# Latest **URL:** https://discuss.elastic.co/latest.md?page=423 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 424 --- ## [Create independent indices](https://discuss.elastic.co/t/create-independent-indices/351603)
**Author:** [@marotaal](https://discuss.elastic.co/u/marotaal)\ **Replies:** 3\ **Last updated:** [January 23, 2024, 2:00pm UTC](https://discuss.elastic.co/t/create-independent-indices/351603 "2024-01-23T14:00:40Z")
Hello, I am setting up a lab for log collection (Apache, Sophos, ...) I want to create different indices for each device (Apache, Sophos, Windows, Linux, ...) Is it possible to create independent indices? How can thi… --- ## [Setting parameters from \[Canvas\] into \[Reporting\]](https://discuss.elastic.co/t/setting-parameters-from-canvas-into-reporting/351630)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 0\ **Last updated:** [January 23, 2024, 1:30pm UTC](https://discuss.elastic.co/t/setting-parameters-from-canvas-into-reporting/351630 "2024-01-23T13:30:32Z")
I would like to have a button in the canvas that could trigger a reporting job of all the data in the index within the selected range in the timefilter. Where could I start to achieve such thing? I've been looking into … --- ## [Size parameter ignored in nested knn search](https://discuss.elastic.co/t/size-parameter-ignored-in-nested-knn-search/350285)
**Author:** [@Jasper\_Simon](https://discuss.elastic.co/u/Jasper_Simon)\ **Replies:** 2\ **Last updated:** [January 23, 2024, 12:34pm UTC](https://discuss.elastic.co/t/size-parameter-ignored-in-nested-knn-search/350285 "2024-01-23T12:34:34Z")
I noticed the quote below in the documentation, about the limitation to retrieve only the best match vector regardless of the "size" parameter in the inner\_hits section of the search request. inner\_hits for kNN will on… --- ## [Data nodes not ingesting new documents for over 10 min](https://discuss.elastic.co/t/data-nodes-not-ingesting-new-documents-for-over-10-min/351462)
**Author:** [@luana](https://discuss.elastic.co/u/luana)\ **Replies:** 4\ **Last updated:** [January 23, 2024, 12:10pm UTC](https://discuss.elastic.co/t/data-nodes-not-ingesting-new-documents-for-over-10-min/351462 "2024-01-23T12:10:00Z")
Hi, I've got about 10 data nodes (this value fluctuates throughout the day) that are triggering my "no new documents" alert, that'll trigger if a node doesn't ingest documents for over 10 minutes. When checking the logs… --- ## [I am trying to Use Webhook connector from ELK- Need Help](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901)
**Author:** [@MOHAMMED\_ASIF\_Z](https://discuss.elastic.co/u/MOHAMMED_ASIF_Z)\ **Replies:** 6\ **Last updated:** [January 23, 2024, 11:45am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901 "2024-01-23T11:45:14Z")
I am capturing IBM Tivoli Schedular logs using Elastic stach - so my idea is to retrigger a failed job based on the reasoning, so using query on the specify field i could get only the failure , but i want to try reach ou… --- ## [Indices con diferentes nombres](https://discuss.elastic.co/t/indices-con-diferentes-nombres/351554)
**Author:** [@marotaal](https://discuss.elastic.co/u/marotaal)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 11:34am UTC](https://discuss.elastic.co/t/indices-con-diferentes-nombres/351554 "2024-01-23T11:34:27Z")
Hola Estoy generando un laboratorio para la recogida de logs (Apache, Sophos,.....) Es posible poner logs en diferentes indices? Como se puede hacer? Solo consigo hacer que el filebeat funcione si el índice es el por… --- ## [Retrieving or saving matching document ID when using percolate](https://discuss.elastic.co/t/retrieving-or-saving-matching-document-id-when-using-percolate/351555)
**Author:** [@Krikkits](https://discuss.elastic.co/u/Krikkits)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 10:32am UTC](https://discuss.elastic.co/t/retrieving-or-saving-matching-document-id-when-using-percolate/351555 "2024-01-23T10:32:59Z")
I am unfamiliar with percolate and honestly a bit confused. My idea is to use percolate on an existing index and not only getting how many match the query, but also which exact ones. The field "\_percolator\_document\_slot"… --- ## [How to user docker secrets with metricbeat](https://discuss.elastic.co/t/how-to-user-docker-secrets-with-metricbeat/349662)
