# Latest **URL:** https://discuss.elastic.co/latest.md?page=1984 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1985 --- ## [Watcher that outputs the total number of snapshots in a repository](https://discuss.elastic.co/t/watcher-that-outputs-the-total-number-of-snapshots-in-a-repository/256244)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 0\ **Last updated:** [November 21, 2020, 10:09pm UTC](https://discuss.elastic.co/t/watcher-that-outputs-the-total-number-of-snapshots-in-a-repository/256244 "2020-11-21T22:09:48Z")
How do I get the total number of snapshots from a repository with this input? I've tried ctx.payload.hits and ctx.payload.hits.value but the value is blank. Any help would be greatly appreciated. "input" : { "ht… --- ## [Kibana add wrong duplicate values](https://discuss.elastic.co/t/kibana-add-wrong-duplicate-values/256256)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 11:55pm UTC](https://discuss.elastic.co/t/kibana-add-wrong-duplicate-values/256256 "2020-11-22T23:55:27Z")
Hi, This is a sample from discovery section in kibana. It happens only some times that values are duplicate. The exact log in Grok Debugger looks fine. Whys this is happening? I've added this line to logstash but not… --- ## [Kibana Dev Tools: can the commands in console be saved?](https://discuss.elastic.co/t/kibana-dev-tools-can-the-commands-in-console-be-saved/256263)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 10:59pm UTC](https://discuss.elastic.co/t/kibana-dev-tools-can-the-commands-in-console-be-saved/256263 "2020-11-22T22:59:39Z")
Right now, the commands in the Kibana Dev Tools console appears to be tied to the browser. If you change computers or use a different browser session, it is gone completely. It is probably implemented this way because t… --- ## [Group\_concat aggragation](https://discuss.elastic.co/t/group-concat-aggragation/256285)
**Author:** [@chupacabra](https://discuss.elastic.co/u/chupacabra)\ **Replies:** 0\ **Last updated:** [November 22, 2020, 9:15pm UTC](https://discuss.elastic.co/t/group-concat-aggragation/256285 "2020-11-22T21:15:40Z")
Hello everybody. I am new to elasticsearch and I would like to create a group\_concat aggregation. But I don't know how. Can someone help me please. The example data: POST /example\_measures/\_bulk {"index":{"\_id"… --- ## [ILM in kubernetes](https://discuss.elastic.co/t/ilm-in-kubernetes/255603)
**Author:** [@Armen\_Khachikyan](https://discuss.elastic.co/u/Armen_Khachikyan)\ **Replies:** 4\ **Last updated:** [November 22, 2020, 8:09pm UTC](https://discuss.elastic.co/t/ilm-in-kubernetes/255603 "2020-11-22T20:09:24Z")
community I need your help, I am using ELK like 3 months, and now I need to add ILM policy in elasticsearch pod in kubernetes with curl -XPUT -u username:password http://localhost:9200/\_ilm/policy/name --header "Conte… --- ## [Set custom @timestamp from fields not working](https://discuss.elastic.co/t/set-custom-timestamp-from-fields-not-working/256262)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [November 22, 2020, 5:31pm UTC](https://discuss.elastic.co/t/set-custom-timestamp-from-fields-not-working/256262 "2020-11-22T17:31:48Z")
Hello all, i need help setting @timestamp from fields, why date plugin is not parsing my custom fill\_date correctly? mutate { add\_field =\> { "fill\_date" =\> "%{FillDate} %{FillTime}" } } date { timezone =\> "UCT… --- ## [Перестал работать мониторинг кластера](https://discuss.elastic.co/t/topic/255451)
**Author:** [@KOTOXJle6](https://discuss.elastic.co/u/KOTOXJle6)\ **Replies:** 9\ **Last updated:** [November 22, 2020, 4:21pm UTC](https://discuss.elastic.co/t/topic/255451 "2020-11-22T16:21:53Z")
Добрый день. Несколько дней назад заметил что в кластере перестали отображаться данные. Появляется стандартное окно При попытке включить self monitoring говорит что данных нет При этом индексы существуют Я уже … --- ## [Got response code '400' contacting Elasticsearch](https://discuss.elastic.co/t/got-response-code-400-contacting-elasticsearch/256276)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 2:35pm UTC](https://discuss.elastic.co/t/got-response-code-400-contacting-elasticsearch/256276 "2020-11-22T14:35:08Z")
Using local instance of Logstash 7.10. with output to Cloud services made an horror hours to me as it is 'pretty bad not telling a thing' issue, however: If your Logstash starts properly and connects to a cloud; If you… --- ## [Elasticsearch 7.9.3 upgrade - GC issues](https://discuss.elastic.co/t/elasticsearch-7-9-3-upgrade-gc-issues/256257)
