# Latest **URL:** https://discuss.elastic.co/latest.md?page=1993 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1994 --- ## [Annotate a doc thru Kibana](https://discuss.elastic.co/t/annotate-a-doc-thru-kibana/255561)
**Author:** [@Narendra\_Jain](https://discuss.elastic.co/u/Narendra_Jain)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:51pm UTC](https://discuss.elastic.co/t/annotate-a-doc-thru-kibana/255561 "2020-11-17T22:51:05Z")
Hi, Is there a way a Kibana user can annotate a document, eg. a doc show some random value which operation team reason and annotate the doc so next person understand the behavior same for exception log --- ## [Cluster crashed: "Server gave HTTP response to HTTPS client"](https://discuss.elastic.co/t/cluster-crashed-server-gave-http-response-to-https-client/255762)
**Author:** [@realscout](https://discuss.elastic.co/u/realscout)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 10:48pm UTC](https://discuss.elastic.co/t/cluster-crashed-server-gave-http-response-to-https-client/255762 "2020-11-17T22:48:13Z")
Today, our ElasticSearch cluster stopped responding. We were not performing any sort of maintenance or making any changes. Any request to the cluster caused it to respond with: "Get "https://X.X.X.X:X/": http: server g… --- ## [Is Storage Size under Index Management includes replicated data storage size as well?](https://discuss.elastic.co/t/is-storage-size-under-index-management-includes-replicated-data-storage-size-as-well/255662)
**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:45pm UTC](https://discuss.elastic.co/t/is-storage-size-under-index-management-includes-replicated-data-storage-size-as-well/255662 "2020-11-17T22:45:57Z")
I am wondering if the storage size under Index Management is calculated for data and replicated data both. Example if my replication Factor is 2 , then do storage size tells the ( data storage + 2 \* replicated data stor… --- ## [Replacing Elasticsearch Node](https://discuss.elastic.co/t/replacing-elasticsearch-node/255654)
**Author:** [@junydania](https://discuss.elastic.co/u/junydania)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:45pm UTC](https://discuss.elastic.co/t/replacing-elasticsearch-node/255654 "2020-11-17T22:45:17Z")
Hello, I have a 3 node elasticsearch cluster running on version 7.6.2 in a container environment. Three nodes used with each container running on unique host machines. Each node in the cluster is both a master and data… --- ## [Windows 2019: elastic-agent and endpoint security](https://discuss.elastic.co/t/windows-2019-elastic-agent-and-endpoint-security/255679)
**Author:** [@fausap](https://discuss.elastic.co/u/fausap)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 11:36am UTC](https://discuss.elastic.co/t/windows-2019-elastic-agent-and-endpoint-security/255679 "2020-11-17T11:36:53Z")
Hello, I'm testing the endpoint-security feature through Elastic Agent. I was able to install and enroll the agent, but I have this error in the logs: {"log.level":"error","@timestamp":"2020-11-17T12:19:09.127+0100","l… --- ## [Assistance with fields and filtering on Elk query](https://discuss.elastic.co/t/assistance-with-fields-and-filtering-on-elk-query/255695)
**Author:** [@douglasnew](https://discuss.elastic.co/u/douglasnew)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:39pm UTC](https://discuss.elastic.co/t/assistance-with-fields-and-filtering-on-elk-query/255695 "2020-11-17T22:39:11Z")
HI all. Can someone assist. I am trying to add an additional field to this query but it does not seem to work as expected. I am trying to simply ass the field "message" and filter based on a matched string. Here is my … --- ## [Logstash as daemon won't start](https://discuss.elastic.co/t/logstash-as-daemon-wont-start/255716)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:05pm UTC](https://discuss.elastic.co/t/logstash-as-daemon-wont-start/255716 "2020-11-17T22:05:25Z")