**Author:** [@denisk](https://discuss.elastic.co/u/denisk)\ **Replies:** 3\ **Last updated:** [January 23, 2024, 10:22am UTC](https://discuss.elastic.co/t/how-to-user-docker-secrets-with-metricbeat/349662 "2024-01-23T10:22:05Z")
I would like to use docker secrets \[1\] to provide credentials for metricbeat to use when running the monitoring modules. Is that possible? I am using the docker image of Metricbeat 8.11.3 from Docker hub. I know metricb… --- ## ["master\_not\_discovered\_exception"](https://discuss.elastic.co/t/master-not-discovered-exception/351548)
**Author:** [@Chulter](https://discuss.elastic.co/u/Chulter)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 10:20am UTC](https://discuss.elastic.co/t/master-not-discovered-exception/351548 "2024-01-23T10:20:35Z")
Hello everyone, My english is not well so i use google trad. have encountered this error from the start knowing that I work on a Debian 11.5 VM with suricata installed as well as elasticsearch, kibana, filebeat so I on… --- ## [Not able to view log afer creating the indices in 8.11](https://discuss.elastic.co/t/not-able-to-view-log-afer-creating-the-indices-in-8-11/351523)
**Author:** [@Neha\_Tiwari](https://discuss.elastic.co/u/Neha_Tiwari)\ **Replies:** 2\ **Last updated:** [January 23, 2024, 10:09am UTC](https://discuss.elastic.co/t/not-able-to-view-log-afer-creating-the-indices-in-8-11/351523 "2024-01-23T10:09:11Z")
i have installed 8.11 and after that i have created indices and i am not able view the log --- ## [\[Lens\] Sum aggregation with missing values](https://discuss.elastic.co/t/lens-sum-aggregation-with-missing-values/351056)
**Author:** [@lizozom](https://discuss.elastic.co/u/lizozom)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 9:50am UTC](https://discuss.elastic.co/t/lens-sum-aggregation-with-missing-values/351056 "2024-01-23T09:50:26Z")
I have a lens visualization on top of this data set: I want to show the total item quantity per date. On days where there was no data, I want to show the last value. However, when I choose the sum aggregation and se… --- ## [Kibana7.17](https://discuss.elastic.co/t/kibana7-17/351484)
**Author:** [@Youssef\_Shehadeh](https://discuss.elastic.co/u/Youssef_Shehadeh)\ **Replies:** 5\ **Last updated:** [January 23, 2024, 9:33am UTC](https://discuss.elastic.co/t/kibana7-17/351484 "2024-01-23T09:33:17Z")
Hello, I'm working on a uni project where I need to use the curator tool. However, it is not compatible with ES8.11, so I configured a three-node cluster (data\_frozen, data\_hot, data\_cold). The cluster health is green, a… --- ## [Failed to flush the buffer](https://discuss.elastic.co/t/failed-to-flush-the-buffer/351538)
**Author:** [@Music\_World](https://discuss.elastic.co/u/Music_World)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 9:15am UTC](https://discuss.elastic.co/t/failed-to-flush-the-buffer/351538 "2024-01-23T09:15:24Z")
Hi @all I am using elasticsearch version: 7.16.2 and fluentd version: 1.14.4 on aws eks cluster and it's throwing bufferoverflow error like failed to flush the buffer. retry\_times=0 next\_retry\_time=2024-01-19 07:43:43 … --- ## [Cound not run org.elasticsearch.bootstrap.Elasticsearch(v8.12.0) directly in Intellij Idea](https://discuss.elastic.co/t/cound-not-run-org-elasticsearch-bootstrap-elasticsearch-v8-12-0-directly-in-intellij-idea/351594)
**Author:** [@Henkel](https://discuss.elastic.co/u/Henkel)\ **Replies:** 2\ **Last updated:** [January 23, 2024, 9:10am UTC](https://discuss.elastic.co/t/cound-not-run-org-elasticsearch-bootstrap-elasticsearch-v8-12-0-directly-in-intellij-idea/351594 "2024-01-23T09:10:11Z")
Hi guys: with elasticsearch version 7.16.0, I can run org.elasticsearch.bootstrap.Elasticsearch directly in Intellij Idea.The configuration of Intellij Idea is as follows： However, with elasticsearch version 8.12.0,… --- ## [In a metric visualization change the color mode based on formula](https://discuss.elastic.co/t/in-a-metric-visualization-change-the-color-mode-based-on-formula/350928)
**Author:** [@SpicyS](https://discuss.elastic.co/u/SpicyS)\ **Replies:** 3\ **Last updated:** [January 23, 2024, 8:58am UTC](https://discuss.elastic.co/t/in-a-metric-visualization-change-the-color-mode-based-on-formula/350928 "2024-01-23T08:58:54Z")
Hello, I'm building a dashboard and now I want to make a lens metric with average time per costomer. Now this isn't difficult but in the color mode I want it to change color based on a formula. So when the current aver… --- ## [Are processors applied to the filebeat application logs?](https://discuss.elastic.co/t/are-processors-applied-to-the-filebeat-application-logs/351598)
