# Latest **URL:** https://discuss.elastic.co/latest.md?page=1953 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1954 --- ## [Integer cannot be casted to long bis](https://discuss.elastic.co/t/integer-cannot-be-casted-to-long-bis/257799)
**Author:** [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Replies:** 3\ **Last updated:** [December 8, 2020, 1:20am UTC](https://discuss.elastic.co/t/integer-cannot-be-casted-to-long-bis/257799 "2020-12-08T01:20:32Z")
Hi, Following this topic that had no replies: I made more tests against several available version of elastic I have. Using this code: POST \_ingest/pipeline/\_simulate { "pipeline" : { "description": "test", … --- ## [Can't send logs by filebeat to logstash in Kubernetes](https://discuss.elastic.co/t/cant-send-logs-by-filebeat-to-logstash-in-kubernetes/257851)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 12:55pm UTC](https://discuss.elastic.co/t/cant-send-logs-by-filebeat-to-logstash-in-kubernetes/257851 "2020-12-07T12:55:20Z")
Configuration nginx.yaml --- apiVersion: v1 kind: Namespace metadata: name: beats --- apiVersion: apps/v1 kind: Deployment metadata: namespace: beats name: nginx spec: replicas: 1 selector: matchLabels: … --- ## [Store enum as keyword VS integer](https://discuss.elastic.co/t/store-enum-as-keyword-vs-integer/257903)
**Author:** [@lang1991](https://discuss.elastic.co/u/lang1991)\ **Replies:** 1\ **Last updated:** [December 8, 2020, 12:53am UTC](https://discuss.elastic.co/t/store-enum-as-keyword-vs-integer/257903 "2020-12-08T00:53:27Z")
We have a layer on top of Elasticsearch to translate enums into their numeric values before querying and indexing, but I am wondering if that's necessary at all for storage savings and query performance when compared wit… --- ## [Synthetic Monitoring](https://discuss.elastic.co/t/synthetic-monitoring/257834)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 6\ **Last updated:** [December 7, 2020, 11:44pm UTC](https://discuss.elastic.co/t/synthetic-monitoring/257834 "2020-12-07T23:44:00Z")
Hi, im having a problem when validating the heartbeat.docker.yml file. It's failing on inline script thus the docker container did not continue. Help? --- ## [7.9 -\> 7.10 ECK experience](https://discuss.elastic.co/t/7-9-7-10-eck-experience/257510)
**Author:** [@3266miles](https://discuss.elastic.co/u/3266miles)\ **Replies:** 5\ **Last updated:** [December 7, 2020, 11:38pm UTC](https://discuss.elastic.co/t/7-9-7-10-eck-experience/257510 "2020-12-07T23:38:31Z")
So I've recently migrated our observability cluster from Elastic 7.9 to Elastic 7.10, and noticed some interesting gotchas that are worthy of discussion. I don't think these are bugs per say but there is definitely some … --- ## [Limit on # of data nodes?](https://discuss.elastic.co/t/limit-on-of-data-nodes/257912)
**Author:** [@Jesbourne](https://discuss.elastic.co/u/Jesbourne)\ **Replies:** 10\ **Last updated:** [December 7, 2020, 10:41pm UTC](https://discuss.elastic.co/t/limit-on-of-data-nodes/257912 "2020-12-07T22:41:17Z")
Is there a limit on the number of data nodes or overall amount of data we can have in a cluster? How can we tell when we're nearing that limit? We've been told a few times by elastic employees that our limit is probably… --- ## [Indexing to index2](https://discuss.elastic.co/t/indexing-to-index2/257919)
**Author:** [@Eddie\_Adams](https://discuss.elastic.co/u/Eddie_Adams)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 10:36pm UTC](https://discuss.elastic.co/t/indexing-to-index2/257919 "2020-12-07T22:36:49Z")
Is it possible to make an index1 readonly and index documents not present in index1 to index2? --- ## [How to parse an array of multi-line json objects as separate documents in ES?](https://discuss.elastic.co/t/how-to-parse-an-array-of-multi-line-json-objects-as-separate-documents-in-es/255230)
**Author:** [@reillye](https://discuss.elastic.co/u/reillye)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 10:22pm UTC](https://discuss.elastic.co/t/how-to-parse-an-array-of-multi-line-json-objects-as-separate-documents-in-es/255230 "2020-12-07T22:22:41Z")
I have a use case where I am going to be receiving a new file every hour that is picked up by filebeat and then sent to logstash. The file will look like this: \[ { "Results": { "StartWeekSec": \[ 2000, 1980… --- ## [Kibana, xpack, nginx proxy and authentication](https://discuss.elastic.co/t/kibana-xpack-nginx-proxy-and-authentication/257138)
