# Latest **URL:** https://discuss.elastic.co/latest.md?page=1987 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1988 --- ## [How to find out if password of elastic user is already set or not](https://discuss.elastic.co/t/how-to-find-out-if-password-of-elastic-user-is-already-set-or-not/254872)
**Author:** [@MartinG](https://discuss.elastic.co/u/MartinG)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 7:08am UTC](https://discuss.elastic.co/t/how-to-find-out-if-password-of-elastic-user-is-already-set-or-not/254872 "2020-11-20T07:08:48Z")
Hi there, I am building up Elasticsearch clusters automatically with Ansible and have a problem with the initial setting of the "elastic" user password. As described in the documentation a initial and transient bootstr… --- ## [Split is not working on multivalued string fields](https://discuss.elastic.co/t/split-is-not-working-on-multivalued-string-fields/256068)
**Author:** [@Abdul\_Aziz](https://discuss.elastic.co/u/Abdul_Aziz)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 7:06am UTC](https://discuss.elastic.co/t/split-is-not-working-on-multivalued-string-fields/256068 "2020-11-20T07:06:08Z")
I have record like below in my text file; id=1 name=Paint category=Decorative color=2345|red|5|| color=123|green|4|| color=345|yellow|8|| REC$$ I wanted output (stdout) as below using logstash configuration; "id… --- ## [Constant session timeouts in Kibana 7.10.0 on OpenShift but not with 7.9.3](https://discuss.elastic.co/t/constant-session-timeouts-in-kibana-7-10-0-on-openshift-but-not-with-7-9-3/256000)
**Author:** [@ngilmore](https://discuss.elastic.co/u/ngilmore)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 6:52am UTC](https://discuss.elastic.co/t/constant-session-timeouts-in-kibana-7-10-0-on-openshift-but-not-with-7-9-3/256000 "2020-11-20T06:52:30Z")
I have installed a secured Elastic 7.10.0 cluster (3 master, 2 client, 5 data nodes) on OpenShift and added Kibana (2 node cluster). However, with Kibana 7.10.0 installed it constantly experiences session timeouts. I h… --- ## [Logstash Grok filters, split and path](https://discuss.elastic.co/t/logstash-grok-filters-split-and-path/256015)
**Author:** [@Priyanka3](https://discuss.elastic.co/u/Priyanka3)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 5:46am UTC](https://discuss.elastic.co/t/logstash-grok-filters-split-and-path/256015 "2020-11-20T05:46:58Z")
Hi, I am new to Elastic search. So, can anyone explain me the difference between Split, xpath and Grok filters? and under what situation do we use these? Thanks, Priyanka --- ## [Having read-only shard greater than 50 GB](https://discuss.elastic.co/t/having-read-only-shard-greater-than-50-gb/256061)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 5:32am UTC](https://discuss.elastic.co/t/having-read-only-shard-greater-than-50-gb/256061 "2020-11-20T05:32:39Z")
I recently re-indexed past 18 months of day-wise indices (18 months \*30 days = 540 indices with 1 primary shard per index) into 18 monthly indices (18 indices with 12 primary shards per index). No indexing happens on th… --- ## [Failed to set password for user \[apm\_system\] with elastic password](https://discuss.elastic.co/t/failed-to-set-password-for-user-apm-system-with-elastic-password/256005)
**Author:** [@xziten](https://discuss.elastic.co/u/xziten)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 5:12am UTC](https://discuss.elastic.co/t/failed-to-set-password-for-user-apm-system-with-elastic-password/256005 "2020-11-20T05:12:24Z")
Hi, I'm trying to setup an elasticsearch cluster. 3 nodes : 1 master, 1 master / data\_hot, 1 data\_warm Elastic Version : 7.10 System : RHEL 8.3 Step by step : Installing Configuring nodes and test if everything… --- ## [Chart Data Not Available in Time Windows of Two Hours or Less?](https://discuss.elastic.co/t/chart-data-not-available-in-time-windows-of-two-hours-or-less/255450)
**Author:** [@astorm](https://discuss.elastic.co/u/astorm)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 4:44am UTC](https://discuss.elastic.co/t/chart-data-not-available-in-time-windows-of-two-hours-or-less/255450 "2020-11-20T04:44:55Z")
I'm relatively new to Elastic Search and Kibaba, so I'm unsure if this is user error or a bug. The short version is my chart data does not show up with time windows less than three hours I'm using Elastic Cloud. I've … --- ## [Config SSL/TLS Kibana and Elasticsearch](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820)