**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\ **Replies:** 3\ **Last updated:** [November 22, 2020, 2:34pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-upgrade-gc-issues/256257 "2020-11-22T14:34:02Z")
Hello, I have started the upgrade process to Elasticsearch-7.9.3 and I see that although I was using CMS GC before, and G1GC configurations are commented out, the instance starts and logs indicates that G1GC is used. W… --- ## [How to get a scripted field value as metric in heatmap](https://discuss.elastic.co/t/how-to-get-a-scripted-field-value-as-metric-in-heatmap/255707)
**Author:** [@preeti1211](https://discuss.elastic.co/u/preeti1211)\ **Replies:** 4\ **Last updated:** [November 22, 2020, 12:21pm UTC](https://discuss.elastic.co/t/how-to-get-a-scripted-field-value-as-metric-in-heatmap/255707 "2020-11-22T12:21:20Z")
My scenario - On heatmap, I want y axis to be defined in three rows, one for each environment(dev,test,val) and x axis should correspond to latest 10 builds for each environment. Each cell in a heatmap represents a uni… --- ## [Dynamic color changing text box based on Pipeline Build Status](https://discuss.elastic.co/t/dynamic-color-changing-text-box-based-on-pipeline-build-status/254443)
**Author:** [@sachin1112](https://discuss.elastic.co/u/sachin1112)\ **Replies:** 22\ **Last updated:** [November 22, 2020, 12:20pm UTC](https://discuss.elastic.co/t/dynamic-color-changing-text-box-based-on-pipeline-build-status/254443 "2020-11-22T12:20:20Z")
Hello , I am trying to create a textbox whose background color will change based on the status of the latest build. I need this visualization on Dashboard rather than on canvas. Thanks, Sachin --- ## [Elastic Stack 7.9.3 on Raspberry Pi 4](https://discuss.elastic.co/t/elastic-stack-7-9-3-on-raspberry-pi-4/254450)
**Author:** [@jamesgarside](https://discuss.elastic.co/u/jamesgarside)\ **Replies:** 2\ **Last updated:** [November 22, 2020, 11:41am UTC](https://discuss.elastic.co/t/elastic-stack-7-9-3-on-raspberry-pi-4/254450 "2020-11-22T11:41:14Z")
Hello all, I have just successfully deployed the Elastic Stack to a Raspberry Pi 4 Ubuntu20.04 environment. Obviously Elasticsearch is supported so that was a breeze, the tricky part was Kibana as it doesn't have an of… --- ## [Can't start auditbeat](https://discuss.elastic.co/t/cant-start-auditbeat/255097)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 24\ **Last updated:** [November 22, 2020, 10:18am UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097 "2020-11-22T10:18:32Z")
I have installed auditbeat (latest version). This is my config file (I hid the output.logstash/kibana part as it's irrelevant and has sensitive data. Also, it doesn't even have audit rules - it didn't work before so I r… --- ## [Prevent pop up with the error "To create custom links, you must be subscribed to an Elastic Gold license or above. With it, you'll have the ability to create custom links to improve your workflow when analyzing your services" appears in kibana apm service](https://discuss.elastic.co/t/prevent-pop-up-with-the-error-to-create-custom-links-you-must-be-subscribed-to-an-elastic-gold-license-or-above-with-it-youll-have-the-ability-to-create-custom-links-to-improve-your-workflow-when-analyzing-your-services-appears-in-kibana-apm-service/256044)
**Author:** [@zbioe](https://discuss.elastic.co/u/zbioe)\ **Replies:** 4\ **Last updated:** [November 22, 2020, 9:18am UTC](https://discuss.elastic.co/t/prevent-pop-up-with-the-error-to-create-custom-links-you-must-be-subscribed-to-an-elastic-gold-license-or-above-with-it-youll-have-the-ability-to-create-custom-links-to-improve-your-workflow-when-analyzing-your-services-appears-in-kibana-apm-service/256044 "2020-11-22T09:18:50Z")
After configure APM in some agents, when i go to page APM -\> Services -\> foo -\> Transactions -\> PUT Media/UpdateMedia {mediaID/sourceID/version} to see my headers in request, i got the error 403 with on get in this ur… --- ## [Enrich SIEM Data](https://discuss.elastic.co/t/enrich-siem-data/255749)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 8:10am UTC](https://discuss.elastic.co/t/enrich-siem-data/255749 "2020-11-22T08:10:55Z")