**Author:** [@annanicotera](https://discuss.elastic.co/u/annanicotera)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 10:06pm UTC](https://discuss.elastic.co/t/kibana-xpack-nginx-proxy-and-authentication/257138 "2020-12-07T22:06:53Z")
Hello, We have embedded Kibana dashboards in our application. if xpack security is enabled, we configure a nginx proxy so that the user viewing the dashboards can seamlessly access/view the dashboards without having to … --- ## [Rsyslog vs filebeat](https://discuss.elastic.co/t/rsyslog-vs-filebeat/257904)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 10:07pm UTC](https://discuss.elastic.co/t/rsyslog-vs-filebeat/257904 "2020-12-07T22:07:01Z")
What is the best way to monitor my hosts? Should I stand up a rsyslog server, and then have clients send logs there, then forward to logstash, or should the clients just send them right to logstash? --- ## [TSVB Visualization is working differently in Read Only mode dashboard](https://discuss.elastic.co/t/tsvb-visualization-is-working-differently-in-read-only-mode-dashboard/257913)
**Author:** [@gaurav1](https://discuss.elastic.co/u/gaurav1)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 9:26pm UTC](https://discuss.elastic.co/t/tsvb-visualization-is-working-differently-in-read-only-mode-dashboard/257913 "2020-12-07T21:26:20Z")
I have used Markdown in TSVB visualization for creating a master dashboards which contains static data like dashboard name and its URL. The standalone markdown visualization does not support CSS for formatting the text s… --- ## [Multiple pipelines output to one cluster - only one of them picks up logs](https://discuss.elastic.co/t/multiple-pipelines-output-to-one-cluster-only-one-of-them-picks-up-logs/257877)
**Author:** [@Ilya\_Geller](https://discuss.elastic.co/u/Ilya_Geller)\ **Replies:** 4\ **Last updated:** [December 7, 2020, 8:38pm UTC](https://discuss.elastic.co/t/multiple-pipelines-output-to-one-cluster-only-one-of-them-picks-up-logs/257877 "2020-12-07T20:38:48Z")
Hi, I have a logstash node that has two pipelines that pick up different inputs and do separate things but both of them output to the same ES cluster into different indeces. Both pipelines have the following defined: … --- ## [Ingest pipeline grok processor on\_failure](https://discuss.elastic.co/t/ingest-pipeline-grok-processor-on-failure/257755)
**Author:** [@vsv0001](https://discuss.elastic.co/u/vsv0001)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 8:36pm UTC](https://discuss.elastic.co/t/ingest-pipeline-grok-processor-on-failure/257755 "2020-12-07T20:36:12Z")
Hi, I have an elastic ingest pipeline with grok processor defined along with error handling { "my\_ingest" : { "description" : "parse multiple patterns", "processors" : \[ { "grok" : { "… --- ## [Elastic : Problème avec format décimal à l'indexation (document non indexé)](https://discuss.elastic.co/t/elastic-probleme-avec-format-decimal-a-lindexation-document-non-indexe/257587)
**Author:** [@oldiequattro](https://discuss.elastic.co/u/oldiequattro)\ **Replies:** 9\ **Last updated:** [December 7, 2020, 8:00pm UTC](https://discuss.elastic.co/t/elastic-probleme-avec-format-decimal-a-lindexation-document-non-indexe/257587 "2020-12-07T20:00:00Z")
Bonjour, Je vous expose ici un souci rencontré chez nos environnement avec l'indexation d'une ligne dans Elasticsearch qui ne se fait pas dès que la valeur décimale contenue dans la clé dépasse 64 ( effet de bord d'un c… --- ## [Elasticsearch Ingest Node or Filebeats processors or Logstash to add fields to my logs](https://discuss.elastic.co/t/elasticsearch-ingest-node-or-filebeats-processors-or-logstash-to-add-fields-to-my-logs/257709)
**Author:** [@ghettosamson](https://discuss.elastic.co/u/ghettosamson)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 8:12pm UTC](https://discuss.elastic.co/t/elasticsearch-ingest-node-or-filebeats-processors-or-logstash-to-add-fields-to-my-logs/257709 "2020-12-07T20:12:45Z")
I am running Dockerized Elastic Stack on a single AWS EC2 instance, with Packetbeats, Filebeats, Metricbeats, Kibana and Elasticsearch. I've been reading the documentation over this past week and I need help determining … --- ## [Including dynamic templates for the elastic index](https://discuss.elastic.co/t/including-dynamic-templates-for-the-elastic-index/257784)