I just upgraded system to 7.10.0 this is test system. and logstash daemon won't start. here is result of journalctl -xe start-up result is done. Nov 17 08:28:25 elkdev01 logstash\[13918\]: Using bundled JDK: /usr/sha… --- ## [Field "process.command\_line" not popluated even though I can see it in the message field](https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 9:53pm UTC](https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589 "2020-11-17T21:53:12Z")
Hello, I need some orientation with my issue : Description : I have an ELK stack version 7.6 that collects event logs from different log sources via logstash. All endpoints (windows ends linux) send logs to logstash t… --- ## [Winlogbeat Deployment with SCCM](https://discuss.elastic.co/t/winlogbeat-deployment-with-sccm/255760)
**Author:** [@atomiczombie79](https://discuss.elastic.co/u/atomiczombie79)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 8:59pm UTC](https://discuss.elastic.co/t/winlogbeat-deployment-with-sccm/255760 "2020-11-17T20:59:08Z")
Does anyone have any experience building out an SCCM package for Winlogbeat? Our Security team would like to use Winlogbeat and Sysmon to monitor the environment and I would like to be able to deploy using SCCM. I curr… --- ## [Sort Discover Search Table 7.10](https://discuss.elastic.co/t/sort-discover-search-table-7-10/255708)
**Author:** [@weand](https://discuss.elastic.co/u/weand)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 8:36pm UTC](https://discuss.elastic.co/t/sort-discover-search-table-7-10/255708 "2020-11-17T20:36:28Z")
Hi, it seems sorting in the Discover Search Table does not work in anymore in recent Releases. Tested with 7.9 and 7.10. Is that a known bug ? Cheers Andreas --- ## [Elasticsearch heap dump phd](https://discuss.elastic.co/t/elasticsearch-heap-dump-phd/255572)
**Author:** [@perezs](https://discuss.elastic.co/u/perezs)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 8:12pm UTC](https://discuss.elastic.co/t/elasticsearch-heap-dump-phd/255572 "2020-11-17T20:12:33Z")
Does Elasticsearch have plugin's to analyze Java heap dumps phd format? --- ## [Filebeat doesn't work with AWS ES domain](https://discuss.elastic.co/t/filebeat-doesnt-work-with-aws-es-domain/255683)
**Author:** [@hairongGao](https://discuss.elastic.co/u/hairongGao)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 8:12pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-work-with-aws-es-domain/255683 "2020-11-17T20:12:09Z")
Hi Team, I've been trying to make filebeat working with AWS ES domain , but I keep getting this error: 2020-11-17T11:42:25.740Z ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(ela… --- ## [Elasticsearch winlogbeat field host.ip value issue](https://discuss.elastic.co/t/elasticsearch-winlogbeat-field-host-ip-value-issue/255660)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 8:09pm UTC](https://discuss.elastic.co/t/elasticsearch-winlogbeat-field-host-ip-value-issue/255660 "2020-11-17T20:09:28Z")
winlogbeat version 7.2.0 host.ip : 10.33.55.5 But winlogbeat version 7.10.0 host.ip field show: fe80::95f4:40d4:80a3:8cd, 10.33.55.5, fe80::399f:e9ad:5f5a:9511, 169.254.149.17, fe80::dc91:96a:a1b8:82e3, 169.254.130.22… --- ## [Accessing nested fields in ruby filter for math](https://discuss.elastic.co/t/accessing-nested-fields-in-ruby-filter-for-math/255740)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 7:30pm UTC](https://discuss.elastic.co/t/accessing-nested-fields-in-ruby-filter-for-math/255740 "2020-11-17T19:30:54Z")
Hello, I am having issues with this bit of code where I am trying to add 3 nested fields together and place them in a new nested field. here is my bit of ruby code ruby { code =\> "event.set('\[device\]\[disconnect\]\[dura… --- ## [Backwards update for transform data](https://discuss.elastic.co/t/backwards-update-for-transform-data/255668)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 7:16pm UTC](https://discuss.elastic.co/t/backwards-update-for-transform-data/255668 "2020-11-17T19:16:21Z")
Hello I wonder what's the best practices , in case of a failed transform (for example if a new index was created with wrong mapping or any reason), of completing the missing data. example: created a new transform at 2… --- ## [Elastisearch daterange filter - days of week](https://discuss.elastic.co/t/elastisearch-daterange-filter-days-of-week/255750)
