# Latest **URL:** https://discuss.elastic.co/latest.md?page=412 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 413 --- ## [Aggregate query after filter](https://discuss.elastic.co/t/aggregate-query-after-filter/352428)
**Author:** [@akashmaharana93](https://discuss.elastic.co/u/akashmaharana93)\ **Replies:** 2\ **Last updated:** [February 2, 2024, 5:29pm UTC](https://discuss.elastic.co/t/aggregate-query-after-filter/352428 "2024-02-02T17:29:38Z")
I want the count of documents post filter in a dataset. So I am invoking a DSL query to do this but not getting any result. For ex : Count number of error messages in logs for a given date range. My query for fetching … --- ## [How to exclude a template from Elasticsearch Auto index creation](https://discuss.elastic.co/t/how-to-exclude-a-template-from-elasticsearch-auto-index-creation/352392)
**Author:** [@Veysel\_yuksel](https://discuss.elastic.co/u/Veysel_yuksel)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 5:16pm UTC](https://discuss.elastic.co/t/how-to-exclude-a-template-from-elasticsearch-auto-index-creation/352392 "2024-02-02T17:16:29Z")
Hello everyone, I have beats index template in my cluster. Auto index creation (\*) is enabled for all templates in this cluster. And I decided to setup new cluster for beats data. But I need to prevent access to old clu… --- ## [Which is the best suggested to be used either Java API client or Java High Level Rest Client](https://discuss.elastic.co/t/which-is-the-best-suggested-to-be-used-either-java-api-client-or-java-high-level-rest-client/352355)
**Author:** [@prasad.ram1431](https://discuss.elastic.co/u/prasad.ram1431)\ **Replies:** 4\ **Last updated:** [February 2, 2024, 4:57pm UTC](https://discuss.elastic.co/t/which-is-the-best-suggested-to-be-used-either-java-api-client-or-java-high-level-rest-client/352355 "2024-02-02T16:57:31Z")
Hi Team, Can you please help in identifying the best one to use among Java API Client and Java High Level Rest Client (as I can see HLRC is deprecated). Also, just wanted to know whether HLRC is permanently deprecated … --- ## [Painless scripted field with nested IF statment](https://discuss.elastic.co/t/painless-scripted-field-with-nested-if-statment/352091)
**Author:** [@auato](https://discuss.elastic.co/u/auato)\ **Replies:** 0\ **Last updated:** [January 30, 2024, 1:20pm UTC](https://discuss.elastic.co/t/painless-scripted-field-with-nested-if-statment/352091 "2024-01-30T13:20:11Z")
I have these two working scripted fields: def M3 = doc\['obj'\].value.splitOnToken('\_'); return M3.length \>= 4 ? M3\[3\] : null; def M2 = doc\['obj'\].value.splitOnToken('\_'); return M2.length \>= 4 ? M2\[2\] : null; that I wo… --- ## [S3 Repository](https://discuss.elastic.co/t/s3-repository/352282)
**Author:** [@Haytham\_Shammout](https://discuss.elastic.co/u/Haytham_Shammout)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 4:43pm UTC](https://discuss.elastic.co/t/s3-repository/352282 "2024-02-02T16:43:34Z")
Hello Dears, We are new to S3 repository and taking snapshots in ELK, we faced a case as below appreciate your support on it. First of all we implement policy to take snapshots as below SC. after taking 2 snapshots… --- ## [Taking average of a numeric field and customise it](https://discuss.elastic.co/t/taking-average-of-a-numeric-field-and-customise-it/352179)
**Author:** [@sharmavipul92](https://discuss.elastic.co/u/sharmavipul92)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 4:36pm UTC](https://discuss.elastic.co/t/taking-average-of-a-numeric-field-and-customise-it/352179 "2024-02-02T16:36:50Z")
Hi I have a duration field of type number having duration in milliseconds. I want to take the average of it, and show it in kibana dashboard metrics as dd:hh:mm:ss format, or basically run a script over the average valu… --- ## [Different outputs when using kibana inspect and dashboard?](https://discuss.elastic.co/t/different-outputs-when-using-kibana-inspect-and-dashboard/351719)
