# Latest **URL:** https://discuss.elastic.co/latest.md?page=1969 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1970 --- ## [Malicious is reported in the zip file for windows platform](https://discuss.elastic.co/t/malicious-is-reported-in-the-zip-file-for-windows-platform/256707)
**Author:** [@dtln](https://discuss.elastic.co/u/dtln)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 2:56pm UTC](https://discuss.elastic.co/t/malicious-is-reported-in-the-zip-file-for-windows-platform/256707 "2020-11-30T14:56:11Z")
I scan the zip file for windows platform which downloaded from (https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-install.html) using virustotal. But it report that it has Malicious in it. … --- ## [Провести поиск по пустому "" значению в массиве документа](https://discuss.elastic.co/t/topic/256646)
**Author:** [@Leleka](https://discuss.elastic.co/u/Leleka)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 3:01pm UTC](https://discuss.elastic.co/t/topic/256646 "2020-11-30T15:01:23Z")
Добрий день У меня есть такая структура данных в базе еластик { "hits": \[ { "\_index": "database", "\_type": "\_doc", "\_id": "1", "\_score": 1.0, "\_source": { "Card\_H… --- ## [Failed to close Detection alert](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 2:53pm UTC](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407 "2020-11-30T14:53:41Z")
Hello, Version 7.9.2 I was trying to clean up / close some old alerts and I get the following error: Known issue? In the Kibana logs I find a 409: Request referrer: https://kiburl:5601/app/security/detections?f… --- ## [ML Datafeed lookback retrieved no data](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 2:40pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864 "2020-11-30T14:40:15Z")
Hello, I am trying to run the job "windows\_rare\_user\_type10\_remote\_login" in my cluster and It process no data, and I am getting ML Datafeed lookback retrieved no data Knowing that I already installed winlogbeat in s… --- ## [Slowness in ES bulk inserts](https://discuss.elastic.co/t/slowness-in-es-bulk-inserts/256886)
**Author:** [@Chirag\_Patwa](https://discuss.elastic.co/u/Chirag_Patwa)\ **Replies:** 10\ **Last updated:** [November 30, 2020, 2:32pm UTC](https://discuss.elastic.co/t/slowness-in-es-bulk-inserts/256886 "2020-11-30T14:32:50Z")
We are running behind the schedule to achieve something and we need help. Please take a look and suggest something. Issue: Slowness on bulk Indexing. For 10000 records its taking 27560 ms For 500 records its taking ab… --- ## [Elasticsearch Shards problem](https://discuss.elastic.co/t/elasticsearch-shards-problem/256998)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [November 29, 2020, 5:48pm UTC](https://discuss.elastic.co/t/elasticsearch-shards-problem/256998 "2020-11-29T17:48:55Z")
I have set-up elasticsearch 8 node cluster 3 master 3 data(500gb total 1.5 tb) +2 coordinate nodes each node have 16gb ram and 4 CPUs and it uses only 2 cpu. In client side we have packbeat and winlogbeat pointing to ka… --- ## [ElasticSearch - Sort by another field which is not mentioned in field section aggregation query](https://discuss.elastic.co/t/elasticsearch-sort-by-another-field-which-is-not-mentioned-in-field-section-aggregation-query/257080)
**Author:** [@Mamta\_Shettigar](https://discuss.elastic.co/u/Mamta_Shettigar)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 2:27pm UTC](https://discuss.elastic.co/t/elasticsearch-sort-by-another-field-which-is-not-mentioned-in-field-section-aggregation-query/257080 "2020-11-30T14:27:12Z")
I want to perform aggregation on a certain results and then sort it. While aggregation query works fine. We want to sort the results based on another parameter and not the aggregated field. Say for example I want to aggr… --- ## [ILM policy to transform index](https://discuss.elastic.co/t/ilm-policy-to-transform-index/256974)
