# Latest **URL:** https://discuss.elastic.co/latest.md?page=1913 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1914 --- ## [Indicator false match on ipv6](https://discuss.elastic.co/t/indicator-false-match-on-ipv6/258521)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 6\ **Last updated:** [January 4, 2021, 2:10am UTC](https://discuss.elastic.co/t/indicator-false-match-on-ipv6/258521 "2021-01-04T02:10:06Z")
I received a ipv6 match (destination.ip) from an indicator however the destination ip doesn't exist in my threat intel feed! I've linked my detection rule, the match event as well as the CSV of the threat intel feed (al… --- ## [Can't parse Unix timestamp with logstash. Getting \_dateparsefailure](https://discuss.elastic.co/t/cant-parse-unix-timestamp-with-logstash-getting-dateparsefailure/259718)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 2:05am UTC](https://discuss.elastic.co/t/cant-parse-unix-timestamp-with-logstash-getting-dateparsefailure/259718 "2021-01-04T02:05:09Z")
Hi, Our log files are in json format. Here is a small snippet of the file { "timestamp": 1608191939682, "formatVersion": 1, "webaclId": "69c2a78d-d849-4dca-bccd-xxx", "terminatingRuleId": "Default\_Action", "te… --- ## [Parsing json array with logstash](https://discuss.elastic.co/t/parsing-json-array-with-logstash/259852)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 2:04am UTC](https://discuss.elastic.co/t/parsing-json-array-with-logstash/259852 "2021-01-04T02:04:01Z")
Our logs have http headers as a json array as shown below "httpRequest": { "httpVersion": "HTTP/1.1", "args": "", "country": "US", "requestId": "1-5fec0c53-78cbd10c4248df7666a62d78", "clien… --- ## [Filebeat harvester started but not sending logs to logstash / kibana](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030)
**Author:** [@Eden\_Corbin](https://discuss.elastic.co/u/Eden_Corbin)\ **Replies:** 7\ **Last updated:** [January 4, 2021, 12:04am UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030 "2021-01-04T00:04:13Z")
I'm certainly missing something in my configuration. I'm running a full docker setup, and can access Kibana and view indexes, including some logs I manually sent to logstash, I'm working on adding filebeat, docker logs s… --- ## [Enable auto login on kibana graph](https://discuss.elastic.co/t/enable-auto-login-on-kibana-graph/259986)
**Author:** [@Ritika\_Joshi](https://discuss.elastic.co/u/Ritika_Joshi)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 11:29pm UTC](https://discuss.elastic.co/t/enable-auto-login-on-kibana-graph/259986 "2021-01-03T23:29:23Z")
Hello, I am trying to skip login page of kibana graph which are embedded in my web console through iframe. I Am trying to login through XMLHttpRequest but getting following error Access to XMLHttpRequest at '\*\*\*\*\*\*\*' … --- ## [Saved search columns reset when filtering?](https://discuss.elastic.co/t/saved-search-columns-reset-when-filtering/259902)
**Author:** [@tallavi](https://discuss.elastic.co/u/tallavi)\ **Replies:** 7\ **Last updated:** [January 3, 2021, 8:05pm UTC](https://discuss.elastic.co/t/saved-search-columns-reset-when-filtering/259902 "2021-01-03T20:05:04Z")
Hi, We're on version 7.8.1 of the stack. I noticed an annoyance. I have a dashboard with a saved search at the bottom. I add/remove columns, change the order, etc, and when I filter by a value, the columns reset! It wa… --- ## [Problem with executing path to Logstash.bat](https://discuss.elastic.co/t/problem-with-executing-path-to-logstash-bat/259731)
**Author:** [@keyofstarrysky973](https://discuss.elastic.co/u/keyofstarrysky973)\ **Replies:** 2\ **Last updated:** [January 3, 2021, 7:19pm UTC](https://discuss.elastic.co/t/problem-with-executing-path-to-logstash-bat/259731 "2021-01-03T19:19:33Z")
Hello Everyone, Pls I need some help on this problem I'm having executing Logstash on Windows 10. I have an ELK Stack with both Elasticsearch and Kibana working without any problems. I have a directory, named elk\_stack … --- ## [Issue installing Logstash no such file to load -- bundler](https://discuss.elastic.co/t/issue-installing-logstash-no-such-file-to-load-bundler/260041)
