# Latest **URL:** https://discuss.elastic.co/latest.md?page=1904 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1905 --- ## [Customize ingest pipelines in Fleet / Elastic Agent](https://discuss.elastic.co/t/customize-ingest-pipelines-in-fleet-elastic-agent/260236)
**Author:** [@icious](https://discuss.elastic.co/u/icious)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 12:35pm UTC](https://discuss.elastic.co/t/customize-ingest-pipelines-in-fleet-elastic-agent/260236 "2021-01-08T12:35:06Z")
Hello, I was fiddling around with Elastic Agent and Fleet to integrate multiple log sources in the same agent, and I am getting "Provided Grok expressions do not match field value" error with Fortinet integration. Usin… --- ## [Nested fields & strict dynamic mapping](https://discuss.elastic.co/t/nested-fields-strict-dynamic-mapping/260533)
**Author:** [@loldebyte](https://discuss.elastic.co/u/loldebyte)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 11:27am UTC](https://discuss.elastic.co/t/nested-fields-strict-dynamic-mapping/260533 "2021-01-08T11:27:54Z")
Hello, Following this stackoverlow question, i came here before opening an issue on github. An indice with the following mapping: { "test2": { "mappings": { "dynamic": "strict", "properties"… --- ## [Why logstash's redis output plugin send list data with \\n?](https://discuss.elastic.co/t/why-logstashs-redis-output-plugin-send-list-data-with-n/260525)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 11:24am UTC](https://discuss.elastic.co/t/why-logstashs-redis-output-plugin-send-list-data-with-n/260525 "2021-01-08T11:24:46Z")
Using Redis output pluginedit to send data to Redis. output { redis { host =\> \["${REDIS\_URL}"\] data\_type =\> "list" key =\> "ID" codec =\> line { format =\> "%{\[@metadata\]\[\_id\]}"} } } Check Redis' data: … --- ## [Elasticsearch cluster - please review my configuration and advise](https://discuss.elastic.co/t/elasticsearch-cluster-please-review-my-configuration-and-advise/259502)
**Author:** [@Ged](https://discuss.elastic.co/u/Ged)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 11:07am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-please-review-my-configuration-and-advise/259502 "2021-01-08T11:07:37Z")
Hi Team, I want to share my ELK stack cluster configuration shown below asking you to review it and share your thoughts and answer some questions. Elasticsearch nodes configuration for ELK SERVER A1 and ELK SERVER B1… --- ## [Circuit breaker exception because of increased time range](https://discuss.elastic.co/t/circuit-breaker-exception-because-of-increased-time-range/260317)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 3\ **Last updated:** [January 8, 2021, 11:03am UTC](https://discuss.elastic.co/t/circuit-breaker-exception-because-of-increased-time-range/260317 "2021-01-08T11:03:17Z")
Hi All, I am facing 429 circuit breaker exception when somebody selects a window of time range more than 7 days. Is there a way to lock the time filter,so that no user can search beyond 7 days. --- ## [Sort documents and reduce overlapping ranges](https://discuss.elastic.co/t/sort-documents-and-reduce-overlapping-ranges/260526)
**Author:** [@lucre](https://discuss.elastic.co/u/lucre)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 9:50am UTC](https://discuss.elastic.co/t/sort-documents-and-reduce-overlapping-ranges/260526 "2021-01-08T09:50:42Z")
Hello, apologies if the query may be trivial, I am just starting using Elasticsearch. I have an index with usage docs (not nested) with a datetime\_start, datetime\_end, company\_id, user\_id, product\_id, range\_start, range… --- ## [Renaming log file in filebeat and passing index name](https://discuss.elastic.co/t/renaming-log-file-in-filebeat-and-passing-index-name/260519)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 9:11am UTC](https://discuss.elastic.co/t/renaming-log-file-in-filebeat-and-passing-index-name/260519 "2021-01-08T09:11:33Z")
hi can i knowif wish to renmae the log before sending to logstash. Besides that, I also wish to set index name based on respective paths. How can this be done in filebeat. I saw we have something called fields but fiel… --- ## [Query multiple fields with and](https://discuss.elastic.co/t/query-multiple-fields-with-and/260021)