**Author:** [@aloalo2242](https://discuss.elastic.co/u/aloalo2242)\ **Replies:** 4\ **Last updated:** [November 20, 2020, 2:37am UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820 "2020-11-20T02:37:23Z")
Hi, Im trying to enable Fleet in Ingest Manager. And it say I have to enable this xpack.security.authc.api\_key.enabled: true in elasticsearch.yml. But if add that line, I have to add bellow line too: xpack.security.en… --- ## [Adding a custom field in alerts without defining in query](https://discuss.elastic.co/t/adding-a-custom-field-in-alerts-without-defining-in-query/255300)
**Author:** [@PD98](https://discuss.elastic.co/u/PD98)\ **Replies:** 12\ **Last updated:** [November 20, 2020, 4:23am UTC](https://discuss.elastic.co/t/adding-a-custom-field-in-alerts-without-defining-in-query/255300 "2020-11-20T04:23:13Z")
Hi, I have a field called organization.name in my logs. I have created a rule based on the field externalId only. However I want that the organization.name field should also be fetched when the alert is generated. I don… --- ## [Modsecurity Log Grok Filter](https://discuss.elastic.co/t/modsecurity-log-grok-filter/256057)
**Author:** [@reza\_naipospos](https://discuss.elastic.co/u/reza_naipospos)\ **Replies:** 10\ **Last updated:** [November 20, 2020, 4:21am UTC](https://discuss.elastic.co/t/modsecurity-log-grok-filter/256057 "2020-11-20T04:21:28Z")
I make grok filter with this condition but noting show anything on grok debugger. Log format is Modsecurity audit log (?%{YEAR}\[./\]%{MONTHNUM}\[./\]%{MONTHDAY} %{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER:thread… --- ## [Add custom field on IIS log](https://discuss.elastic.co/t/add-custom-field-on-iis-log/256054)
**Author:** [@victortamotsu](https://discuss.elastic.co/u/victortamotsu)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 2:34am UTC](https://discuss.elastic.co/t/add-custom-field-on-iis-log/256054 "2020-11-20T02:34:52Z")
Hi everybody! I added a custom field on IIS log to register the original client IP (x-forwarded-for). This is necessary because I use a reverse proxy to publish my webserver, so the Client IP Address (c-ip) show only th… --- ## [Policy to automatically delete indexes with max days and size](https://discuss.elastic.co/t/policy-to-automatically-delete-indexes-with-max-days-and-size/255995)
**Author:** [@cruizba](https://discuss.elastic.co/u/cruizba)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 12:28am UTC](https://discuss.elastic.co/t/policy-to-automatically-delete-indexes-with-max-days-and-size/255995 "2020-11-20T00:28:14Z")
Hello to all the Elastic Stack community and developers :slight\_smile: We have a server that use Elasticsearch to store logs, events and metrics. This server configure a policy which delete an Index if it is older that … --- ## [Non-negative Serial Diff for a "counter" that resets to 0 from time to time](https://discuss.elastic.co/t/non-negative-serial-diff-for-a-counter-that-resets-to-0-from-time-to-time/256046)
**Author:** [@mludvig](https://discuss.elastic.co/u/mludvig)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 11:35pm UTC](https://discuss.elastic.co/t/non-negative-serial-diff-for-a-counter-that-resets-to-0-from-time-to-time/256046 "2020-11-19T23:35:48Z")
I'm collecting stats from some industrial process that has variable number of workers that produce some output at a variable rate, that is accumulating to a balance queue that from time to time is flushed and reset to 0. … --- ## [Canvas workpad - intermittently broken visualizations](https://discuss.elastic.co/t/canvas-workpad-intermittently-broken-visualizations/255780)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 11:29pm UTC](https://discuss.elastic.co/t/canvas-workpad-intermittently-broken-visualizations/255780 "2020-11-19T23:29:26Z")
Hey All Elastic/Kibana Version 7.9.1 Have this weird issue in canvas. I get 0 results when counting docs. It happens in all visualisations. Here is an example. In this sample, I want to count the number of backups. … --- ## [Metricbeat doesn't communicate with Elasticsearch](https://discuss.elastic.co/t/metricbeat-doesnt-communicate-with-elasticsearch/256035)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 11:03pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-communicate-with-elasticsearch/256035 "2020-11-19T23:03:13Z")