**Author:** [@Grant1999](https://discuss.elastic.co/u/Grant1999)\ **Replies:** 5\ **Last updated:** [January 3, 2021, 6:15pm UTC](https://discuss.elastic.co/t/issue-installing-logstash-no-such-file-to-load-bundler/260041 "2021-01-03T18:15:29Z")
I have downloaded kibana and elastic search on windows 10 64 bit and now trying to install logstash. But I get this error when I type in the command any ideas? C:\\Elasticstack\\logstash-7.10.1\>logstash -f logstash.conf U… --- ## [Aggregation](https://discuss.elastic.co/t/aggregation/260038)
**Author:** [@Uri\_Parush](https://discuss.elastic.co/u/Uri_Parush)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 6:06pm UTC](https://discuss.elastic.co/t/aggregation/260038 "2021-01-03T18:06:18Z")
Hi, I'm trying to understand how to create an aggregation query for tag distribution. Record example: { @timestamp: {iso time} , record\_type: {string}, record\_data: {string}, tags: \[ {key: {string}, value: {string… --- ## [Two series linechart with time offset](https://discuss.elastic.co/t/two-series-linechart-with-time-offset/260035)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 4:26pm UTC](https://discuss.elastic.co/t/two-series-linechart-with-time-offset/260035 "2021-01-03T16:26:21Z")
I have 2 data source first one's data is for from: now-1w / to: now second one is from: now-2w / to: now-1 I want to visualize both of them in one line chart. y axis is ratio and it's clear. but how can i define x a… --- ## [Runing Elastic Endpoint Security tohether with MS Defender](https://discuss.elastic.co/t/runing-elastic-endpoint-security-tohether-with-ms-defender/259252)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 3, 2021, 12:11pm UTC](https://discuss.elastic.co/t/runing-elastic-endpoint-security-tohether-with-ms-defender/259252 "2021-01-03T12:11:51Z")
Hello, Is it supported / allowed to run Elastic Endpoint Security and the free builtin Windows Defender together on a host? --- ## [Office365 Signin Logs event.outcome seems incorrect sometimes](https://discuss.elastic.co/t/office365-signin-logs-event-outcome-seems-incorrect-sometimes/258832)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 11:22am UTC](https://discuss.elastic.co/t/office365-signin-logs-event-outcome-seems-incorrect-sometimes/258832 "2021-01-03T11:22:59Z")
Hello, (Elastic 7.9.2) We noticed something weird in the Office365 Signin logs. This a screenshot from the Azure Portal itself: As you can see the user had 1 failed login followed by a successful login. In the o365 … --- ## [APM showing framework exceptions also in Errors tab](https://discuss.elastic.co/t/apm-showing-framework-exceptions-also-in-errors-tab/259995)
**Author:** [@shivasantosh](https://discuss.elastic.co/u/shivasantosh)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 9:58am UTC](https://discuss.elastic.co/t/apm-showing-framework-exceptions-also-in-errors-tab/259995 "2021-01-03T09:58:27Z")
We have integrated APM with our Spring boot application Java. we have two concerns with APM agent, just wanted to know are they expected or anything missing at my side in configuration. Below are the concerns If we us… --- ## [Apply filter from custom plugin onto dashboard is not working in 7.9.3](https://discuss.elastic.co/t/apply-filter-from-custom-plugin-onto-dashboard-is-not-working-in-7-9-3/257979)
**Author:** [@nrt.krishna](https://discuss.elastic.co/u/nrt.krishna)\ **Replies:** 2\ **Last updated:** [January 3, 2021, 8:10am UTC](https://discuss.elastic.co/t/apply-filter-from-custom-plugin-onto-dashboard-is-not-working-in-7-9-3/257979 "2021-01-03T08:10:27Z")
Hi, I am trying to apply filter from custom plugin on to dashboard. It used to work with belowcode snippet with old version. Now I am migrating my plugin to 7.9.3. As soon as I apply filter using below code the filter i… --- ## [New Community Beat to Apache Pulsar](https://discuss.elastic.co/t/new-community-beat-to-apache-pulsar/259968)
**Author:** [@Pinar\_Zaimoglu](https://discuss.elastic.co/u/Pinar_Zaimoglu)\ **Replies:** 2\ **Last updated:** [January 2, 2021, 9:17pm UTC](https://discuss.elastic.co/t/new-community-beat-to-apache-pulsar/259968 "2021-01-02T21:17:04Z")
Hi everyone! I wanted to share with you that I'm creating a new community beat based on Metricbeat called "pulsar beat". If you have any advice, please let me know. Thank you in advance. --- ## [Problem while using shrink api](https://discuss.elastic.co/t/problem-while-using-shrink-api/260025)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [January 2, 2021, 7:47pm UTC](https://discuss.elastic.co/t/problem-while-using-shrink-api/260025 "2021-01-02T19:47:11Z")