**Author:** [@moomoo21](https://discuss.elastic.co/u/moomoo21)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 4:36pm UTC](https://discuss.elastic.co/t/different-outputs-when-using-kibana-inspect-and-dashboard/351719 "2024-02-02T16:36:35Z")
Hello, I am having some trouble with Elasticsearch and kibana, I am able to use the inspect element to get the raw request command of my desired query in Elasticsearch: { "version": true, "size": 500, "sort": \[ … --- ## [Disable ES|QL in kibana.yml for multiple spaces](https://discuss.elastic.co/t/disable-es-ql-in-kibana-yml-for-multiple-spaces/352281)
**Author:** [@toki0709](https://discuss.elastic.co/u/toki0709)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 4:33pm UTC](https://discuss.elastic.co/t/disable-es-ql-in-kibana-yml-for-multiple-spaces/352281 "2024-02-02T16:33:01Z")
Hi, for multiple spcaes I would to like to disable ES|QL feature. I could disable from advance settings but would like to do it from kibana.yml. Could any one give me an hint how to do so? Thanks in advance … --- ## [Table visualization in a custom plugin](https://discuss.elastic.co/t/table-visualization-in-a-custom-plugin/352139)
**Author:** [@JSFern83](https://discuss.elastic.co/u/JSFern83)\ **Replies:** 3\ **Last updated:** [February 2, 2024, 4:20pm UTC](https://discuss.elastic.co/t/table-visualization-in-a-custom-plugin/352139 "2024-02-02T16:20:55Z")
Hi All, I am trying to bring the following dashboard into the custom plugin that I am working on. This dashboard is for displaying a set of posts in table format. Below is the saved\_object structure for this particu… --- ## [Bug report regarding time zone in Kibana](https://discuss.elastic.co/t/bug-report-regarding-time-zone-in-kibana/352366)
**Author:** [@VijayIQA](https://discuss.elastic.co/u/VijayIQA)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 4:20pm UTC](https://discuss.elastic.co/t/bug-report-regarding-time-zone-in-kibana/352366 "2024-02-02T16:20:27Z")
Hi Team, Deployed Kibana 8.12.0 and Elasticsearch 8.12.0 as Docker container. for that used custom docker file to install tzdata here is the Docker file USER root RUN apt-get update && apt-get install -y tzdata --no-in… --- ## [Filebeat and Okta System Logs HA scenario](https://discuss.elastic.co/t/filebeat-and-okta-system-logs-ha-scenario/352012)
**Author:** [@g.vecchi](https://discuss.elastic.co/u/g.vecchi)\ **Replies:** 2\ **Last updated:** [February 2, 2024, 4:16pm UTC](https://discuss.elastic.co/t/filebeat-and-okta-system-logs-ha-scenario/352012 "2024-02-02T16:16:06Z")
Hi guys, I need to send Okta System Logs to our Elastic Cloud tenant and I'm looking for a scenario that satisfies active-active or active-passive high availability configuration. In case of the active-active one, 2 co… --- ## [Cannot run curator from cron in docker container as the elasticsearch user](https://discuss.elastic.co/t/cannot-run-curator-from-cron-in-docker-container-as-the-elasticsearch-user/352039)
**Author:** [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Replies:** 10\ **Last updated:** [February 2, 2024, 4:08pm UTC](https://discuss.elastic.co/t/cannot-run-curator-from-cron-in-docker-container-as-the-elasticsearch-user/352039 "2024-02-02T16:08:46Z")
In my 8.8.2 Elasticsearch container, I have this cron job in the cron table: \* 1 \* \* \* su elasticsearch /bin/bash -c "export ES\_CURATOR\_USERNAME=curator ES\_CURATOR\_PASSWORD=xxxxx; /usr/local/bin/curator --config /config… --- ## [How to apply same filter on different pages freely in Kibana Canvas in the same index?](https://discuss.elastic.co/t/how-to-apply-same-filter-on-different-pages-freely-in-kibana-canvas-in-the-same-index/351624)