Hi! I have installed Metricbeat and I have Security feature installed on my ELK! After I make all configurations with certificates and modules I get this error: "service": { "type": "elasticsearch", "address… --- ## [Action Shrink n Reindex with Curator](https://discuss.elastic.co/t/action-shrink-n-reindex-with-curator/256028)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 6:25pm UTC](https://discuss.elastic.co/t/action-shrink-n-reindex-with-curator/256028 "2020-11-19T18:25:18Z")
Hello, I need to shrink an index called log\_index\_ARC (too many shards/replicas). Also, i want after shrink process, add an alias on new shrink index (log\_index\_ARC-shrink) to log\_index\_ARC (original value so). Here m… --- ## [Is it possible to use payload as input to an exec output command?](https://discuss.elastic.co/t/is-it-possible-to-use-payload-as-input-to-an-exec-output-command/256042)
**Author:** [@esguy](https://discuss.elastic.co/u/esguy)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 10:18pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-payload-as-input-to-an-exec-output-command/256042 "2020-11-19T22:18:14Z")
Hello, I have a watcher set up with multiple email actions where each email action has a conditional checking whats in the user field of the payload. For example, if user = 'userGroupA', then it will execute the action … --- ## [Heat Map visualization of Azure DevOps Pipeline build](https://discuss.elastic.co/t/heat-map-visualization-of-azure-devops-pipeline-build/255868)
**Author:** [@sachin1112](https://discuss.elastic.co/u/sachin1112)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 9:37pm UTC](https://discuss.elastic.co/t/heat-map-visualization-of-azure-devops-pipeline-build/255868 "2020-11-19T21:37:33Z")
Hello Experts, we are trying to create a Heat map to reflect last 10 pipeline builds for environments (Dev, Test, Prod) In the metric section we had chosen the count , in the x axis we had taken the Date histogram an… --- ## [Integration Office365](https://discuss.elastic.co/t/integration-office365/256023)
**Author:** [@nottellingyou](https://discuss.elastic.co/u/nottellingyou)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 9:13pm UTC](https://discuss.elastic.co/t/integration-office365/256023 "2020-11-19T21:13:55Z")
Has anyone successfully integrated o365 with integrations in ElasticCloud? --- ## [Logstash.bat generates new .jar files every time it is run](https://discuss.elastic.co/t/logstash-bat-generates-new-jar-files-every-time-it-is-run/255747)
**Author:** [@Mefhisto1](https://discuss.elastic.co/u/Mefhisto1)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 9:01pm UTC](https://discuss.elastic.co/t/logstash-bat-generates-new-jar-files-every-time-it-is-run/255747 "2020-11-19T21:01:10Z")
Hi, I'm running logstash every minute via a task scheduler. The task is to call logstash.bat with the appropriate .config file. This is done every minute. Logstash is generating a lot of files in TEMP folder every ti… --- ## [Kibana server is not ready after upgrading to 7.10](https://discuss.elastic.co/t/kibana-server-is-not-ready-after-upgrading-to-7-10/256029)
**Author:** [@patrickr](https://discuss.elastic.co/u/patrickr)\ **Replies:** 6\ **Last updated:** [November 19, 2020, 8:19pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-after-upgrading-to-7-10/256029 "2020-11-19T20:19:34Z")
Hello, We seem to constantly have issues when attempting to upgrade. This time, after the upgrade is complete and the server has rebooted, we simply get a kibana is not ready message. Can someone provide any informati… --- ## ["error":{"type":"missing\_references","references":\[{"type":"search","id":"dfd3ea60-0154-11eb-8672-4ba31b1f4ee1"}\]](https://discuss.elastic.co/t/error-type-missing-references-references-type-search-id-dfd3ea60-0154-11eb-8672-4ba31b1f4ee1/255979)