**Author:** [@radhika](https://discuss.elastic.co/u/radhika)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 8:03pm UTC](https://discuss.elastic.co/t/including-dynamic-templates-for-the-elastic-index/257784 "2020-12-07T20:03:42Z")
Hello everyone, I have an elastic index with the mappings set to strict except for one field which is dynamic. I would also like to set the mapping of the dynamic field using dynamic templates PUT trial { "mappings"… --- ## [Kafka Output fails to authenticate with kerberos](https://discuss.elastic.co/t/kafka-output-fails-to-authenticate-with-kerberos/257906)
**Author:** [@burkeg](https://discuss.elastic.co/u/burkeg)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 7:57pm UTC](https://discuss.elastic.co/t/kafka-output-fails-to-authenticate-with-kerberos/257906 "2020-12-07T19:57:56Z")
I'm trying to write data to Kafka broker authenticated with Kerberos with GSSAPI and SASL. When I start the logstash agent it errors out with Receive Timeout from Kerberos but when i use kinit to get the ticket from kerb… --- ## [Modify All Logs Before Giving To Filter](https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 7:50pm UTC](https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815 "2020-12-07T19:50:48Z")
Hello everyone, Imagine that I have a codec plugin for input and my logs like this : 00:23 Lorem Ipsum 13:35 Lorem Ipsum 14:00 DATE-LINE 01/01/2020 15:43 Lorem Ipsum 20:20 Lorem Ipsum 00:15 Lorem Ipsum 13:10 DAT… --- ## [Cisco FTD module does not appear to be processing any events](https://discuss.elastic.co/t/cisco-ftd-module-does-not-appear-to-be-processing-any-events/257896)
**Author:** [@ThePVD](https://discuss.elastic.co/u/ThePVD)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 7:00pm UTC](https://discuss.elastic.co/t/cisco-ftd-module-does-not-appear-to-be-processing-any-events/257896 "2020-12-07T19:00:47Z")
Helllo! I am currently troubleshooting sending FTD syslog output to a filebeat listener. I'm able to sniff traffic and see packets arriving, but filebeat does not seem to do ANYTHING with the event. I've experimented … --- ## [Help with \`docCount\`](https://discuss.elastic.co/t/help-with-doccount/257894)
**Author:** [@tiagokalinke](https://discuss.elastic.co/u/tiagokalinke)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 6:57pm UTC](https://discuss.elastic.co/t/help-with-doccount/257894 "2020-12-07T18:57:55Z")
Hi. I am using the Explain API to understand the relevance of a result. However, for each request the docCount is varying. { "size": 6, "query": { "bool": { "must": \[ … --- ## [Trying to forward multiple filebeats via a filebeat relay](https://discuss.elastic.co/t/trying-to-forward-multiple-filebeats-via-a-filebeat-relay/257886)
**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 6:17pm UTC](https://discuss.elastic.co/t/trying-to-forward-multiple-filebeats-via-a-filebeat-relay/257886 "2020-12-07T18:17:11Z")
Hello, I have multiple machines running filebeat and a logstash host in my cloud environment. To minimize firewall impact, I created a single VM to be a relay, and forward everything from the other filebeats to the out… --- ## [Error in Dashboard/ \[filebeat System\]](https://discuss.elastic.co/t/error-in-dashboard-filebeat-system/257731)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 10\ **Last updated:** [December 7, 2020, 6:14pm UTC](https://discuss.elastic.co/t/error-in-dashboard-filebeat-system/257731 "2020-12-07T18:14:35Z")
Hi Team, I am getting error (as attached) when clicked in Dashboard and selected file-beat, here I am getting error for tabs Sudo commands | SSH logins | New users and groups. How can I see all this information. … --- ## [Create new or obtain default private-api-key](https://discuss.elastic.co/t/create-new-or-obtain-default-private-api-key/257789)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 4\ **Last updated:** [December 7, 2020, 6:09pm UTC](https://discuss.elastic.co/t/create-new-or-obtain-default-private-api-key/257789 "2020-12-07T18:09:04Z")
Is it possible to automate creation of API Keys (private and search) without needing to do manually steps in Enterprise Search / App Search UI first? We have 4 environments and treats infrastructure and platforms-as-a-c… --- ## [Is it possible to create a new instance or cluster automatically after some number of space created?](https://discuss.elastic.co/t/is-it-possible-to-create-a-new-instance-or-cluster-automatically-after-some-number-of-space-created/257884)
