hi, Below are the logs of the single node cluster of elastic search before it stops \[2021-01-30T15:34:36,160\]\[INFO \]\[o.e.x.m.p.NativeController\] \[ELK-NODE\] Native controller process has stopped - no new native processe… --- ## [No index pattern for logstash](https://discuss.elastic.co/t/no-index-pattern-for-logstash/262297)
**Author:** [@mof\_cmsmith](https://discuss.elastic.co/u/mof_cmsmith)\ **Replies:** 26\ **Last updated:** [February 1, 2021, 7:41pm UTC](https://discuss.elastic.co/t/no-index-pattern-for-logstash/262297 "2021-02-01T19:41:55Z")
I am struggling a bit with this. Windows 2019 running ELK 7.10.2. I have it ingesting filebeat, metricbeat, etc. Proper indices and patterns are present, except... Logstash has an index, so I know its ingesting. How… --- ## [How to custom the fetch metrics by docker containers?](https://discuss.elastic.co/t/how-to-custom-the-fetch-metrics-by-docker-containers/262836)
**Author:** [@MatteoM](https://discuss.elastic.co/u/MatteoM)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 7:31pm UTC](https://discuss.elastic.co/t/how-to-custom-the-fetch-metrics-by-docker-containers/262836 "2021-02-01T19:31:14Z")
Hi to everyone! I'm new to kibana and elasticsearch. I've seen that in kibana is possible to fetch metrics by docker containers. How can i custum this metric to fetch the consumption disk space of a container ? And i… --- ## [How to calculate minimum and maximun of Session duration](https://discuss.elastic.co/t/how-to-calculate-minimum-and-maximun-of-session-duration/262852)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 7\ **Last updated:** [February 1, 2021, 6:03pm UTC](https://discuss.elastic.co/t/how-to-calculate-minimum-and-maximun-of-session-duration/262852 "2021-02-01T18:03:37Z")
Hello everyone!! i am new to Kibana and i lik to know how to calculate the minimum and maximum of a session. Thanks for your help. --- ## [Instrument elasticsearch search with Jaeger (or elastic APM)](https://discuss.elastic.co/t/instrument-elasticsearch-search-with-jaeger-or-elastic-apm/262869)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 5:12pm UTC](https://discuss.elastic.co/t/instrument-elasticsearch-search-with-jaeger-or-elastic-apm/262869 "2021-02-01T17:12:23Z")
In order to tune our cluster, we want to understand what elasticsearch do when a query arrive. Usually we use jaeger for that , (I am a big fan of elasticAPM too), is it possible to profile elasticsearch like that? So … --- ## [Mysql query speed slow, cause offset](https://discuss.elastic.co/t/mysql-query-speed-slow-cause-offset/262868)
**Author:** [@star\_gold](https://discuss.elastic.co/u/star_gold)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 4:58pm UTC](https://discuss.elastic.co/t/mysql-query-speed-slow-cause-offset/262868 "2021-02-01T16:58:58Z")
this is my config file: \` input { jdbc { jdbc\_driver\_library =\> "/tmp/logstash/logstash-7.9.3/mysql/mysql-connector-java-8.0.16.jar" jdbc\_driver\_class =\> "com.mysql.cj.jdbc.Driver" jdbc\_page\_size =\> 3 tracking\_col… --- ## [Logstash error](https://discuss.elastic.co/t/logstash-error/262558)
**Author:** [@suraj.ghorp](https://discuss.elastic.co/u/suraj.ghorp)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 4:57pm UTC](https://discuss.elastic.co/t/logstash-error/262558 "2021-02-01T16:57:49Z")
Hi Masters, I am pulling logs from cloud based WAF through logstash. i am getting an below error. WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by org.jruby.ext.openss… --- ## [Latest value in a gauge](https://discuss.elastic.co/t/latest-value-in-a-gauge/262659)
**Author:** [@luc.c](https://discuss.elastic.co/u/luc.c)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 4:42pm UTC](https://discuss.elastic.co/t/latest-value-in-a-gauge/262659 "2021-02-01T16:42:03Z")
Hi, I'm having trouble building a gauge based on two relevant fields: requestID and Status. My goal is to show the number of requestID for each status; it is not a cumulative count though, as the same requestID can ass… --- ## [Scripted Fields + Filtering](https://discuss.elastic.co/t/scripted-fields-filtering/262047)
**Author:** [@Rob\_wylde](https://discuss.elastic.co/u/Rob_wylde)\ **Replies:** 7\ **Last updated:** [February 1, 2021, 4:40pm UTC](https://discuss.elastic.co/t/scripted-fields-filtering/262047 "2021-02-01T16:40:13Z")
I am trying to use painless to calculate the duration of 2 ISO8601 timestamps The field is correctly populated with the returned string i have defined. However the field can't not be filtered upon / with. This is my firs… --- ## [Filebeat to GCP PubSub](https://discuss.elastic.co/t/filebeat-to-gcp-pubsub/262859)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-to-gcp-pubsub/262859 "2021-02-01T16:08:20Z")
I want to setup the environment similar to this: but to use GCP PubSub instead of Kafka. I know, that Filebeat does not have a PubSub output. What is the easiest way to achieve this? I know, that Logstash can be use… --- ## [Grok filters are not getting applied](https://discuss.elastic.co/t/grok-filters-are-not-getting-applied/262851)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 4:07pm UTC](https://discuss.elastic.co/t/grok-filters-are-not-getting-applied/262851 "2021-02-01T16:07:16Z")
grok patterns are not getting applied. Please apply. grok debugger shows no issue. please find the filebeat.yml filebeat.inputs: - type: log paths: - C:/Program Files (x86)/dox/onion.log fields: tags: appl… --- ## [Watcher or Alerting?](https://discuss.elastic.co/t/watcher-or-alerting/262827)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 3:58pm UTC](https://discuss.elastic.co/t/watcher-or-alerting/262827 "2021-02-01T15:58:21Z")
Hi all. I heard that Watcher will be discontinued in the future. Is that right? Watcher at the moment is the only way (and not easy I must say) to integrate Atlassian OPSGenie alerting management with Elastic but it is … --- ## [Scaling\_factor is missing in generated template using ECS Tooling 1.7.0](https://discuss.elastic.co/t/scaling-factor-is-missing-in-generated-template-using-ecs-tooling-1-7-0/262511)
**Author:** [@mxu](https://discuss.elastic.co/u/mxu)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 3:37pm UTC](https://discuss.elastic.co/t/scaling-factor-is-missing-in-generated-template-using-ecs-tooling-1-7-0/262511 "2021-02-01T15:37:58Z")
Hi, I am adding a custom schema for CPU Usage, configured as following. The ECS Tooling 1.7.0 generated template without "scaling\_factor" field. - name: 1MinAvg.Pct level: custom type: scaled\_float s… --- ## [Convert Map Shape to layer or Region](https://discuss.elastic.co/t/convert-map-shape-to-layer-or-region/262828)
**Author:** [@stexxen](https://discuss.elastic.co/u/stexxen)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 3:31pm UTC](https://discuss.elastic.co/t/convert-map-shape-to-layer-or-region/262828 "2021-02-01T15:31:55Z")
Kibana maps is great! however I'd like to know if this is possible I am able to import layers with the various Layer tools i.e. Administrative Regions via EMS is one possibility. I'm also able to create shapes via the… [Previous page](https://discuss.elastic.co/latest.md?page=1862) [Next page](https://discuss.elastic.co/latest.md?page=1864)