**Author:** [@PADMAVATHI\_GUNTURU](https://discuss.elastic.co/u/PADMAVATHI_GUNTURU)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 8:09pm UTC](https://discuss.elastic.co/t/error-type-missing-references-references-type-search-id-dfd3ea60-0154-11eb-8672-4ba31b1f4ee1/255979 "2020-11-19T20:09:46Z")
Hi, I'm importing a dashboard from one kibana to another kibana, While importing I'm got the error "missing\_references". Here dashboard having 8 visualizations. Here I have a doubt that, when importing the dashboard, the… --- ## [Kibana scripted fields](https://discuss.elastic.co/t/kibana-scripted-fields/255930)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 7:36pm UTC](https://discuss.elastic.co/t/kibana-scripted-fields/255930 "2020-11-19T19:36:08Z")
i am differentiating two date fields and getting the time in milliseconds as output. here is my code if(!doc\['confirmedAt'\].empty) { return doc\['confirmedAt'\].value.getMillis() - doc\['createdAt'\].value.getMillis() } … --- ## [Calculating MTTR(Mean Time to Recovery)](https://discuss.elastic.co/t/calculating-mttr-mean-time-to-recovery/255741)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:13pm UTC](https://discuss.elastic.co/t/calculating-mttr-mean-time-to-recovery/255741 "2020-11-19T19:13:06Z")
I have an Index having build failed and succeeded status with respective time stamp. I want to calculate MTTR(Mean Time to Recovery) using scripted field or any other option available. Any suggestions? --- ## [Get datepart from @timestamp in 7.1](https://discuss.elastic.co/t/get-datepart-from-timestamp-in-7-1/255752)
**Author:** [@himanshur](https://discuss.elastic.co/u/himanshur)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:09pm UTC](https://discuss.elastic.co/t/get-datepart-from-timestamp-in-7-1/255752 "2020-11-19T19:09:23Z")
I am trying to get the date part from the @timestamp field in 7.1. Looks like all the date functions were introduced in 7.5. Is there a way I can get the date part using SQL in Kibana Trying the below query SELECT dat… --- ## [Problem execute watcher "Cannot invoke \\"Object.getClass()\\" because \\"callArgs\[0\]\\" is null"](https://discuss.elastic.co/t/problem-execute-watcher-cannot-invoke-object-getclass-because-callargs-0-is-null/255763)
**Author:** [@John\_Martinez](https://discuss.elastic.co/u/John_Martinez)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:05pm UTC](https://discuss.elastic.co/t/problem-execute-watcher-cannot-invoke-object-getclass-because-callargs-0-is-null/255763 "2020-11-19T19:05:57Z")
Hello experts, the following watcher should be executed when five failed logins occur in five minutes. { "trigger": { "schedule": { "interval": "5m" } }, "input": { "search": { "request": {… --- ## [Time Series Sum aggregation](https://discuss.elastic.co/t/time-series-sum-aggregation/255770)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:03pm UTC](https://discuss.elastic.co/t/time-series-sum-aggregation/255770 "2020-11-19T19:03:07Z")
I have a series of endpoint readings each containing an integer value as read at that point in time (on the hour) and I am trying to generate a time series sum aggregation. I want to view it for a year but I want to kee… --- ## [Kibana metric visualization - Get Inner hits count](https://discuss.elastic.co/t/kibana-metric-visualization-get-inner-hits-count/255781)
**Author:** [@Abhilash\_Sathe](https://discuss.elastic.co/u/Abhilash_Sathe)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:59pm UTC](https://discuss.elastic.co/t/kibana-metric-visualization-get-inner-hits-count/255781 "2020-11-19T18:59:53Z")
Here's my code to get inner hits count. GET my\_index/\_search { "\_source": \[ "inner\_hits" \], "query": { "nested": { "path": "someNestedK… --- ## [Grok cant detect change of line](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 0\ **Last updated:** [November 18, 2020, 7:36am UTC](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796 "2020-11-18T07:36:45Z")
Hello all, I have the following file that i want to grok: AG 100045 1FB702 27.12.2011 675337068 ZFA31200000...... AG 100045 X 17.11.1961 084260332 5352... AG 100046 1SF995 22.04.2016 217347660 TMBET6NH1G4...... AG 1… --- ## [Bucket key/item counting](https://discuss.elastic.co/t/bucket-key-item-counting/255826)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:54pm UTC](https://discuss.elastic.co/t/bucket-key-item-counting/255826 "2020-11-19T18:54:45Z")
Hello, I have a bucket that looks like this: { "took" : 0, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "va… [Previous page](https://discuss.elastic.co/latest.md?page=1986) [Next page](https://discuss.elastic.co/latest.md?page=1988)