**Author:** [@bastimm](https://discuss.elastic.co/u/bastimm)\ **Replies:** 4\ **Last updated:** [January 8, 2021, 8:57am UTC](https://discuss.elastic.co/t/query-multiple-fields-with-and/260021 "2021-01-08T08:57:53Z")
Hello back again! Last time I wrote queries is about 3 years ago, so I am not sure wether something changed for my case ,-) I have multiple fields in my Index, like MPN (manufacturernumber), manufacturer, title, descri… --- ## [About the test of indicators.breaker.total.limit parameters](https://discuss.elastic.co/t/about-the-test-of-indicators-breaker-total-limit-parameters/260513)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 8:50am UTC](https://discuss.elastic.co/t/about-the-test-of-indicators-breaker-total-limit-parameters/260513 "2021-01-08T08:50:31Z")
I want to test the test cluster. I want to see what the threshold of the indices.breaker.total.limit parameter is set to, the cluster can reject the request to ensure that it does not crash. So 20 requests were issued at… --- ## [Logstash parse json file content failed, but ok when enter one line with input plugin](https://discuss.elastic.co/t/logstash-parse-json-file-content-failed-but-ok-when-enter-one-line-with-input-plugin/260503)
**Author:** [@bo\_bo](https://discuss.elastic.co/u/bo_bo)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 7:01am UTC](https://discuss.elastic.co/t/logstash-parse-json-file-content-failed-but-ok-when-enter-one-line-with-input-plugin/260503 "2021-01-08T07:01:20Z")
File content is: {"#account\_id":"43DDBF5E46FBC68F2B9C395DA7C3443B","#distinct\_id":"205aa1ec49b21576da4ee3beb994f132","#type":"track","#ip":"122.157.17 5.52","#time":"2020-01-06 19:44:54","#event\_name":"TALENT\_CAPTURE",… --- ## [ElasticSearch DAU and MAU](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 9\ **Last updated:** [January 8, 2021, 6:34am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405 "2021-01-08T06:34:24Z")
Hello Team In Kibana Visualisation Dashboard , we have option to get charts for DAU and MAU. I would like to check the query used by Kibana in background to get the data. My purpose is to get the query and use it in C… --- ## [\[java high level client 7.9.1\] highlight in inner hit is null](https://discuss.elastic.co/t/java-high-level-client-7-9-1-highlight-in-inner-hit-is-null/260497)
**Author:** [@jaru\_kim](https://discuss.elastic.co/u/jaru_kim)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 6:09am UTC](https://discuss.elastic.co/t/java-high-level-client-7-9-1-highlight-in-inner-hit-is-null/260497 "2021-01-08T06:09:31Z")
I want to get highlight data in inner hit. in response, but, highlight in inner hit is null. did I miss something? portion of class file: //-- innerHit's Highlight HighlightBuilder enHighlightBuilder = new HighlightB… --- ## [Basic License unable to enable xpack](https://discuss.elastic.co/t/basic-license-unable-to-enable-xpack/260461)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 4\ **Last updated:** [January 8, 2021, 5:30am UTC](https://discuss.elastic.co/t/basic-license-unable-to-enable-xpack/260461 "2021-01-08T05:30:27Z")
Hi, i perform yum install in my centos 7 elk. When i configure security i hitting the error below. I am using basic license. Is basic license not allowed for xpack security as i want allow user to login rather than hav… --- ## [Take/calculate value from dashboard](https://discuss.elastic.co/t/take-calculate-value-from-dashboard/259093)
**Author:** [@blukit](https://discuss.elastic.co/u/blukit)\ **Replies:** 4\ **Last updated:** [January 8, 2021, 5:07am UTC](https://discuss.elastic.co/t/take-calculate-value-from-dashboard/259093 "2021-01-08T05:07:21Z")
Hi guys... Is it possible to calculate value directly from a dashboard? The underlying logic of existing metrics kinda complex, so i think it would be more simple if I could take the output for other calculation. ex… --- ## [Kibana filter](https://discuss.elastic.co/t/kibana-filter/260440)
**Author:** [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 4:49am UTC](https://discuss.elastic.co/t/kibana-filter/260440 "2021-01-08T04:49:01Z")
I have a set of domain names I want only the domains names which has .in when I tried to add filter in kibana where domainname.keywors is \*.in I m not getting any results pls suggest on how to use the wildcard operator --- ## [Endpoint Security Network Events Missing & Not Parsing Data](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982)