**Author:** [@kpj2024](https://discuss.elastic.co/u/kpj2024)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 4:03pm UTC](https://discuss.elastic.co/t/how-to-apply-same-filter-on-different-pages-freely-in-kibana-canvas-in-the-same-index/351624 "2024-02-02T16:03:26Z")
Hi everyone, I need some help here, please. In Kibana canvas, version 8.3.3, I have 2 pages on the workpad and I use the same document index for both. On the first page I have a filter dropdown control and a table, ju… --- ## [Data inconsistencty shown in ELK](https://discuss.elastic.co/t/data-inconsistencty-shown-in-elk/350963)
**Author:** [@Ravi\_Pattar](https://discuss.elastic.co/u/Ravi_Pattar)\ **Replies:** 4\ **Last updated:** [February 2, 2024, 3:50pm UTC](https://discuss.elastic.co/t/data-inconsistencty-shown-in-elk/350963 "2024-02-02T15:50:22Z")
Hello, I am running with ELK version 7.17.15. # curl -X GET "localhost:9200" { "name" : "ip", "cluster\_name" : "name", "cluster\_uuid" : "uudi", "version" : { "number" : "7.17.15", "build\_flavor" : "defa… --- ## [Limit in index document filter using Roles](https://discuss.elastic.co/t/limit-in-index-document-filter-using-roles/351794)
**Author:** [@stobbe](https://discuss.elastic.co/u/stobbe)\ **Replies:** 0\ **Last updated:** [January 25, 2024, 11:40am UTC](https://discuss.elastic.co/t/limit-in-index-document-filter-using-roles/351794 "2024-01-25T11:40:49Z")
In a role I added a document filter on an index like below:: { "bool": { "filter": \[ { "terms": { "data\_stream.dataset": \["1","2","3","4","5","6","7","8","9","0"\] } … --- ## [Temporarily change the display time zone for searches in kibana](https://discuss.elastic.co/t/temporarily-change-the-display-time-zone-for-searches-in-kibana/352337)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 3:40pm UTC](https://discuss.elastic.co/t/temporarily-change-the-display-time-zone-for-searches-in-kibana/352337 "2024-02-02T15:40:06Z")
We have kibana setup to display timestamp in local time (+1200/1300). Occasionally we need to send search result to external parties on other time zone. When doing this I like to have the timestamps in UTC -- everyone … --- ## [Logstash stats API is showing wrong events values](https://discuss.elastic.co/t/logstash-stats-api-is-showing-wrong-events-values/352419)
**Author:** [@Freddy\_Laffita\_Almag](https://discuss.elastic.co/u/Freddy_Laffita_Almag)\ **Replies:** 0\ **Last updated:** [February 2, 2024, 3:17pm UTC](https://discuss.elastic.co/t/logstash-stats-api-is-showing-wrong-events-values/352419 "2024-02-02T15:17:53Z")
Hello everyone: I'm using logstash from a docker image, I'm consulting the stats API to show the logs processed by a pipeline to the user, but when I send 200 logs every 0.01 seconds the event information is showing wro… --- ## [What is the best procedure to delete indices?](https://discuss.elastic.co/t/what-is-the-best-procedure-to-delete-indices/351778)
**Author:** [@7a6b6f](https://discuss.elastic.co/u/7a6b6f)\ **Replies:** 2\ **Last updated:** [February 2, 2024, 3:17pm UTC](https://discuss.elastic.co/t/what-is-the-best-procedure-to-delete-indices/351778 "2024-02-02T15:17:38Z")
Hello everyone, I have a question regarding the deletion of indices in an ELK (Elasticsearch, Logstash, Kibana) Docker-compose stack. Specifically, I would like to know the recommended procedure for deleting indices, an… --- ## [ConnectionError: socket hang up](https://discuss.elastic.co/t/connectionerror-socket-hang-up/351009)
