# Latest **URL:** https://discuss.elastic.co/latest.md?page=1944 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1945 --- ## [How to parse logstash's data to a json array?](https://discuss.elastic.co/t/how-to-parse-logstashs-data-to-a-json-array/258274)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 2:08am UTC](https://discuss.elastic.co/t/how-to-parse-logstashs-data-to-a-json-array/258274 "2020-12-11T02:08:38Z")
How to parse logstash's data to a json array? Using filebeat sending a file to logstash. The file includes 2 line of records: {"request\_id": "m2ee22d045f6c5ce07fe43dbdaea1de0","method": "GET","status": "304","forwarde… --- ## ["The quota has been exceeded error" when accessing a dashboard](https://discuss.elastic.co/t/the-quota-has-been-exceeded-error-when-accessing-a-dashboard/257215)
**Author:** [@Craig\_Sharp](https://discuss.elastic.co/u/Craig_Sharp)\ **Replies:** 4\ **Last updated:** [December 11, 2020, 2:03am UTC](https://discuss.elastic.co/t/the-quota-has-been-exceeded-error-when-accessing-a-dashboard/257215 "2020-12-11T02:03:08Z")
I am receiving the following error when trying to access one of my regularly used dashboards. "The quota has been exceeded" This is a new one for me. I am not finding anything specific on a web search. Any assistance… --- ## [Error in elasticsearch filter of logstash: Failed to query elasticsearch for previous event](https://discuss.elastic.co/t/error-in-elasticsearch-filter-of-logstash-failed-to-query-elasticsearch-for-previous-event/256686)
**Author:** [@Vita\_Rosenberg](https://discuss.elastic.co/u/Vita_Rosenberg)\ **Replies:** 5\ **Last updated:** [December 11, 2020, 1:11am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-filter-of-logstash-failed-to-query-elasticsearch-for-previous-event/256686 "2020-12-11T01:11:20Z")
Hello. I have an index in kibana called poc1\*, it contains fields of machineId and timestamp I need to get from that index a maximum value of timestamp to a new index for each machineId (which is deviceId in sql). … --- ## [No runner available for operation type \[composite\]](https://discuss.elastic.co/t/no-runner-available-for-operation-type-composite/258245)
**Author:** [@rose](https://discuss.elastic.co/u/rose)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 12:22am UTC](https://discuss.elastic.co/t/no-runner-available-for-operation-type-composite/258245 "2020-12-11T00:22:45Z")
I use operation type is composite,esrally version is 2.0.2. \[ERROR\] Cannot race. Error in load generator \[0\] ('No runner available for operation type \[composite\]', None) The above is an error report. grep 'ERROR' .ra… --- ## [Find average response time in data table Kibana](https://discuss.elastic.co/t/find-average-response-time-in-data-table-kibana/258342)
**Author:** [@Thols](https://discuss.elastic.co/u/Thols)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 11:03pm UTC](https://discuss.elastic.co/t/find-average-response-time-in-data-table-kibana/258342 "2020-12-10T23:03:48Z")
Hi, I have requirement to visualize data in the below format in Kibana I have series of log events loaded from csv. Here the log events can be segregated using trace id for the particular transaction which as an act… --- ## [Visualize time difference of each transaction that falls in certain bucket range](https://discuss.elastic.co/t/visualize-time-difference-of-each-transaction-that-falls-in-certain-bucket-range/257759)
**Author:** [@Thols](https://discuss.elastic.co/u/Thols)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 9:40pm UTC](https://discuss.elastic.co/t/visualize-time-difference-of-each-transaction-that-falls-in-certain-bucket-range/257759 "2020-12-10T21:40:20Z")
Hi , I have requirement to show something similar to the above image. I have start and end time in each of my transaction with which I will be creating a scripted filed for time difference. So based on the range the t… --- ## [Kibana Dashboard with Control & Data Table](https://discuss.elastic.co/t/kibana-dashboard-with-control-data-table/258319)
**Author:** [@mailinglists19](https://discuss.elastic.co/u/mailinglists19)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 9:22pm UTC](https://discuss.elastic.co/t/kibana-dashboard-with-control-data-table/258319 "2020-12-10T21:22:06Z")
I’ve millions of JSON on ES that look like this: { "overallAverage": { "clickAverage": { "avg": 4.4460716 }, "viewAverage": { "avg": 4.8814287 } }, "day": "2019-07-02", "browser": "ch… --- ## [Data Normalization](https://discuss.elastic.co/t/data-normalization/258335)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 9:07pm UTC](https://discuss.elastic.co/t/data-normalization/258335 "2020-12-10T21:07:46Z")