**Author:** [@Man715](https://discuss.elastic.co/u/Man715)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 4:07am UTC](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982 "2021-01-08T04:07:00Z")
I am running into two issues with the Network Events. The first issue is that HTTPS traffic is not getting identified as HTTPS traffic and is has an empty http.request.body.content and most HTTP traffic is the same. … --- ## [Get node hostname/ip on which the container is hosted](https://discuss.elastic.co/t/get-node-hostname-ip-on-which-the-container-is-hosted/260493)
**Author:** [@astrovj](https://discuss.elastic.co/u/astrovj)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 3:41am UTC](https://discuss.elastic.co/t/get-node-hostname-ip-on-which-the-container-is-hosted/260493 "2021-01-08T03:41:09Z")
Is there a way to get node hostname/ip on which the container is hosted using filebeat dynamically, as a field in the ES index. Right now it gives the container id/ip as hostname/ip ? I am not using logstash. --- ## [Elk custome log](https://discuss.elastic.co/t/elk-custome-log/260407)
**Author:** [@Supun\_Madushanka](https://discuss.elastic.co/u/Supun_Madushanka)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 3:35am UTC](https://discuss.elastic.co/t/elk-custome-log/260407 "2021-01-08T03:35:03Z")
Hi, I am new to elk. I have a nodejs application. current I am writing nodejs log to the log file. my log format is "type username ip eventname data". I set up filebeat in nodejs server and I setup kibana with elastic se… --- ## [Search query based of number of values a field contains](https://discuss.elastic.co/t/search-query-based-of-number-of-values-a-field-contains/260408)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 2:34am UTC](https://discuss.elastic.co/t/search-query-based-of-number-of-values-a-field-contains/260408 "2021-01-08T02:34:14Z")
Hi, I was wondering whether you can point me at any documentation, or let me know if this is not possible for the following. I am trying to write a query of a fields called result\_code. Some of my documents contain mul… --- ## [Could not add document](https://discuss.elastic.co/t/could-not-add-document/260023)
**Author:** [@cdwmhcc](https://discuss.elastic.co/u/cdwmhcc)\ **Replies:** 14\ **Last updated:** [January 8, 2021, 12:07am UTC](https://discuss.elastic.co/t/could-not-add-document/260023 "2021-01-08T00:07:21Z")
https://streamable.com/x9svr1 --- ## [Painless script for a comparison between two fields taken at interval](https://discuss.elastic.co/t/painless-script-for-a-comparison-between-two-fields-taken-at-interval/260464)
**Author:** [@CyaTo](https://discuss.elastic.co/u/CyaTo)\ **Replies:** 8\ **Last updated:** [January 7, 2021, 10:41pm UTC](https://discuss.elastic.co/t/painless-script-for-a-comparison-between-two-fields-taken-at-interval/260464 "2021-01-07T22:41:21Z")
Hello :wave: I take the ELK suite in hand and try to do a few things with it to learn. Currently I'm trying to make a scripted field that will be able to determine a change between two hashes taken at two different mom… --- ## [Name saved in disk when taking snapshot](https://discuss.elastic.co/t/name-saved-in-disk-when-taking-snapshot/260429)
**Author:** [@khzied](https://discuss.elastic.co/u/khzied)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 9:34pm UTC](https://discuss.elastic.co/t/name-saved-in-disk-when-taking-snapshot/260429 "2021-01-07T21:34:22Z")
Hello, I have Elasticsearch 5.6 and I have a question when making snapshot: it's possible to find the same name of directory like index name after making snap. Now the directory generated is random name like this lMTV… --- ## [PanW module issues](https://discuss.elastic.co/t/panw-module-issues/260487)
**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 8:34pm UTC](https://discuss.elastic.co/t/panw-module-issues/260487 "2021-01-07T20:34:47Z")
I have the panw module enabled in filebeat along with other modules enabled as well. For the panw module I have configured it as shown below - module: panw panos: enabled: true # Set which input to use betwee… --- ## [Kibana 7.10 custom plugin grayed out in dashboard](https://discuss.elastic.co/t/kibana-7-10-custom-plugin-grayed-out-in-dashboard/260471)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 8\ **Last updated:** [January 7, 2021, 8:08pm UTC](https://discuss.elastic.co/t/kibana-7-10-custom-plugin-grayed-out-in-dashboard/260471 "2021-01-07T20:08:53Z")