**Author:** [@fadjar340](https://discuss.elastic.co/u/fadjar340)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 2:10pm UTC](https://discuss.elastic.co/t/ilm-policy-to-transform-index/256974 "2020-11-30T14:10:39Z")
Is it possible to use ILM policy to the transform index result? I tried to the transform index and added alias into it, but the ILM not works as expected for transform indices. Is there any workaround to do this? Rega… --- ## [Categorizing similar values](https://discuss.elastic.co/t/categorizing-similar-values/257071)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 2:04pm UTC](https://discuss.elastic.co/t/categorizing-similar-values/257071 "2020-11-30T14:04:21Z")
Hi, Is there a way to categorize similar values of specific field, during the query time ? for example, suppose I have these documents: {..., message: "this is message no 1",...} {..., message: "this is message no 2"… --- ## [Http 400 query crashes elastic search cluster](https://discuss.elastic.co/t/http-400-query-crashes-elastic-search-cluster/256228)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 1:54pm UTC](https://discuss.elastic.co/t/http-400-query-crashes-elastic-search-cluster/256228 "2020-11-30T13:54:37Z")
on a 5.6 ES cluster that i don't administrate, i noticed, when a query gives an error HTTP 400 such as {"error":{"root\_cause":\[{"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: template is mi… --- ## [Help parse Snort IDS Alert](https://discuss.elastic.co/t/help-parse-snort-ids-alert/256991)
**Author:** [@coolkaveh](https://discuss.elastic.co/u/coolkaveh)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 1:30pm UTC](https://discuss.elastic.co/t/help-parse-snort-ids-alert/256991 "2020-11-30T13:30:27Z")
Please help me to correct my Logstash conf as below: Log: 11/28-06:50:39.263833 \[\*\*\] \[1:31978:5\] OS-OTHER Bash CGI environment variable injection attempt \[\*\*\] \[Classification: Attempted Administrator Privilege Gain\] \[… --- ## [Eliminate Failure that Later Converted in Success in Dashboard](https://discuss.elastic.co/t/eliminate-failure-that-later-converted-in-success-in-dashboard/257051)
**Author:** [@Vaishali19](https://discuss.elastic.co/u/Vaishali19)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 1:24pm UTC](https://discuss.elastic.co/t/eliminate-failure-that-later-converted-in-success-in-dashboard/257051 "2020-11-30T13:24:55Z")
Hi All, I have a requirement to create a dashboard in kibana for SuccessVsFailure for institutions. The single user is identified by token and I want to eliminate failures which later converted into Success on retry. Ho… --- ## [Elasticsearch single node "cluster" fails with "incoming term X does not match current term Y"](https://discuss.elastic.co/t/elasticsearch-single-node-cluster-fails-with-incoming-term-x-does-not-match-current-term-y/256857)
**Author:** [@tobal](https://discuss.elastic.co/u/tobal)\ **Replies:** 6\ **Last updated:** [November 30, 2020, 1:22pm UTC](https://discuss.elastic.co/t/elasticsearch-single-node-cluster-fails-with-incoming-term-x-does-not-match-current-term-y/256857 "2020-11-30T13:22:58Z")
Hi there, We have a recurring error in our test environment, where elasticsearch fails to boot up. We have logs from two occurrence, but sadly we can't reproduce the error consistently to help determine what the problem… --- ## [Elasticesearch 7.6.2 translog overflow issue](https://discuss.elastic.co/t/elasticesearch-7-6-2-translog-overflow-issue/256776)
**Author:** [@rambling](https://discuss.elastic.co/u/rambling)\ **Replies:** 9\ **Last updated:** [November 30, 2020, 1:08pm UTC](https://discuss.elastic.co/t/elasticesearch-7-6-2-translog-overflow-issue/256776 "2020-11-30T13:08:58Z")
Hi, recently I caught very strange behavior of translog in my cluster: I noticed that one node was executing task for 3 days like: "node" : "PAHpy641TPqLYhPOKPnAvQ", "id" : 1336600606, "type" : "trans… --- ## [Taking several snapshots in parallell](https://discuss.elastic.co/t/taking-several-snapshots-in-parallell/257054)
**Author:** [@johanhaugland](https://discuss.elastic.co/u/johanhaugland)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 1:07pm UTC](https://discuss.elastic.co/t/taking-several-snapshots-in-parallell/257054 "2020-11-30T13:07:51Z")
As discussed in https://github.com/elastic/elasticsearch/issues/27353 it is desirable to either queue snapshots, or even better, take several snapshots in parallell. I have not been able to find documentation on how thi… --- ## [Clearing selection for dropdowncontrol in Canvas](https://discuss.elastic.co/t/clearing-selection-for-dropdowncontrol-in-canvas/256405)