We have a dataset with 110 million documents, 20 million of which have a reading of "0". We suspect some hourly readings have been lost due to totals running 10% to 30% lower than expected and unfortunately it seems the… --- ## [How to create a new Canvas template?](https://discuss.elastic.co/t/how-to-create-a-new-canvas-template/258331)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 8:53pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-canvas-template/258331 "2020-12-10T20:53:23Z")
Hello, Looked around Canvas options and documentation, but I can't seem to find a way to create a new template? I would like to create a template containing some example pages with our new house style. So is it possib… --- ## [Find time difference between series of events with uniqueid](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911)
**Author:** [@GokulD](https://discuss.elastic.co/u/GokulD)\ **Replies:** 5\ **Last updated:** [December 10, 2020, 8:45pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911 "2020-12-10T20:45:09Z")
Hi , I have requirement where I have series of events that has a unique trace id. I want to find and take the timestamp from the first and last event of this id and find the difference. Since I dont have any start and … --- ## [Math function in tsvb](https://discuss.elastic.co/t/math-function-in-tsvb/258320)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 8:42pm UTC](https://discuss.elastic.co/t/math-function-in-tsvb/258320 "2020-12-10T20:42:07Z")
I am trying to do simple match function on TSVB but it shows no data. If I remove math I can see the value. What am I doing wrong. I just want to minus some fixed number from it. totalfreesize is in bytes. --- ## [Compressing and forcemerging past time-based indices](https://discuss.elastic.co/t/compressing-and-forcemerging-past-time-based-indices/256060)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 28\ **Last updated:** [December 10, 2020, 8:32pm UTC](https://discuss.elastic.co/t/compressing-and-forcemerging-past-time-based-indices/256060 "2020-12-10T20:32:45Z")
I have a bunch of past monthly indices that are read-only since no data is being indexed to them. I was thinking of applying best\_compression on them and then invoke the \_forcemerge api to reduce the num\_segments to 1. I… --- ## [Getting "security\_exception: action \[indices:admin/settings/update\] is unauthorized" on indexes with policies updated by a new user](https://discuss.elastic.co/t/getting-security-exception-action-indices-admin-settings-update-is-unauthorized-on-indexes-with-policies-updated-by-a-new-user/258198)
**Author:** [@prolbrakels](https://discuss.elastic.co/u/prolbrakels)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 7:58pm UTC](https://discuss.elastic.co/t/getting-security-exception-action-indices-admin-settings-update-is-unauthorized-on-indexes-with-policies-updated-by-a-new-user/258198 "2020-12-10T19:58:18Z")
This is for an ES cluster running v7.8.1. I'm trying to automate pushing updates to our ILM policies and (legacy) templates, so I have a shell script that curls the appropriate json via a new ES user called "template\_ma… --- ## [Wildcard search for exact phrase](https://discuss.elastic.co/t/wildcard-search-for-exact-phrase/258022)
**Author:** [@vadim-permakoff](https://discuss.elastic.co/u/vadim-permakoff)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 7:48pm UTC](https://discuss.elastic.co/t/wildcard-search-for-exact-phrase/258022 "2020-12-10T19:48:41Z")
We want to migrate from Solr to Elasticsearch and everything looks fine, but there is one task we are doing in Solr for which I cannot find a solution using Elasticsearch. I need to find exactly matching text in a conten… --- ## [Multiple values in a string value in logstash?](https://discuss.elastic.co/t/multiple-values-in-a-string-value-in-logstash/258316)