**Author:** [@y34rz3r0](https://discuss.elastic.co/u/y34rz3r0)\ **Replies:** 4\ **Last updated:** [February 2, 2024, 2:37pm UTC](https://discuss.elastic.co/t/connectionerror-socket-hang-up/351009 "2024-02-02T14:37:29Z")
I successfully run this docker compose locally on macOS and can work with ELK, but when running the same compose I encounter the following errors: \[2024-01-13T14:26:44.001+00:00\]\[ERROR\]\[plugins.security.authorization\]… --- ## [Query on ELK stack version 8.12: post installation](https://discuss.elastic.co/t/query-on-elk-stack-version-8-12-post-installation/352304)
**Author:** [@Ravi\_Pattar](https://discuss.elastic.co/u/Ravi_Pattar)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 1:44pm UTC](https://discuss.elastic.co/t/query-on-elk-stack-version-8-12-post-installation/352304 "2024-02-02T13:44:00Z")
Hello, I have installed ELK stack version 8.12 on one of the test instance. The purpose was to assign the existing ILM policy set for ver 7.17, as I could see new indices are being built with filebeat version 8.x on a p… --- ## [Logstash netflow codec says "no template has been received" but it did receive one](https://discuss.elastic.co/t/logstash-netflow-codec-says-no-template-has-been-received-but-it-did-receive-one/352397)
**Author:** [@m0nkeyc0de](https://discuss.elastic.co/u/m0nkeyc0de)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 1:30pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-says-no-template-has-been-received-but-it-did-receive-one/352397 "2024-02-02T13:30:06Z")
Hello, the Logstash codec logstash-codec-netflow says it can't decode a flowset because no template has been received. When looking in the packet capture, a template has been sent. \[2024-02-02T13:10:19,136\]\[WARN \]\[logst… --- ## [Kibana oidc (azure) role assignment not working (too many groups)](https://discuss.elastic.co/t/kibana-oidc-azure-role-assignment-not-working-too-many-groups/350568)
**Author:** [@rafi0101](https://discuss.elastic.co/u/rafi0101)\ **Replies:** 2\ **Last updated:** [February 2, 2024, 12:15pm UTC](https://discuss.elastic.co/t/kibana-oidc-azure-role-assignment-not-working-too-many-groups/350568 "2024-02-02T12:15:11Z")
I am using Kibana/Elasticsearch with Oidc (Microsoft Azure) for authentication. Currently I have the problem that not all defined role mappings are working correctly. We are using Azure groups in role mappings to assig… --- ## [BulkInsert fails with knn\_vector data type](https://discuss.elastic.co/t/bulkinsert-fails-with-knn-vector-data-type/352390)
**Author:** [@CodeNinja](https://discuss.elastic.co/u/CodeNinja)\ **Replies:** 0\ **Last updated:** [February 2, 2024, 11:58am UTC](https://discuss.elastic.co/t/bulkinsert-fails-with-knn-vector-data-type/352390 "2024-02-02T11:58:44Z")
Hello All, I am using BulkInsert (Java client) to ingest with an Index that has knn\_vector Data Type. Currently, I am able to ingest when I create document with a POJO Class object for every row that insert into Index. … --- ## [How we can drop transport event type in Elasticsearch 8.12 version](https://discuss.elastic.co/t/how-we-can-drop-transport-event-type-in-elasticsearch-8-12-version/352358)
**Author:** [@ashishshukla](https://discuss.elastic.co/u/ashishshukla)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 5:43am UTC](https://discuss.elastic.co/t/how-we-can-drop-transport-event-type-in-elasticsearch-8-12-version/352358 "2024-02-02T05:43:40Z")
Hi Team, I am getting system generated log in Elasticsearch Audit logs file. can you please provide me solution to avoid the system generated logs in audit log. I did below configuration in elasticsearch.yml file Mi… --- ## [AWS S3 buclet with SQS failed processing SQS S3 event notification](https://discuss.elastic.co/t/aws-s3-buclet-with-sqs-failed-processing-sqs-s3-event-notification/350664)
