# Latest **URL:** https://discuss.elastic.co/latest.md?page=406 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 407 --- ## [Error when doing knn search with more than one embeddings in the index](https://discuss.elastic.co/t/error-when-doing-knn-search-with-more-than-one-embeddings-in-the-index/352411)
**Author:** [@Carlos\_Carlota](https://discuss.elastic.co/u/Carlos_Carlota)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 7:27pm UTC](https://discuss.elastic.co/t/error-when-doing-knn-search-with-more-than-one-embeddings-in-the-index/352411 "2024-02-08T19:27:15Z")
\< I'm trying to add an extra embedding using another field with the following code: class Search: def \_\_init\_\_(self, index\_name): self.es = Elasticsearch(cloud\_id=os.environ\['ELASTIC\_CLOUD\_ID'\], … --- ## [Single logstash config file should send data to mutiple indices](https://discuss.elastic.co/t/single-logstash-config-file-should-send-data-to-mutiple-indices/352506)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 6\ **Last updated:** [February 8, 2024, 7:08pm UTC](https://discuss.elastic.co/t/single-logstash-config-file-should-send-data-to-mutiple-indices/352506 "2024-02-08T19:08:59Z")
Hello All, Kindly suggest if something wrong I'm doing here. Logstash: 8.8.2 I have two indices: mis-monitoring-webserver and mis-monitoring-webui. I want some additional fileds to be created based on some condition… --- ## [Can't write to logstash (ELK)](https://discuss.elastic.co/t/cant-write-to-logstash-elk/352887)
**Author:** [@Rotem\_Orbach](https://discuss.elastic.co/u/Rotem_Orbach)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 6:13pm UTC](https://discuss.elastic.co/t/cant-write-to-logstash-elk/352887 "2024-02-08T18:13:15Z")
Hi, I'm trying to write to ELK. (using Docker) Elastic is already installed and working properly. I've installed Logstash on docker as well. Problem is I can't see any logs being generated on kibana, I thought tha… --- ## [Logs not being sent if multiple fields in grok pattern](https://discuss.elastic.co/t/logs-not-being-sent-if-multiple-fields-in-grok-pattern/352881)
**Author:** [@vuvu](https://discuss.elastic.co/u/vuvu)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 5:26pm UTC](https://discuss.elastic.co/t/logs-not-being-sent-if-multiple-fields-in-grok-pattern/352881 "2024-02-08T17:26:17Z")
hi! I have the following filter which works fine: filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp}" } } date { match =\> \[ "syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:… --- ## [Filebeat o365 module field type inconsistency](https://discuss.elastic.co/t/filebeat-o365-module-field-type-inconsistency/352884)
**Author:** [@Daniel314](https://discuss.elastic.co/u/Daniel314)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-o365-module-field-type-inconsistency/352884 "2024-02-08T17:41:49Z")
Hi, I've been using the O365 module in FileBeat for a while now, and I've noticed that when the O365 module outputs the o365.audit.AdditionalInfo field, sometimes it's as a JSON string, and sometimes it's as an object. … --- ## [Error executing alerts](https://discuss.elastic.co/t/error-executing-alerts/352883)
**Author:** [@Deividi\_Cavarzan](https://discuss.elastic.co/u/Deividi_Cavarzan)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 5:25pm UTC](https://discuss.elastic.co/t/error-executing-alerts/352883 "2024-02-08T17:25:55Z")
Hi, Some alerts stop working due to the error above, I wans't able to find how to set this index as write. --- ## [Event Correlation - Can Elastic do this?](https://discuss.elastic.co/t/event-correlation-can-elastic-do-this/352880)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 4:49pm UTC](https://discuss.elastic.co/t/event-correlation-can-elastic-do-this/352880 "2024-02-08T16:49:38Z")
Hello, With the introduction of AIOPs, I was wondering if Elastic can do event correlation among different systems and different apps more easily? I know currently we can display variety of systems data in one dashboar… --- ## [Can't log into Elastic in Data Analyst course lab environment](https://discuss.elastic.co/t/cant-log-into-elastic-in-data-analyst-course-lab-environment/352692)