**Author:** [@GetYourSh1tTogether](https://discuss.elastic.co/u/GetYourSh1tTogether)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 7:46pm UTC](https://discuss.elastic.co/t/multiple-values-in-a-string-value-in-logstash/258316 "2020-12-10T19:46:10Z")
I am trying to set up this plugin by itself it works great and imports everything in the bucket. However, there are tons of subdirectories that i would like to prevent logstash from reading. I found this field "exclude\_p… --- ## [Dense\_vector becomes type "float"](https://discuss.elastic.co/t/dense-vector-becomes-type-float/258330)
**Author:** [@miya2](https://discuss.elastic.co/u/miya2)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 7:31pm UTC](https://discuss.elastic.co/t/dense-vector-becomes-type-float/258330 "2020-12-10T19:31:53Z")
Hi, I'm trying to load vector\_value into elastic search, and loading finished without any error. But the result of mapping shows type "float", not "dense\_vector". The version of Elasticsearch is 7.5.0. { "test" : … --- ## [I can't figure out what I should be setting rollover\_alias to](https://discuss.elastic.co/t/i-cant-figure-out-what-i-should-be-setting-rollover-alias-to/258329)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 7:21pm UTC](https://discuss.elastic.co/t/i-cant-figure-out-what-i-should-be-setting-rollover-alias-to/258329 "2020-12-10T19:21:19Z")
put another way I don't understand the function of rollover\_alias and I can't find an explanation in the docs. My managed indices keep failing with errors like this: illegal\_argument\_exception: index.lifecycle.rollove… --- ## [Filebeat / kubernetes / data loss](https://discuss.elastic.co/t/filebeat-kubernetes-data-loss/258322)
**Author:** [@elastic\_user1](https://discuss.elastic.co/u/elastic_user1)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 7:20pm UTC](https://discuss.elastic.co/t/filebeat-kubernetes-data-loss/258322 "2020-12-10T19:20:15Z")
I am using following config https://raw.githubusercontent.com/elastic/beats/master/deploy/kubernetes/filebeat-kubernetes.yaml plus settings symlinks: true I have container'd containers with rotated logs by default. 5 lo… --- ## [Filebeat not loading env variables](https://discuss.elastic.co/t/filebeat-not-loading-env-variables/258328)
**Author:** [@francom1](https://discuss.elastic.co/u/francom1)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 7:17pm UTC](https://discuss.elastic.co/t/filebeat-not-loading-env-variables/258328 "2020-12-10T19:17:48Z")
Hello everyone! I'm using this filebeats installation script in my deploys to ec2. files: "/etc/filebeat/filebeat.yml": mode: "000755" owner: root group: root content: | … --- ## [Optimisation of scripted aggregation](https://discuss.elastic.co/t/optimisation-of-scripted-aggregation/258324)
**Author:** [@drewblin](https://discuss.elastic.co/u/drewblin)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 6:59pm UTC](https://discuss.elastic.co/t/optimisation-of-scripted-aggregation/258324 "2020-12-10T18:59:40Z")
Hello! I have such aggregation. "aggs":{ "child\_id":{ "terms":{ "script":{ "lang":"painless", "source":"params\['\_source'\]\['prod\_list'\]\[params\['\_source'\]\['prod\_list'\].indexOf(params.prod) + 1\]", … --- ## [Elastic agent fails under SysVinit due to dying endpoint security](https://discuss.elastic.co/t/elastic-agent-fails-under-sysvinit-due-to-dying-endpoint-security/257921)
**Author:** [@grin](https://discuss.elastic.co/u/grin)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 6:48pm UTC](https://discuss.elastic.co/t/elastic-agent-fails-under-sysvinit-due-to-dying-endpoint-security/257921 "2020-12-10T18:48:32Z")
running operation 'operation-install' for endpoint-security.7.10.0 Failed to dispatch action 'action\_id: xxxxxxxxxxxxxxxx, type: POLICY\_CHANGE', error: operator: failed to execute step sc-run, error: operation '… --- ## [How to send multiple headers in Logstash http output plugin?](https://discuss.elastic.co/t/how-to-send-multiple-headers-in-logstash-http-output-plugin/258318)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 6:45pm UTC](https://discuss.elastic.co/t/how-to-send-multiple-headers-in-logstash-http-output-plugin/258318 "2020-12-10T18:45:07Z")
Hi, I am using Logstash 7.8.0. I am trying to send some message to an http endpoint using POST. I would like to add 3 header parameters and I would like to know how to do that. Its mentioned in the docs that its a hash h… --- ## [How to setup Kibana?](https://discuss.elastic.co/t/how-to-setup-kibana/258268)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 6:43pm UTC](https://discuss.elastic.co/t/how-to-setup-kibana/258268 "2020-12-10T18:43:39Z")