I was following this doc for decreasing shards but GET /\_cluster/allocation/explain shows "explanation" : """node does not match index setting \[index.routing.allocation.require\] filters \[\_name:"ed1"\]""" I want to shrin… --- ## [Get last document string value in each bucket](https://discuss.elastic.co/t/get-last-document-string-value-in-each-bucket/260013)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 1\ **Last updated:** [January 2, 2021, 4:43pm UTC](https://discuss.elastic.co/t/get-last-document-string-value-in-each-bucket/260013 "2021-01-02T16:43:27Z")
I have a reports index and I need to count the number of reports per-user that have a specific string (keyword) field value in their last document (sorted by time) in some time range. I tried bucketing by user -\> top (1… --- ## [Elastic Endpoint Expected CPU Usage](https://discuss.elastic.co/t/elastic-endpoint-expected-cpu-usage/259889)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 6\ **Last updated:** [January 2, 2021, 4:29pm UTC](https://discuss.elastic.co/t/elastic-endpoint-expected-cpu-usage/259889 "2021-01-02T16:29:18Z")
Hello, I've been playing around with Elastic Endpoint lately on my home Windows 10 pc, which has 4 CPU cores. I see that the elastic-endpoint.exe process is using around 24 % Normalized CPU: I'm just wondering if thi… --- ## [Wildcard filter on a Windows path](https://discuss.elastic.co/t/wildcard-filter-on-a-windows-path/258035)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [January 2, 2021, 3:48pm UTC](https://discuss.elastic.co/t/wildcard-filter-on-a-windows-path/258035 "2021-01-02T15:48:17Z")
Hello, I'm trying to create a wildcard filter that filters on paths starting with c:\\git\* But: { "query": { "wildcard": { "process.working\_directory": { "value": "c:\\\\git\\\\\*" } } } } i… --- ## [Snapshots: State: Partial failure (?)](https://discuss.elastic.co/t/snapshots-state-partial-failure/260018)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [January 2, 2021, 12:59pm UTC](https://discuss.elastic.co/t/snapshots-state-partial-failure/260018 "2021-01-02T12:59:12Z")
Hello, Example of a snapshot error in Elasticsearch: Global cluster state was stored, but at least one shard wasn't stored successfully... Shards: 10 Failed Shards: 2 From what I understand, the system in this cas… --- ## [Kibana API Result format](https://discuss.elastic.co/t/kibana-api-result-format/259989)
**Author:** [@shiv97](https://discuss.elastic.co/u/shiv97)\ **Replies:** 1\ **Last updated:** [January 1, 2021, 11:06pm UTC](https://discuss.elastic.co/t/kibana-api-result-format/259989 "2021-01-01T23:06:35Z")
Hi Everyone, I write one query in the Kibana console that provides me some JSON result I want to know about some insight into the Json result { "took" : 11, "timed\_out" : false, "\_shards" : { "total" : 10, "succes… --- ## [How to test logstash .conf file easily without logstash shutting down everytime?](https://discuss.elastic.co/t/how-to-test-logstash-conf-file-easily-without-logstash-shutting-down-everytime/260004)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [January 1, 2021, 10:10pm UTC](https://discuss.elastic.co/t/how-to-test-logstash-conf-file-easily-without-logstash-shutting-down-everytime/260004 "2021-01-01T22:10:29Z")
I'm currently testing the logstash in below manner. /opt/logstash/bin/logstash -f /tmp/simpleInputs.conf This works perfectly, but the issue is, it takes some time to execute it.. just for the starting of java process … --- ## [Delete unsued dynamic mapping Fields](https://discuss.elastic.co/t/delete-unsued-dynamic-mapping-fields/260000)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 1\ **Last updated:** [January 1, 2021, 9:04pm UTC](https://discuss.elastic.co/t/delete-unsued-dynamic-mapping-fields/260000 "2021-01-01T21:04:49Z")