I've create a test plugin for Kibana 7.10 using logic from a 7.8 plugin. It works fine when I create a visualization using the custom plugin. However, when I add the visualization to a dashboard everything is grayed out … --- ## [Search for String Literal in KQL](https://discuss.elastic.co/t/search-for-string-literal-in-kql/260482)
**Author:** [@Samsquantch](https://discuss.elastic.co/u/Samsquantch)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 8:04pm UTC](https://discuss.elastic.co/t/search-for-string-literal-in-kql/260482 "2021-01-07T20:04:21Z")
How do I search for a literal string value? Current example query: Subject : "\[External Sender\] Test" Brings back what I'm looking for, but also the following: \[External Sender\] test-results.pdf \[External Sender\] Te… --- ## [Audit logging in ECE 1.1](https://discuss.elastic.co/t/audit-logging-in-ece-1-1/260486)
**Author:** [@jhegarty](https://discuss.elastic.co/u/jhegarty)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 8:01pm UTC](https://discuss.elastic.co/t/audit-logging-in-ece-1-1/260486 "2021-01-07T20:01:05Z")
We have an ECE 1.1 installation that’s been running for a while, and we’d like to know which clusters are still being used. We don’t have access to most of the clusters, so we need a way to do this through ECE for all cl… --- ## ["simple\_query\_string" with "default\_operator": "AND" doesn't imply "analyzer": "default"](https://discuss.elastic.co/t/simple-query-string-with-default-operator-and-doesnt-imply-analyzer-default/260485)
**Author:** [@Luke\_Nezda](https://discuss.elastic.co/u/Luke_Nezda)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 7:59pm UTC](https://discuss.elastic.co/t/simple-query-string-with-default-operator-and-doesnt-imply-analyzer-default/260485 "2021-01-07T19:59:38Z")
Hello, all - I went to convert some code using query\_string to simple\_query\_string (using "default\_operator": "AND" for both) and was surprised to find I needed to explicitly say "analyzer": "default" despite the analyz… --- ## [Trouble With Multiline Codec Logstash](https://discuss.elastic.co/t/trouble-with-multiline-codec-logstash/260483)
**Author:** [@bigbobolue](https://discuss.elastic.co/u/bigbobolue)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:51pm UTC](https://discuss.elastic.co/t/trouble-with-multiline-codec-logstash/260483 "2021-01-07T19:51:55Z")
I am having trouble with a particular multiline log 2021-01-07T07:17:59.942 INFO (129c-2b04) \[LogonMonitor::LogSummary\] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* Session Summary (User: User1234, Session: 1) \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 2021-01-07T07:17:… --- ## [Count fields with the same value as one](https://discuss.elastic.co/t/count-fields-with-the-same-value-as-one/260466)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:31pm UTC](https://discuss.elastic.co/t/count-fields-with-the-same-value-as-one/260466 "2021-01-07T19:31:29Z")
Hi! I have many fields which have the same value. So let's we have those document in different time periods: @timestamp Jan 6, 2021 @ 23:00:00 field.mess value1 field.sub examp1 @timestamp Jan 6, 2021 @ 23:00:01 fie… --- ## [Help on creating a visualization of total time taken for service in Kibana](https://discuss.elastic.co/t/help-on-creating-a-visualization-of-total-time-taken-for-service-in-kibana/260401)
**Author:** [@Thols](https://discuss.elastic.co/u/Thols)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:10pm UTC](https://discuss.elastic.co/t/help-on-creating-a-visualization-of-total-time-taken-for-service-in-kibana/260401 "2021-01-07T19:10:30Z")
Hi I am trying to create a time visualization like below Where 1 - 5 are various calls the single service travels through and come back. Each of these has a separate log source and are indexed in different patterns. … [Previous page](https://discuss.elastic.co/latest.md?page=1903) [Next page](https://discuss.elastic.co/latest.md?page=1905)