**Author:** [@Dragan\_Bosnjak](https://discuss.elastic.co/u/Dragan_Bosnjak)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 8:30am UTC](https://discuss.elastic.co/t/are-processors-applied-to-the-filebeat-application-logs/351598 "2024-01-23T08:30:03Z")
I am trying to filter out some filebeat logs with drop\_event processor, but it doesn't seem to work. This is the event: { "log.level":"warn", "@timestamp":"2024-01-01T12:11:22.333Z", "log.logger":"file\_watcher", "log.or… --- ## [\[ERROR\]\[plugins.observability\] Failed to install SLO common resources and summary transforms](https://discuss.elastic.co/t/error-plugins-observability-failed-to-install-slo-common-resources-and-summary-transforms/351587)
**Author:** [@griy](https://discuss.elastic.co/u/griy)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 8:22am UTC](https://discuss.elastic.co/t/error-plugins-observability-failed-to-install-slo-common-resources-and-summary-transforms/351587 "2024-01-23T08:22:03Z")
I found an error when starting Kibana, \[ERROR\] \[plugins. observability\] Failed to install SLO. When I used bin/kibana plugin to install SLO, an address was provided https://artifacts.elastic.co/downloads/kibana-plugins/S… --- ## [I am trying to deduplicate my events one the basis of timestamp and operation field. But it did not work?](https://discuss.elastic.co/t/i-am-trying-to-deduplicate-my-events-one-the-basis-of-timestamp-and-operation-field-but-it-did-not-work/351599)
**Author:** [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Replies:** 0\ **Last updated:** [January 23, 2024, 8:18am UTC](https://discuss.elastic.co/t/i-am-trying-to-deduplicate-my-events-one-the-basis-of-timestamp-and-operation-field-but-it-did-not-work/351599 "2024-01-23T08:18:42Z")
My Log event: { "priority" =\> 13, "host" =\> "172.31.63.35", "consistency" =\> "\\"ONE\\"", "source" =\> "\\"127.0.0.1", "type" =\> "scylladb", "severity" =\> 5… --- ## [Kubernetes deployed Elastic Agent is looped in beat restart](https://discuss.elastic.co/t/kubernetes-deployed-elastic-agent-is-looped-in-beat-restart/350707)
**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\ **Replies:** 4\ **Last updated:** [January 23, 2024, 7:58am UTC](https://discuss.elastic.co/t/kubernetes-deployed-elastic-agent-is-looped-in-beat-restart/350707 "2024-01-23T07:58:07Z")
Hello, I tried to deploy Fleet-managed Elastic Agent with Kubernetes Integration into RedHat OpenShift. When deploying an agent policy update using Fleet, the beats are caught up in a restart loop: Agent version: beats… --- ## [Sub aggregating top\_hits](https://discuss.elastic.co/t/sub-aggregating-top-hits/351163)
**Author:** [@Vivek\_Burman](https://discuss.elastic.co/u/Vivek_Burman)\ **Replies:** 6\ **Last updated:** [January 23, 2024, 7:51am UTC](https://discuss.elastic.co/t/sub-aggregating-top-hits/351163 "2024-01-23T07:51:19Z")
Hi, I've the below Query { "query": { "bool": { "filter": \[ { "term": { "is\_deleted": 0 } }, … --- ## [Unable to Build Kibana Prometheus Exporter Plugin](https://discuss.elastic.co/t/unable-to-build-kibana-prometheus-exporter-plugin/351515)
**Author:** [@Domnic\_Raj\_D](https://discuss.elastic.co/u/Domnic_Raj_D)\ **Replies:** 2\ **Last updated:** [January 23, 2024, 7:12am UTC](https://discuss.elastic.co/t/unable-to-build-kibana-prometheus-exporter-plugin/351515 "2024-01-23T07:12:45Z")
We have consistently encountered errors related to plugin-helper while attempting to build the Kibana Prometheus Exporter plugin. Please advise. @pjhampton --- ## [Kibana upgrade error - \[2023-12-27T14:22:46.832+00:00\]\[ERROR\]\[plugins.observability\] Failed to install SLO common resources and summary transforms](https://discuss.elastic.co/t/kibana-upgrade-error-2023-12-27t1446-832-00-00-error-plugins-observability-failed-to-install-slo-common-resources-and-summary-transforms/350028)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 2\ **Last updated:** [January 1, 2024, 12:40am UTC](https://discuss.elastic.co/t/kibana-upgrade-error-2023-12-27t1446-832-00-00-error-plugins-observability-failed-to-install-slo-common-resources-and-summary-transforms/350028 "2024-01-01T00:40:54Z")