**Author:** [@shifra](https://discuss.elastic.co/u/shifra)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 6:51pm UTC](https://discuss.elastic.co/t/elastisearch-daterange-filter-days-of-week/255750 "2020-11-17T18:51:28Z")
Hi! This is my first time on this forum, I hope my question is clear. Please let me know if I should add any details. My goal: Implement a filter on days of week and time I'm trying to implement a filter for open hour… --- ## [Sort array before concatenated fingerprint hash?](https://discuss.elastic.co/t/sort-array-before-concatenated-fingerprint-hash/255602)
**Author:** [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Replies:** 5\ **Last updated:** [November 17, 2020, 6:56pm UTC](https://discuss.elastic.co/t/sort-array-before-concatenated-fingerprint-hash/255602 "2020-11-17T18:56:02Z")
I have src\_ip and dst\_ip fields. I have copied both those values to "\[fw\]\[talkers\]" field to produce this: "fw": { "talkers": \[ "172.16.216.118", "172.23.253.22" \] Now I run fingerprint on this value to pr… --- ## [Kubernetes.container.memory.usage.bytes doesn't match pmap](https://discuss.elastic.co/t/kubernetes-container-memory-usage-bytes-doesnt-match-pmap/255748)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 6:48pm UTC](https://discuss.elastic.co/t/kubernetes-container-memory-usage-bytes-doesnt-match-pmap/255748 "2020-11-17T18:48:20Z")
None of the metric sets listed above closely match: pmap \ which is the size of the process. I have tried working set, rss and usage.bytes, and none seem to match this. What is the correct metric to use for memor… --- ## [EnterpriseSearch : "Could not perform access check to Enterprise Search"](https://discuss.elastic.co/t/enterprisesearch-could-not-perform-access-check-to-enterprise-search/255548)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 6:46pm UTC](https://discuss.elastic.co/t/enterprisesearch-could-not-perform-access-check-to-enterprise-search/255548 "2020-11-17T18:46:13Z")
Hi, I am trying to bind my Enterprise Search instance to my Kibana with SSL. My Enterprise Search instance works well alone, but Kibana refuses to connect to it : {"type":"log","@timestamp":"2020-11-16T13:44:55Z","ta… --- ## [Python3 Large Query Cardinality & Query return different results](https://discuss.elastic.co/t/python3-large-query-cardinality-query-return-different-results/255717)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 6:45pm UTC](https://discuss.elastic.co/t/python3-large-query-cardinality-query-return-different-results/255717 "2020-11-17T18:45:44Z")
hi, i'm using python3 and the elasticsearch library to query some very large ES indexes. I've been following this blog post as a reference: I'm getting some results i dont understand, the Cardnality returns a certa… --- ## [FVH Highlighter Not Being Used By Default](https://discuss.elastic.co/t/fvh-highlighter-not-being-used-by-default/255743)
**Author:** [@jdouty](https://discuss.elastic.co/u/jdouty)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 6:12pm UTC](https://discuss.elastic.co/t/fvh-highlighter-not-being-used-by-default/255743 "2020-11-17T18:12:16Z")
Hi everyone! I've been playing around with the FVH and noticed the highlighter isn't behaving as it's described in the term vector documention. Down at the bottom of that page it shows that you can use the default high… --- ## [Elastic Agent Linux Install Directory](https://discuss.elastic.co/t/elastic-agent-linux-install-directory/255595)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 6:10pm UTC](https://discuss.elastic.co/t/elastic-agent-linux-install-directory/255595 "2020-11-17T18:10:12Z")
Hi all, I installed Elastic Agent from /tmp/elastic-agent-7.10.0-linux-x86\_64. I now see a metricbeat running from /tmp/elastic-agent-7.10.0-linux-x86\_64/data/elastic-agent-1428d5. Is this intended? Why are downloaded … --- ## [Filebeat fortinet module not indexing after upgrading it and kibana to 7.10.0,](https://discuss.elastic.co/t/filebeat-fortinet-module-not-indexing-after-upgrading-it-and-kibana-to-7-10-0/255739)