**Author:** [@dherst](https://discuss.elastic.co/u/dherst)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 4:42pm UTC](https://discuss.elastic.co/t/cant-log-into-elastic-in-data-analyst-course-lab-environment/352692 "2024-02-08T16:42:26Z")
Course: Data Analyst Version: \ Question: I'm in the Lab environment. I can see the Terminal, Editor and Lab Instrucctions. When I click on the Kibana tab I'm presented with a login page… --- ## [Load Null values to Index Key column](https://discuss.elastic.co/t/load-null-values-to-index-key-column/352879)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 4:38pm UTC](https://discuss.elastic.co/t/load-null-values-to-index-key-column/352879 "2024-02-08T16:38:29Z")
Hi Team, we had created index with location\_timestamp as key of type date and format "epoch\_millis" as below. "location\_timestamp":{ "type": "date", "format": "epoch\_millis" }, But while loading data from… --- ## [Terms aggregation split by coma](https://discuss.elastic.co/t/terms-aggregation-split-by-coma/352798)
**Author:** [@Imad\_Ourak](https://discuss.elastic.co/u/Imad_Ourak)\ **Replies:** 5\ **Last updated:** [February 8, 2024, 4:32pm UTC](https://discuss.elastic.co/t/terms-aggregation-split-by-coma/352798 "2024-02-08T16:32:51Z")
I have a bunch of Elasticsearch documents that contain information about study fields. I'm trying to aggregate the studyfields field to extract the number of "study fields" instances from the job posting. e.g. data scien… --- ## [Question on DHCP Scope Utilization on Windows for Used IP's, Available IP's, and Total IP's](https://discuss.elastic.co/t/question-on-dhcp-scope-utilization-on-windows-for-used-ips-available-ips-and-total-ips/352878)
**Author:** [@Tortuga](https://discuss.elastic.co/u/Tortuga)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 4:30pm UTC](https://discuss.elastic.co/t/question-on-dhcp-scope-utilization-on-windows-for-used-ips-available-ips-and-total-ips/352878 "2024-02-08T16:30:01Z")
Does anyone know of a way to collect the DHCP stats on a non-domain joined Windows system for the number of used IP's, available IP's, and total IP's? --- ## [\[ERROR\]\[discovery.ec2 \] \[host\] unexpected error while joining cluster, trying again org.elasticsearch.ElasticsearchException: Ping execution failed](https://discuss.elastic.co/t/error-discovery-ec2-host-unexpected-error-while-joining-cluster-trying-again-org-elasticsearch-elasticsearchexception-ping-execution-failed/352690)
**Author:** [@jnunez87](https://discuss.elastic.co/u/jnunez87)\ **Replies:** 7\ **Last updated:** [February 8, 2024, 4:22pm UTC](https://discuss.elastic.co/t/error-discovery-ec2-host-unexpected-error-while-joining-cluster-trying-again-org-elasticsearch-elasticsearchexception-ping-execution-failed/352690 "2024-02-08T16:22:45Z")
Hello all Today we had a very strange error appear today in our cluster that is preventing the node from connecting. Below is our errors \[2024-02-06 23:18:11,590\]\[ERROR\]\[discovery.ec2 \] \[Windeagle\] unexpect… --- ## [Kibana restarting in a loop](https://discuss.elastic.co/t/kibana-restarting-in-a-loop/352877)
**Author:** [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 4:10pm UTC](https://discuss.elastic.co/t/kibana-restarting-in-a-loop/352877 "2024-02-08T16:10:00Z")
Hi, After an upgrade , kibana is restarting in a loop. On kibana.logs, I can see: "message":"\[{\\"type\\":\\"unavailable\_shards\_exception\\",\\"reason\\":\\"\[.kibana\_security\_solution\_8.9.2\_001\]\[0\] Not enough active copies t… --- ## [Process monitor](https://discuss.elastic.co/t/process-monitor/352026)
**Author:** [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Replies:** 13\ **Last updated:** [February 8, 2024, 3:59pm UTC](https://discuss.elastic.co/t/process-monitor/352026 "2024-02-08T15:59:25Z")
Hi Team, I need some help on process monitor ex: datamonitor.exe process from logstash which plugin i need to use. wmi plugin is not working. and more over we are getting the status of process.state as running only.… --- ## [Migrating from RestClient to ElasticsearchClient](https://discuss.elastic.co/t/migrating-from-restclient-to-elasticsearchclient/352575)
**Author:** [@Tony\_Clarke](https://discuss.elastic.co/u/Tony_Clarke)\ **Replies:** 6\ **Last updated:** [February 8, 2024, 3:54pm UTC](https://discuss.elastic.co/t/migrating-from-restclient-to-elasticsearchclient/352575 "2024-02-08T15:54:36Z")
Hi, I'm trying to migrate from using the org.elasticsearch.client.RestClient to co.elastic.clients.elasticsearch.ElasticsearchClient. However, I'm noticing one difference in behavior. The ElasticsearchClient has bespoke… --- ## [Confusion about winlog.process.pid and xcopy](https://discuss.elastic.co/t/confusion-about-winlog-process-pid-and-xcopy/352520)