**Author:** [@sunil\_petkar](https://discuss.elastic.co/u/sunil_petkar)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 6:02pm UTC](https://discuss.elastic.co/t/is-it-possible-to-create-a-new-instance-or-cluster-automatically-after-some-number-of-space-created/257884 "2020-12-07T18:02:59Z")
Is it possible to create a new instance or cluster automatically after some number of space created? And add new space to new cluster / instance . Because we have 30K user and we can create max 1000 space for better p… --- ## [Threshold value for color conditioning to be taken from a variable/field rather than giving direct number](https://discuss.elastic.co/t/threshold-value-for-color-conditioning-to-be-taken-from-a-variable-field-rather-than-giving-direct-number/255585)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 6:50pm UTC](https://discuss.elastic.co/t/threshold-value-for-color-conditioning-to-be-taken-from-a-variable-field-rather-than-giving-direct-number/255585 "2020-11-16T18:50:28Z")
"color": { "condition": { "test": {"field": "PercentOfTotal", "gt": 70}, "value": "#B22222" }, "value": "#006400" } By this way I am able to do color conditioning "… --- ## [ILM not deleting indices in data\_stream](https://discuss.elastic.co/t/ilm-not-deleting-indices-in-data-stream/257811)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 5:50pm UTC](https://discuss.elastic.co/t/ilm-not-deleting-indices-in-data-stream/257811 "2020-12-07T17:50:44Z")
Hello! So I've been checking out new features of ELK stack - created a template for data stream and connected a basic ILM policy to it. ILM policy is basically: { "policy": { "phases": { "hot": { … --- ## [The Elasticsearch server could not be reached. Further data is therefore unavailable](https://discuss.elastic.co/t/the-elasticsearch-server-could-not-be-reached-further-data-is-therefore-unavailable/257701)
**Author:** [@webapps](https://discuss.elastic.co/u/webapps)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 3:28pm UTC](https://discuss.elastic.co/t/the-elasticsearch-server-could-not-be-reached-further-data-is-therefore-unavailable/257701 "2020-12-07T15:28:11Z")
Hey, I'm trying to setup the Elasticsearch server in the search-api drupal 8. But I'm getting the above message when I save the server. In parallel with that I accessed the Elasticsearch server URI in the postman, but … --- ## [Auto-login in iFrame using nginx proxy](https://discuss.elastic.co/t/auto-login-in-iframe-using-nginx-proxy/257322)
**Author:** [@Docrom](https://discuss.elastic.co/u/Docrom)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 5:02pm UTC](https://discuss.elastic.co/t/auto-login-in-iframe-using-nginx-proxy/257322 "2020-12-07T17:02:49Z")
Hello everyone, I'm trying to follow the post here in order login to my Kibana iFrame via nginx as proxy but I fail. I'm not really good with proxies and nginx in particular so maybe I'm missing something important tha… --- ## ["destination.geo.country\_iso\_code" field with logstash geoip?](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482)
**Author:** [@Camille](https://discuss.elastic.co/u/Camille)\ **Replies:** 4\ **Last updated:** [December 7, 2020, 3:59pm UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482 "2020-12-07T15:59:07Z")
Hi, is it possible to have to " destination.geo.country\_iso\_code" field with the geoip plugin in logstash ? I use it but similar output fields are "destination.geo.country\_code2" and "destination.geo.country\_code3" and… --- ## [Kibana action webhook failing](https://discuss.elastic.co/t/kibana-action-webhook-failing/257855)
**Author:** [@Alexhutchinson](https://discuss.elastic.co/u/Alexhutchinson)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 3:58pm UTC](https://discuss.elastic.co/t/kibana-action-webhook-failing/257855 "2020-12-07T15:58:53Z")
Hi! I have an 7.10 stack running in ECK, and have a webhook Alert and Action set up (Linked to a custom Security Detection Rule). The webhook endpoint is HTTPS with a self-signed certificate. When hitting test on the c… [Previous page](https://discuss.elastic.co/latest.md?page=1952) [Next page](https://discuss.elastic.co/latest.md?page=1954)