I have a remote server which runs Elasticsearch. I'm accessing this server via ssh. I want to setup Kibana how can I do it? Do I need to set Kibana locally or to the remote server? --- ## [How to make queries to elasticsearch from client side of kibana plugin](https://discuss.elastic.co/t/how-to-make-queries-to-elasticsearch-from-client-side-of-kibana-plugin/254178)
**Author:** [@K\_Chaitanya](https://discuss.elastic.co/u/K_Chaitanya)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 6:40pm UTC](https://discuss.elastic.co/t/how-to-make-queries-to-elasticsearch-from-client-side-of-kibana-plugin/254178 "2020-12-10T18:40:50Z")
Hi, I am trying to query elasticsearch indices from client side of kibana plugin. I was unable to find any native kibana plugin components which can readily enable me to create a client with which I can make request to… --- ## [Adding field creates an array not a static string](https://discuss.elastic.co/t/adding-field-creates-an-array-not-a-static-string/258149)
**Author:** [@jknott](https://discuss.elastic.co/u/jknott)\ **Replies:** 7\ **Last updated:** [December 10, 2020, 6:23pm UTC](https://discuss.elastic.co/t/adding-field-creates-an-array-not-a-static-string/258149 "2020-12-10T18:23:52Z")
When I add this in my filter it adds it but my other pipelines also add a field of the same and the values turn into an array instead of a static value per log. mutate { add\_field =\> { "service\_name"… --- ## [Security error when create new role with field\_security](https://discuss.elastic.co/t/security-error-when-create-new-role-with-field-security/258082)
**Author:** [@thejusjose-mindcurv](https://discuss.elastic.co/u/thejusjose-mindcurv)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 6:23pm UTC](https://discuss.elastic.co/t/security-error-when-create-new-role-with-field-security/258082 "2020-12-10T18:23:02Z")
Hi Team, We have Kibana version 7.8 installed. Tried to hide some particular fields for kibana users by creating a new custom role after referring https://www.elastic.co/guide/en/elasticsearch/reference/7.8/field-level… --- ## [Metricbeat - resource 'metricbeat-7.10.0' exists, but it is not an alias](https://discuss.elastic.co/t/metricbeat-resource-metricbeat-7-10-0-exists-but-it-is-not-an-alias/258311)
**Author:** [@madhan0618](https://discuss.elastic.co/u/madhan0618)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 6:20pm UTC](https://discuss.elastic.co/t/metricbeat-resource-metricbeat-7-10-0-exists-but-it-is-not-an-alias/258311 "2020-12-10T18:20:34Z")
Please help me understand this error message. I have metricbeat with kafka module running on each of my three kafka cluster nodes this is my metricbeat.yml file # =========================== Modules configuration ===… --- ## [Notification when alert ended](https://discuss.elastic.co/t/notification-when-alert-ended/255962)
**Author:** [@user007](https://discuss.elastic.co/u/user007)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 6:17pm UTC](https://discuss.elastic.co/t/notification-when-alert-ended/255962 "2020-12-10T18:17:37Z")
Is it possible to get a notification when the alert is ended? At the moment i only get notifications when the alert is ongoing. Thanks for your help! --- ## [Average line is not shown as expected in vega visualization](https://discuss.elastic.co/t/average-line-is-not-shown-as-expected-in-vega-visualization/258314)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 6:11pm UTC](https://discuss.elastic.co/t/average-line-is-not-shown-as-expected-in-vega-visualization/258314 "2020-12-10T18:11:47Z")
{ "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "description": "Bar chart with text labels. Apply scale padding to make the frame cover the labels.", "data": { "values": \[ {"a": "A", … --- ## [Alert Notification just once](https://discuss.elastic.co/t/alert-notification-just-once/256030)
**Author:** [@user007](https://discuss.elastic.co/u/user007)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 6:11pm UTC](https://discuss.elastic.co/t/alert-notification-just-once/256030 "2020-12-10T18:11:14Z")
Is it possible to send an alert notification only once (when the alert starts) and not repeatedly within a certain time frame? Thanks for your help! [Previous page](https://discuss.elastic.co/latest.md?page=1943) [Next page](https://discuss.elastic.co/latest.md?page=1945)