**Author:** [@nerio](https://discuss.elastic.co/u/nerio)\ **Replies:** 0\ **Last updated:** [February 5, 2024, 10:29am UTC](https://discuss.elastic.co/t/confusion-about-winlog-process-pid-and-xcopy/352520 "2024-02-05T10:29:26Z")
Hello I would have 2 questions : In an event id 1 (pcoess creation), what is the difference between the field winlog.process.pid (eg 2360) and the field process.pid (eg 6392) ? Why did not the command "C:\\Windows\\S… --- ## [Alert for multiple indices without summing them up](https://discuss.elastic.co/t/alert-for-multiple-indices-without-summing-them-up/352721)
**Author:** [@vymk](https://discuss.elastic.co/u/vymk)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 3:46pm UTC](https://discuss.elastic.co/t/alert-for-multiple-indices-without-summing-them-up/352721 "2024-02-08T15:46:15Z")
Hi, I'd like to have alerts if indices don't receive any new documents for a few minutes, therefore I have a rule like this: Now if I add another index to the rule, they get summarized, so as long as one index receiv… --- ## [Disable Stack Monitoring access in Kibana spaces](https://discuss.elastic.co/t/disable-stack-monitoring-access-in-kibana-spaces/352870)
**Author:** [@Manal\_A](https://discuss.elastic.co/u/Manal_A)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 3:38pm UTC](https://discuss.elastic.co/t/disable-stack-monitoring-access-in-kibana-spaces/352870 "2024-02-08T15:38:55Z")
I want to create spaces in Kibana with some limited privileges, and I also want to disable "Stack Management" within those spaces. I want to know what privileges to give to those users so they can only manage their indi… --- ## [API calls taking more than 10s](https://discuss.elastic.co/t/api-calls-taking-more-than-10s/352769)
**Author:** [@kvmuralidhar](https://discuss.elastic.co/u/kvmuralidhar)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 3:28pm UTC](https://discuss.elastic.co/t/api-calls-taking-more-than-10s/352769 "2024-02-08T15:28:35Z")
Hi There, We are running Elasticsearch version 8.8.1 (on prem) and have the following configuration. 3 coordinator nodes 3 dedicated master nodes 17 hot nodes 20 cold nodes 6 frozen nodes (Each frozen node has abou… --- ## [Shrink do not proceed because of number of shard filter](https://discuss.elastic.co/t/shrink-do-not-proceed-because-of-number-of-shard-filter/352861)
**Author:** [@Teoman\_Sevinc](https://discuss.elastic.co/u/Teoman_Sevinc)\ **Replies:** 3\ **Last updated:** [February 8, 2024, 3:27pm UTC](https://discuss.elastic.co/t/shrink-do-not-proceed-because-of-number-of-shard-filter/352861 "2024-02-08T15:27:37Z")
Hi Community, I'm trying to shrink my indices with a curator. This is my action.yml content: actions: 1: action: shrink description: "Shrink indices starting with mylog older than two days" options: … --- ## [Lifecycle is not workin - no errors](https://discuss.elastic.co/t/lifecycle-is-not-workin-no-errors/352875)
**Author:** [@Nathan\_Borik1](https://discuss.elastic.co/u/Nathan_Borik1)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 3:25pm UTC](https://discuss.elastic.co/t/lifecycle-is-not-workin-no-errors/352875 "2024-02-08T15:25:51Z")
Elastic version 7.17.1 Looks like all the settings are ok, no errors but the lifecycle is not running. Not moving to warm or cold and no deletion as specified in the Index Lifecycle Policies. { "lx-logs-be-01" : { … --- ## [Elastic-endpoint installed although defend integration is not applied to policy](https://discuss.elastic.co/t/elastic-endpoint-installed-although-defend-integration-is-not-applied-to-policy/352632)
**Author:** [@Pinpin](https://discuss.elastic.co/u/Pinpin)\ **Replies:** 4\ **Last updated:** [February 8, 2024, 3:05pm UTC](https://discuss.elastic.co/t/elastic-endpoint-installed-although-defend-integration-is-not-applied-to-policy/352632 "2024-02-08T15:05:01Z")
Hi ! I'm kind of new to the whole elastic stack and I was tasked to put in place some sort of log monitoring and siem solution. After deploying the stack on some test hosts, everything was fine so I deployed the agent o… --- ## [Generate multi resolution dashboard/visualize just by url](https://discuss.elastic.co/t/generate-multi-resolution-dashboard-visualize-just-by-url/352455)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 2:47pm UTC](https://discuss.elastic.co/t/generate-multi-resolution-dashboard-visualize-just-by-url/352455 "2024-02-08T14:47:34Z")