Hi all, First of all I wish you a Happy New Year. I have some unused fields which were created by dynamic mapping. Is there any way to remove them from Index-mapping ? Best Regards --- ## [How to compile Vega-Lite project to Vega?](https://discuss.elastic.co/t/how-to-compile-vega-lite-project-to-vega/259837)
**Author:** [@Ganymede](https://discuss.elastic.co/u/Ganymede)\ **Replies:** 4\ **Last updated:** [January 1, 2021, 6:50pm UTC](https://discuss.elastic.co/t/how-to-compile-vega-lite-project-to-vega/259837 "2021-01-01T18:50:18Z")
Hello all, Literally title. I have a working project in Vega-Lite and want to add "Vega only features" ontop of it. Is it possible to compile the Vega-Lite script and look at the resulting Vega output? As far as I'm … --- ## [Reading data trough mongodb -input](https://discuss.elastic.co/t/reading-data-trough-mongodb-input/259999)
**Author:** [@bucco1958](https://discuss.elastic.co/u/bucco1958)\ **Replies:** 1\ **Last updated:** [January 1, 2021, 5:39pm UTC](https://discuss.elastic.co/t/reading-data-trough-mongodb-input/259999 "2021-01-01T17:39:26Z")
I'm trying to learn more about the mongodb-input-plugin. I'm running a local mongo db instance on my localhost on my Win 10 machine. The database is up and used with other purposes. There is no security on the database -… --- ## [Automatic replications factor](https://discuss.elastic.co/t/automatic-replications-factor/259996)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 0\ **Last updated:** [January 1, 2021, 2:05pm UTC](https://discuss.elastic.co/t/automatic-replications-factor/259996 "2021-01-01T14:05:35Z")
Hi, I wonder if there is a feature for dynamically changing the replication\_factor of each index. We have an Elasticseach cluster with hundreds of indices as part of our recommendations engine. Each index represents a … --- ## [Elasticsearch remote cluster authentication](https://discuss.elastic.co/t/elasticsearch-remote-cluster-authentication/259991)
**Author:** [@xxlaila](https://discuss.elastic.co/u/xxlaila)\ **Replies:** 1\ **Last updated:** [January 1, 2021, 12:32pm UTC](https://discuss.elastic.co/t/elasticsearch-remote-cluster-authentication/259991 "2021-01-01T12:32:04Z")
Elasticsearch 7.8. Independent account authentication is configured between the two clusters, xpack.security.enabled : true xpack.security.transport . ssl.enabled : true xpack.security.transport . ssl.verificatio… --- ## [Has\_child not working as expected inside has\_parent](https://discuss.elastic.co/t/has-child-not-working-as-expected-inside-has-parent/259992)
**Author:** [@Waseem\_Farooqui](https://discuss.elastic.co/u/Waseem_Farooqui)\ **Replies:** 0\ **Last updated:** [January 1, 2021, 12:11pm UTC](https://discuss.elastic.co/t/has-child-not-working-as-expected-inside-has-parent/259992 "2021-01-01T12:11:35Z")
I have a parent child relationship in my elasticsearch 7.9 where I am having the car as a parent type and it has multiple child types like honda, suzuki, volvo now I want to have a child of type volvo and parent type is … --- ## [Data A first delete then index but version conflict](https://discuss.elastic.co/t/data-a-first-delete-then-index-but-version-conflict/259988)
**Author:** [@kai1](https://discuss.elastic.co/u/kai1)\ **Replies:** 1\ **Last updated:** [January 1, 2021, 9:49am UTC](https://discuss.elastic.co/t/data-a-first-delete-then-index-but-version-conflict/259988 "2021-01-01T09:49:38Z")
hello, everybody: I have a problem. I don\`t know why. Es(version is 6.3.2) index name is \[index\_1\]. Data A in index\_1, and version is 100 (version type is external). First, I Delete data A and search data A does not … --- ## [Watcher Assistance](https://discuss.elastic.co/t/watcher-assistance/259919)
**Author:** [@PinkElephant](https://discuss.elastic.co/u/PinkElephant)\ **Replies:** 2\ **Last updated:** [January 1, 2021, 5:10am UTC](https://discuss.elastic.co/t/watcher-assistance/259919 "2021-01-01T05:10:19Z")
Am trying to loop through a particular aggregation bucket-by-bucket and check if its corresponding key matches the value of ctx.payload.second.hits.hits.0.\_source.host.hostname. If it matches (and the hits total is \> 0 … [Previous page](https://discuss.elastic.co/latest.md?page=1912) [Next page](https://discuss.elastic.co/latest.md?page=1914)