**Author:** [@Merdesz](https://discuss.elastic.co/u/Merdesz)\ **Replies:** 2\ **Last updated:** [February 2, 2024, 9:01am UTC](https://discuss.elastic.co/t/aws-s3-buclet-with-sqs-failed-processing-sqs-s3-event-notification/350664 "2024-02-02T09:01:54Z")
Hi! Trying to set up the AWS Cloudtrail integration with elastic-agent/fleet. The integration is able to pull the SQS messages, but then it says "Failed processing SQS message. AWS Permissions: And it doesn't … --- ## [Unable to create component template updating component template results in invalid composable template after templates are merged](https://discuss.elastic.co/t/unable-to-create-component-template-updating-component-template-results-in-invalid-composable-template-after-templates-are-merged/352271)
**Author:** [@florinsfetea](https://discuss.elastic.co/u/florinsfetea)\ **Replies:** 2\ **Last updated:** [February 2, 2024, 8:32am UTC](https://discuss.elastic.co/t/unable-to-create-component-template-updating-component-template-results-in-invalid-composable-template-after-templates-are-merged/352271 "2024-02-02T08:32:58Z")
On 8.12.0 I am hitting this again \` Unable to create component template updating component template \[metrics-mysql.performance@custom\] results in invalid composable template \[metrics-mysql.performance\] after templates… --- ## [Getting Error in Elasticsearch 8.12 version](https://discuss.elastic.co/t/getting-error-in-elasticsearch-8-12-version/352371)
**Author:** [@ashishshukla](https://discuss.elastic.co/u/ashishshukla)\ **Replies:** 1\ **Last updated:** [February 2, 2024, 8:07am UTC](https://discuss.elastic.co/t/getting-error-in-elasticsearch-8-12-version/352371 "2024-02-02T08:07:34Z")
I am getting error while starting the Elasticsearch please provide the solution for this. Error java.lang.IllegalArgumentException: unknown setting \[xpack.security.audit.logfile.events.ignore\_filters.users\] please chec… --- ## [Add custom fields to metadata with elastic agent jar](https://discuss.elastic.co/t/add-custom-fields-to-metadata-with-elastic-agent-jar/352370)
**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\ **Replies:** 0\ **Last updated:** [February 2, 2024, 7:52am UTC](https://discuss.elastic.co/t/add-custom-fields-to-metadata-with-elastic-agent-jar/352370 "2024-02-02T07:52:13Z")
Hi, I need to add custom fields in metadata of the transactions captured by the java agent jar . Is there any way I can achieve this? I read about global\_labels inclusion in elastic agent properties file, But i need to… --- ## [No search result (by field exluded from source) after update](https://discuss.elastic.co/t/no-search-result-by-field-exluded-from-source-after-update/352368)
**Author:** [@Sergey1983](https://discuss.elastic.co/u/Sergey1983)\ **Replies:** 0\ **Last updated:** [February 2, 2024, 7:43am UTC](https://discuss.elastic.co/t/no-search-result-by-field-exluded-from-source-after-update/352368 "2024-02-02T07:43:56Z")
Hi everyone! I have some specific problem with search. There are a lot of product with name, prices (divided by warehouses), amount (divided by warehouses) and personal prices (divided by agreement). Because of huge amou… --- ## [Kibana.yml file with server.host having integer host name issue](https://discuss.elastic.co/t/kibana-yml-file-with-server-host-having-integer-host-name-issue/351946)
**Author:** [@vikas.shirke](https://discuss.elastic.co/u/vikas.shirke)\ **Replies:** 2\ **Last updated:** [February 2, 2024, 4:24am UTC](https://discuss.elastic.co/t/kibana-yml-file-with-server-host-having-integer-host-name-issue/351946 "2024-02-02T04:24:31Z")
I am getting Fatal Error with invalid host name for Kibana service because of server has host name starting with integer. Any idea why Kibana service doesnt like host name starting with integer because as per RFC 1123, … [Previous page](https://discuss.elastic.co/latest.md?page=411) [Next page](https://discuss.elastic.co/latest.md?page=413)