How to enrich SIEM data with Threat Intelligence? SIEM data can be overwhelming, how to implement Threat Intelligence feed like OTX Alienvault or other Intel feeds? --- ## [Logstash S3 Input Error](https://discuss.elastic.co/t/logstash-s3-input-error/256250)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 7:22am UTC](https://discuss.elastic.co/t/logstash-s3-input-error/256250 "2020-11-22T07:22:39Z")
Hi All, I am getting this error while running logstash with S3 input plugin. Is there anything wrong with my config. include\_object\_properties=\>false\> Error: Net::OpenTimeout Exception: Seahorse::Client::Networkin… --- ## [How to use S3 Input Plugin with assume role\_arn](https://discuss.elastic.co/t/how-to-use-s3-input-plugin-with-assume-role-arn/256248)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 0\ **Last updated:** [November 22, 2020, 1:52am UTC](https://discuss.elastic.co/t/how-to-use-s3-input-plugin-with-assume-role-arn/256248 "2020-11-22T01:52:08Z")
Hi, I am trying to find a way to use the S3 input plugin to ingest AWS Cloudtrail data. I have the config working but the way I am doing doesn't seem to be streamlined. So this is how I am able to make it work till now. … --- ## [Why does Beat need to connect to Kibana?](https://discuss.elastic.co/t/why-does-beat-need-to-connect-to-kibana/255417)
**Author:** [@houmie](https://discuss.elastic.co/u/houmie)\ **Replies:** 4\ **Last updated:** [November 22, 2020, 1:11am UTC](https://discuss.elastic.co/t/why-does-beat-need-to-connect-to-kibana/255417 "2020-11-22T01:11:54Z")
In filebeat.yml there is this line Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API. But filebeat either connects to logstash or directly to Elasticsearch. Elastic search then in return… --- ## [Add parameter "include\_type\_name":true in index settings block](https://discuss.elastic.co/t/add-parameter-include-type-name-true-in-index-settings-block/256078)
**Author:** [@Tamil\_Selvan](https://discuss.elastic.co/u/Tamil_Selvan)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 6:52pm UTC](https://discuss.elastic.co/t/add-parameter-include-type-name-true-in-index-settings-block/256078 "2020-11-20T18:52:07Z")
In ES version 7.9.3, the include\_type\_name is defaulted to false, need to make it true, Need to pass include\_type\_name=true in request URL Is there is another way without passing in the request url --- ## [Elasticsearch: "high" CPU usage every 6 minutes for one minute](https://discuss.elastic.co/t/elasticsearch-high-cpu-usage-every-6-minutes-for-one-minute/256235)
**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\ **Replies:** 2\ **Last updated:** [November 21, 2020, 8:03pm UTC](https://discuss.elastic.co/t/elasticsearch-high-cpu-usage-every-6-minutes-for-one-minute/256235 "2020-11-21T20:03:43Z")
Hi, I'm running ELK Stack 7.10.0 (elasticsearch, filebeat, kibana, logstash) on the same server. And since two days elasticsearch is doing something every 6 minutes for one minute. The CPU usage is not high, but it's li… --- ## [SearchTemplate issue Java API](https://discuss.elastic.co/t/searchtemplate-issue-java-api/256185)
**Author:** [@Mombasa](https://discuss.elastic.co/u/Mombasa)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 7:57pm UTC](https://discuss.elastic.co/t/searchtemplate-issue-java-api/256185 "2020-11-20T19:57:45Z")
I'm stuck with a SearchTemplate request, until now I've been able to write queries thru the QueryBuilder and execute them calling the "search" method of the RestHighLevelClient java client, but when I try to execute the … --- ## [\[Grok\] Array of patterns - only first pattern matched](https://discuss.elastic.co/t/grok-array-of-patterns-only-first-pattern-matched/256234)
**Author:** [@james64](https://discuss.elastic.co/u/james64)\ **Replies:** 2\ **Last updated:** [November 21, 2020, 5:19pm UTC](https://discuss.elastic.co/t/grok-array-of-patterns-only-first-pattern-matched/256234 "2020-11-21T17:19:21Z")
Hello, based on this documentation I am trying to use grok filter with this configuration: grok { match =\> { "message" =\> \[ ' volume\_path="%{UNIXPATH:csi\_volume\_path}', … --- ## [WARN#011\[elasticsearch\]#011elasticsearch/client.go:408#011Cannot index event publisher.Event](https://discuss.elastic.co/t/warn-011-elasticsearch-011elasticsearch-client-go-408-011cannot-index-event-publisher-event/254608)