Hi friends, How are you? I want to say a story for you! in these days, when i want to create minutely, hourly, daily visualizations. I create 3 visualize. one for minutely resolution, one for hourly and the last one fo… --- ## [Shard allocated / total](https://discuss.elastic.co/t/shard-allocated-total/352868)
**Author:** [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)\ **Replies:** 0\ **Last updated:** [February 8, 2024, 2:02pm UTC](https://discuss.elastic.co/t/shard-allocated-total/352868 "2024-02-08T14:02:30Z")
Hi everyone, im doing some check on my system and im analyzing the number of shard on my deployment. Im using two "command" to check how many shard im using. With the command GET /\_stats?level=cluster&filter\_path=\_sh… --- ## [Can we create kibana dashboards as code?](https://discuss.elastic.co/t/can-we-create-kibana-dashboards-as-code/352783)
**Author:** [@senyam08](https://discuss.elastic.co/u/senyam08)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 1:57pm UTC](https://discuss.elastic.co/t/can-we-create-kibana-dashboards-as-code/352783 "2024-02-08T13:57:53Z")
Is there a way we can automate kibana dashboard creation? It would be great if we could create via version controlled source for better tracking and easy maintenance. Thanks --- ## [Using Elastic Search Latest Version Throw Exception](https://discuss.elastic.co/t/using-elastic-search-latest-version-throw-exception/352739)
**Author:** [@GANESHAN\_RAMAN](https://discuss.elastic.co/u/GANESHAN_RAMAN)\ **Replies:** 3\ **Last updated:** [February 8, 2024, 1:54pm UTC](https://discuss.elastic.co/t/using-elastic-search-latest-version-throw-exception/352739 "2024-02-08T13:54:50Z")
Hi, My application with Elasticsearch was working fine until Elasticsearch version 7.17.9, As there is a vulnerability issue with this version as reported by black duck i changed to the recent version 8.12.0, Once i c… --- ## [Add volume for each strimzi kafka broker](https://discuss.elastic.co/t/add-volume-for-each-strimzi-kafka-broker/352864)
**Author:** [@jerin](https://discuss.elastic.co/u/jerin)\ **Replies:** 1\ **Last updated:** [February 8, 2024, 1:44pm UTC](https://discuss.elastic.co/t/add-volume-for-each-strimzi-kafka-broker/352864 "2024-02-08T13:44:44Z")
I am sending logs to Elasticsearch like below beats -- logstash entry -- Kafka -- logstash indexing -- Elasticsearch . We want to remove Kafka in the data flow by replacing with logstash persistent queue .. currently … --- ## [How Can I generate Root-ca.pem for Elasticsearch for integrating with wazuh](https://discuss.elastic.co/t/how-can-i-generate-root-ca-pem-for-elasticsearch-for-integrating-with-wazuh/352835)
**Author:** [@fahim2024](https://discuss.elastic.co/u/fahim2024)\ **Replies:** 3\ **Last updated:** [February 8, 2024, 1:28pm UTC](https://discuss.elastic.co/t/how-can-i-generate-root-ca-pem-for-elasticsearch-for-integrating-with-wazuh/352835 "2024-02-08T13:28:00Z")
It would be great if someone help me with step by step guidance with explanation --- ## [Slowness in Kibana and high CPU utilization usage](https://discuss.elastic.co/t/slowness-in-kibana-and-high-cpu-utilization-usage/352824)
**Author:** [@Seemant\_Bind](https://discuss.elastic.co/u/Seemant_Bind)\ **Replies:** 8\ **Last updated:** [February 8, 2024, 1:26pm UTC](https://discuss.elastic.co/t/slowness-in-kibana-and-high-cpu-utilization-usage/352824 "2024-02-08T13:26:55Z")
Hi, I am facing slowness in Kibana Production. Discover and dashboard is taking too much time to load and sometimes getting the error as shown in the first screenshot. I checked the cluster status from the stack mon… --- ## [Multiple Inner\_hit on knn](https://discuss.elastic.co/t/multiple-inner-hit-on-knn/351893)
**Author:** [@Tommaso\_FAVARON](https://discuss.elastic.co/u/Tommaso_FAVARON)\ **Replies:** 4\ **Last updated:** [February 8, 2024, 1:11pm UTC](https://discuss.elastic.co/t/multiple-inner-hit-on-knn/351893 "2024-02-08T13:11:35Z")
here my index mapping: { "chunker2": { "aliases": {}, "mappings": { "properties": { "creation\_time": { "type": "date" }, "full\_text": { "type": "text" … [Previous page](https://discuss.elastic.co/latest.md?page=405) [Next page](https://discuss.elastic.co/latest.md?page=407)