**Author:** [@shaigbdb](https://discuss.elastic.co/u/shaigbdb)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 12:57pm UTC](https://discuss.elastic.co/t/clearing-selection-for-dropdowncontrol-in-canvas/256405 "2020-11-30T12:57:36Z")
I have a dropdowncontrol A, and then a dropdowncontrol B. A filters B, which works fine. But once I make a choice in B, changing the choice in A doesn't remove the choice in B: it just adds up to it, causing B to show n… --- ## [Kibana Maintainance notification](https://discuss.elastic.co/t/kibana-maintainance-notification/256988)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 12:52pm UTC](https://discuss.elastic.co/t/kibana-maintainance-notification/256988 "2020-11-30T12:52:30Z")
How do I get Maintainance notification on kibana GUI ? --- ## [Having an issue enabling proper multiline options for container logs](https://discuss.elastic.co/t/having-an-issue-enabling-proper-multiline-options-for-container-logs/256916)
**Author:** [@sloney](https://discuss.elastic.co/u/sloney)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 12:36pm UTC](https://discuss.elastic.co/t/having-an-issue-enabling-proper-multiline-options-for-container-logs/256916 "2020-11-30T12:36:06Z")
Currently have these settings enabled, hoping to make all logs that start with a date like: 2020-11-27 to be in their own entry, including java stack traces. multiline.type: pattern multiline.pattern: '^\[0-9\]{4}-\[0-9\]{… --- ## [Error trying to setup filebeat](https://discuss.elastic.co/t/error-trying-to-setup-filebeat/257011)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 12:26pm UTC](https://discuss.elastic.co/t/error-trying-to-setup-filebeat/257011 "2020-11-30T12:26:26Z")
i'm geting this error trying to setup Filebeat 7.10 on a 7.10 Elasticsearch cluster: ➜ filebeat ./filebeat setup Overwriting ILM policy is disabled. Set \`setup.ilm.overwrite: true… --- ## [Watcher Alerting on multi-bucket anomaly?](https://discuss.elastic.co/t/watcher-alerting-on-multi-bucket-anomaly/256911)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 12:11pm UTC](https://discuss.elastic.co/t/watcher-alerting-on-multi-bucket-anomaly/256911 "2020-11-30T12:11:52Z")
Its posible to alert only on multi-bucket anomalies? can you direct me to some examples please? thanks --- ## [Elastic 7.9.2 / kibana 7.9.2 pie chart, json filter pb refresh display](https://discuss.elastic.co/t/elastic-7-9-2-kibana-7-9-2-pie-chart-json-filter-pb-refresh-display/256865)
**Author:** [@Corben\_Dallas](https://discuss.elastic.co/u/Corben_Dallas)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 11:19am UTC](https://discuss.elastic.co/t/elastic-7-9-2-kibana-7-9-2-pie-chart-json-filter-pb-refresh-display/256865 "2020-11-30T11:19:43Z")
Hello, i work on migration dashboard, vizualisation, queries, kibana 4.5.2 to 7.9.2 I created simple pie chart 7.9.2, with filter with kql, working fine, result is ok. i create new pie chart 7.9.2, same approach at … --- ## [After applied the tutorial "Getting start with Elasticsearch security" Logstash receive Syslog data but Kibana can’t show it](https://discuss.elastic.co/t/after-applied-the-tutorial-getting-start-with-elasticsearch-security-logstash-receive-syslog-data-but-kibana-can-t-show-it/256666)
**Author:** [@Thelmo\_Henrique\_Sant](https://discuss.elastic.co/u/Thelmo_Henrique_Sant)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 11:42am UTC](https://discuss.elastic.co/t/after-applied-the-tutorial-getting-start-with-elasticsearch-security-logstash-receive-syslog-data-but-kibana-can-t-show-it/256666 "2020-11-30T11:42:09Z")
Hi buddies! I getting a problem after applying "Getting start with Elasticsearch security" to my environment. I followed this entire procedure: And everything works fine. Elasticsearch protected with user and passwo… --- ## [Elasticsearch perform slow process intermittently](https://discuss.elastic.co/t/elasticsearch-perform-slow-process-intermittently/255510)