**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\ **Replies:** 2\ **Last updated:** [November 21, 2020, 4:52pm UTC](https://discuss.elastic.co/t/warn-011-elasticsearch-011elasticsearch-client-go-408-011cannot-index-event-publisher-event/254608 "2020-11-21T16:52:50Z")
Hi, ES is flooting syslog. Nov 7 13:57:04 nuc-mini-server filebeat\[757\]: 2020-11-07T13:57:04.044+0100#011WARN#011\[elasticsearch\]#011elasticsearch/client.go:408#011Cannot index event publisher.Event{Content:beat.Event{… --- ## [Alternative to running logstash from the command line](https://discuss.elastic.co/t/alternative-to-running-logstash-from-the-command-line/256231)
**Author:** [@jafri6](https://discuss.elastic.co/u/jafri6)\ **Replies:** 1\ **Last updated:** [November 21, 2020, 4:05pm UTC](https://discuss.elastic.co/t/alternative-to-running-logstash-from-the-command-line/256231 "2020-11-21T16:05:26Z")
I have a perfect working solution on ELK. The only issue that I am facing is that I want the logstash config to be run in the background as compared to running in the command line: /usr/share/logstash/bin/logstash --pat… --- ## [Parsing error Logstash with file as input](https://discuss.elastic.co/t/parsing-error-logstash-with-file-as-input/256227)
**Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 1\ **Last updated:** [November 21, 2020, 3:09pm UTC](https://discuss.elastic.co/t/parsing-error-logstash-with-file-as-input/256227 "2020-11-21T15:09:30Z")
Hi Folks , I'm new in ELK , i'm trying read and parse a file with logstash. But I get some errors during the parsing process Here is an example of logs // date="Nov 21 2020 14:36:00" AED="1.1.1.1" type=group\_location … --- ## [How does ES stores the geopoints or location of an entry?](https://discuss.elastic.co/t/how-does-es-stores-the-geopoints-or-location-of-an-entry/256230)
**Author:** [@HseinBitar](https://discuss.elastic.co/u/HseinBitar)\ **Replies:** 0\ **Last updated:** [November 21, 2020, 3:09pm UTC](https://discuss.elastic.co/t/how-does-es-stores-the-geopoints-or-location-of-an-entry/256230 "2020-11-21T15:09:14Z")
I need to return nearest 10 results with score above a threshold that I specify. I do have the location of every entry, as a geopoint with latitude and longitude. I doubt a geospatial index would be useful for such a … --- ## [Ruby exception occurred: undefined method \`\[\]' for #\ **Author:** [@sujeetjha](https://discuss.elastic.co/u/sujeetjha)\ **Replies:** 3\ **Last updated:** [November 21, 2020, 2:02pm UTC](https://discuss.elastic.co/t/ruby-exception-occurred-undefined-method-for-logstash/256131 "2020-11-21T14:02:51Z") filter { ## Ignore the comments that IIS will add to the start of the W3C logs # if \[message\] =~ "^#" { drop {} } grok { ## Very helpful site for building these statements: # http://grokdebug.her… --- ## [How to search text field for list of "terms" / "keywords"](https://discuss.elastic.co/t/how-to-search-text-field-for-list-of-terms-keywords/256218)
**Author:** [@msta](https://discuss.elastic.co/u/msta)\ **Replies:** 0\ **Last updated:** [November 21, 2020, 11:50am UTC](https://discuss.elastic.co/t/how-to-search-text-field-for-list-of-terms-keywords/256218 "2020-11-21T11:50:29Z")
Hi ES Community, We have a set of text-documents indexed, and their primary field is an analyzed version of their text (stored in a text field). We want to exact or partial match any of a long list of keywords in the te… --- ## [Unable to load an index with more than 2.1 B documents](https://discuss.elastic.co/t/unable-to-load-an-index-with-more-than-2-1-b-documents/256211)
**Author:** [@amir\_veyseh](https://discuss.elastic.co/u/amir_veyseh)\ **Replies:** 10\ **Last updated:** [November 21, 2020, 10:43am UTC](https://discuss.elastic.co/t/unable-to-load-an-index-with-more-than-2-1-b-documents/256211 "2020-11-21T10:43:54Z")
I stopped the elasticSearch service and restarted it. Now, one of the indices cannot be loaded. Here's the status of the indeices: yellow open test-index \_taPEhm3ReSwCYjb1Y5hQA 1 1 3 0 7.5kb … --- ## [Filebeat-\* index pattern (Can´t find it!)](https://discuss.elastic.co/t/filebeat-index-pattern-can-t-find-it/256208)
**Author:** [@771M771](https://discuss.elastic.co/u/771M771)\ **Replies:** 3\ **Last updated:** [November 21, 2020, 4:43am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-can-t-find-it/256208 "2020-11-21T04:43:24Z")
I´ve installed and configured ELK (elasticsearch, logstash, kibana, and filebeat) and they are up and running on localhost:ports. But when I try to create an index pattern in Kibana after uploading my .json it can´t find… [Previous page](https://discuss.elastic.co/latest.md?page=1983) [Next page](https://discuss.elastic.co/latest.md?page=1985)