**Author:** [@jonjon](https://discuss.elastic.co/u/jonjon)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 5:32pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-not-indexing-after-upgrading-it-and-kibana-to-7-10-0/255739 "2020-11-17T17:32:09Z")
I upgraded Kibana and filebeat to 7.10.0 and my Fortinet logs aren't being indexed anymore. Looking at the logs, it looks like I am filebeat is connected to Kibana but I am getting several of these messages below and log… --- ## [Trouble Mutating](https://discuss.elastic.co/t/trouble-mutating/255598)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 6\ **Last updated:** [November 17, 2020, 5:36pm UTC](https://discuss.elastic.co/t/trouble-mutating/255598 "2020-11-17T17:36:19Z")
I am having trouble performing a mutate. I thought I had it working with a more simplified version of this config but cannot seem to get it going in this new one (though everything else seems to be working much better). … --- ## [Get system.process.cpu.user.ticks](https://discuss.elastic.co/t/get-system-process-cpu-user-ticks/255584)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 4:59pm UTC](https://discuss.elastic.co/t/get-system-process-cpu-user-ticks/255584 "2020-11-17T16:59:16Z")
I am trying to located system.process.cpu.user.ticks but I can't find it on my output. do I have to enable something in my system.module file? I only have following for system.process "cpu" =\> { … --- ## [Elastic Agent 7.10 - Setup - Invalid URL - NULL](https://discuss.elastic.co/t/elastic-agent-7-10-setup-invalid-url-null/255416)
**Author:** [@casa0](https://discuss.elastic.co/u/casa0)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 4:43pm UTC](https://discuss.elastic.co/t/elastic-agent-7-10-setup-invalid-url-null/255416 "2020-11-17T16:43:17Z")
Hi, I'm seeing an error "Invalid URL: null" when trying to view any pages related to fleet. I was testing 7.9.3 in Docker and was able to add a few agents, then upgraded to 7.10.0. Now none of the fleet pages will load.… --- ## [Setting re-index batch size in curator tool](https://discuss.elastic.co/t/setting-re-index-batch-size-in-curator-tool/255579)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 4:30pm UTC](https://discuss.elastic.co/t/setting-re-index-batch-size-in-curator-tool/255579 "2020-11-17T16:30:46Z")
When using \_reindex api in Elasticsearch, we can set scroll batch size as below From https://www.elastic.co/guide/en/elasticsearch/reference/6.8/docs-reindex.html - By default \_reindex uses scroll batches of 1000. You c… --- ## [Connect both ES 6.7 & ES 7.x to the same Kibana host](https://discuss.elastic.co/t/connect-both-es-6-7-es-7-x-to-the-same-kibana-host/255649)
**Author:** [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 3:46pm UTC](https://discuss.elastic.co/t/connect-both-es-6-7-es-7-x-to-the-same-kibana-host/255649 "2020-11-17T15:46:52Z")
Hi mates, Now I am running old Security Onion 16 (ElasticStack v6.7) and want to upgrade to S.O2.3 but I see the incident response process is much more complicated so I decide to build a new ES + Kibana v7.10, then the … --- ## [Ruby Script in Logstash :: Enters a NULL into the Data?](https://discuss.elastic.co/t/ruby-script-in-logstash-enters-a-null-into-the-data/255727)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 3:41pm UTC](https://discuss.elastic.co/t/ruby-script-in-logstash-enters-a-null-into-the-data/255727 "2020-11-17T15:41:54Z")
Hi Logstash Jedi Masters, I’m running Logstash 7.7.1 in the Docker container. (Yes, I know I need to upgrade) In my Logstash config file, I’m running a snippet of Ruby code: ruby { init =\> " require 'sock… --- ## [Prune filter plugin - How whitelist a nested field?](https://discuss.elastic.co/t/prune-filter-plugin-how-whitelist-a-nested-field/255720)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 3:16pm UTC](https://discuss.elastic.co/t/prune-filter-plugin-how-whitelist-a-nested-field/255720 "2020-11-17T15:16:14Z")
Documentation at has this example and it mentions that it would allow only "msg" through. filter { prune { whitelist\_names =\> \["^msg$"\] } } If I have a single record that has "source" … [Previous page](https://discuss.elastic.co/latest.md?page=1992) [Next page](https://discuss.elastic.co/latest.md?page=1994)