**Author:** [@fardhana](https://discuss.elastic.co/u/fardhana)\ **Replies:** 12\ **Last updated:** [November 30, 2020, 10:59am UTC](https://discuss.elastic.co/t/elasticsearch-perform-slow-process-intermittently/255510 "2020-11-30T10:59:48Z")
Hi, i have nodejs consumer using rabbitmq that doing one of this two thing. simple Indexing into elasticsearch using predifined \_id (using INDEX API) search using specific id then if the doc exists it will running upda… --- ## [Kibana scripted field error tells me I dont have any values in field while they do show up in discovery](https://discuss.elastic.co/t/kibana-scripted-field-error-tells-me-i-dont-have-any-values-in-field-while-they-do-show-up-in-discovery/256851)
**Author:** [@skibana](https://discuss.elastic.co/u/skibana)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 10:40am UTC](https://discuss.elastic.co/t/kibana-scripted-field-error-tells-me-i-dont-have-any-values-in-field-while-they-do-show-up-in-discovery/256851 "2020-11-30T10:40:29Z")
I've been trying to create a scripted field in which i want to make a URL which directs me to a specific APM timeline page. The values I want to add to this URL are filters which are needed to select te specific transact… --- ## [How to get started for beginners](https://discuss.elastic.co/t/how-to-get-started-for-beginners/253194)
**Author:** [@palash-cj](https://discuss.elastic.co/u/palash-cj)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 12:50am UTC](https://discuss.elastic.co/t/how-to-get-started-for-beginners/253194 "2020-10-26T00:50:21Z")
Hey There...! It feels really excited to talk about GSOC for beginners. But the graph of excitement tends towards the negative slope when one stucks because of lack of mentorship, proper guidelines to start and the init… --- ## [Unable to login to kibana](https://discuss.elastic.co/t/unable-to-login-to-kibana/256758)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 10:35am UTC](https://discuss.elastic.co/t/unable-to-login-to-kibana/256758 "2020-11-30T10:35:11Z")
Hi Team, I am unable to login to kibana dashboard. We have kibana url as \`\`. It's only accessible from intranet. We have haproxy where request first goes and from there it goes to kibana server on 8601. # Ansible man… --- ## [Kibana defualt indexes usage](https://discuss.elastic.co/t/kibana-defualt-indexes-usage/256985)
**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 10:26am UTC](https://discuss.elastic.co/t/kibana-defualt-indexes-usage/256985 "2020-11-30T10:26:48Z")
Hi, How do I determine which of my .Kibana indexes are being used by the stack? i have quite a few of those indexes, some of which are probably not benig used and are interfering with my logstash and elasticsearch upda… --- ## [Strict search in Kibana](https://discuss.elastic.co/t/strict-search-in-kibana/256695)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 10:25am UTC](https://discuss.elastic.co/t/strict-search-in-kibana/256695 "2020-11-30T10:25:02Z")
I'm looking for messages with 'mydomain.tld' homepage address only. Now i get this result: where "path" is random uri How to get below result without photoshop? --- ## [Index pattern routing](https://discuss.elastic.co/t/index-pattern-routing/256897)
**Author:** [@mats.ahlbom](https://discuss.elastic.co/u/mats.ahlbom)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 10:19am UTC](https://discuss.elastic.co/t/index-pattern-routing/256897 "2020-11-30T10:19:10Z")
Hi, We have setup our cluster and we have some logs and metrics flowing in to Elastic. Now we have tried to add Gerrit logs and metrics. The problem I have is the metrics-data is in both of the Kibana patterns. I hav… --- ## [ES datanode can't join the cluster since disconnected from master](https://discuss.elastic.co/t/es-datanode-cant-join-the-cluster-since-disconnected-from-master/257023)
**Author:** [@AngryCookie](https://discuss.elastic.co/u/AngryCookie)\ **Replies:** 6\ **Last updated:** [November 30, 2020, 10:16am UTC](https://discuss.elastic.co/t/es-datanode-cant-join-the-cluster-since-disconnected-from-master/257023 "2020-11-30T10:16:20Z")
​ Hi, we are faced with a huge problem that is random nodes started disconnecting from the master and can't join to the cluster again util i restart it. First, the messages from master node.The master detects that a nod… [Previous page](https://discuss.elastic.co/latest.md?page=1968) [Next page](https://discuss.elastic.co/latest.md?page=1970)