Hi Team, We are trying to upgrade the cluster from 8.9.2 to 8.11.3. The Elasticsearch upgrade is succesfull however when trying to upgrade kibana, we are getting error as below \[2023-12-27T14:22:46.832+00:00\]\[ERROR\]\[pl… --- ## [./elastic-agent: 2: Syntax error: word unexpected (expecting ")")](https://discuss.elastic.co/t/elastic-agent-2-syntax-error-word-unexpected-expecting/351589)
**Author:** [@axiescholar](https://discuss.elastic.co/u/axiescholar)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 4:44am UTC](https://discuss.elastic.co/t/elastic-agent-2-syntax-error-word-unexpected-expecting/351589 "2024-01-23T04:44:31Z")
i am getting this error when i am installing agent on kali linux. ./elastic-agent: 1: ./elastic-agent: 1: ELF: not found O@8: not found ./elastic-agent: 2: Syntax error: word unexpected (expecting ")") i am using a V… --- ## [Single line text data is truncated](https://discuss.elastic.co/t/single-line-text-data-is-truncated/350725)
**Author:** [@kevin1811](https://discuss.elastic.co/u/kevin1811)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 2:59am UTC](https://discuss.elastic.co/t/single-line-text-data-is-truncated/350725 "2024-01-23T02:59:04Z")
When there are multiple line breaks at the end of my file, the last valid complete text message will be truncated based on the number of line breaks at the end of the text txt file {"b":"001T230197002","t":"E0040150ED4… --- ## [Regarding parsing of data in logstash](https://discuss.elastic.co/t/regarding-parsing-of-data-in-logstash/351400)
**Author:** [@Ajay\_Kumar.S](https://discuss.elastic.co/u/Ajay_Kumar.S)\ **Replies:** 2\ **Last updated:** [January 23, 2024, 1:59am UTC](https://discuss.elastic.co/t/regarding-parsing-of-data-in-logstash/351400 "2024-01-23T01:59:48Z")
"message" =\> "{\\"namespace\\":\\"oci\_computeagent\\",\\"resourceGroup\\":null,\\"compartmentId\\":\\"ocid1.compartment.oc1..aaaaaaaacu54zo4clgrmfs3faxqqgfxyu2mjlufgslcem3venf2kon2ktmsq\\",\\"name\\":\\"DiskIopsWritten\\",\\"dimensions… --- ## [Error when enrolloning Fleet on ELK](https://discuss.elastic.co/t/error-when-enrolloning-fleet-on-elk/349983)
**Author:** [@Ellery](https://discuss.elastic.co/u/Ellery)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 1:25am UTC](https://discuss.elastic.co/t/error-when-enrolloning-fleet-on-elk/349983 "2024-01-23T01:25:34Z")
Hello, I hope you can help me. I have the following issue: I have successfully installed Elasticsearch and Kibana. Now I'm installing Fleet, but no matter what I do, I encounter the following error: The instalation it's … --- ## [Fleet serve wrong elastic Address](https://discuss.elastic.co/t/fleet-serve-wrong-elastic-address/350332)
**Author:** [@Lukasz\_Skrzat](https://discuss.elastic.co/u/Lukasz_Skrzat)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 1:11am UTC](https://discuss.elastic.co/t/fleet-serve-wrong-elastic-address/350332 "2024-01-23T01:11:42Z")
HI Installed new ECK instance with fleet server, but i change namespace from Default to logging-stack Changed in fleet configs addresses. Now install new agents to kubernetes integration with fleet token but after … --- ## [When does compression\_level change?](https://discuss.elastic.co/t/when-does-compression-level-change/350659)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 1:04am UTC](https://discuss.elastic.co/t/when-does-compression-level-change/350659 "2024-01-23T01:04:39Z")
We're on Elastic 8.8.1 and about to upgrade to 8.11.3. Since we have alot of issues with Elastic Agents on our Windows-boxes, esp. when endpoint or agent is being reloaded but also with high cpuutilization (mostly due t… --- ## [Vega Query - Find first match](https://discuss.elastic.co/t/vega-query-find-first-match/351583)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 12:39am UTC](https://discuss.elastic.co/t/vega-query-find-first-match/351583 "2024-01-23T00:39:02Z")
Hi, I am building status indicators in vega to find certain events in logs and give me a green light if it found it and red light if the event is not found. What I've come up with so far works, but I noticed in the res… --- ## [Filebeats not sending output to Logstash](https://discuss.elastic.co/t/filebeats-not-sending-output-to-logstash/351154)
**Author:** [@pmuno007](https://discuss.elastic.co/u/pmuno007)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 12:33am UTC](https://discuss.elastic.co/t/filebeats-not-sending-output-to-logstash/351154 "2024-01-23T00:33:26Z")
I suspect filebeats is not sending output to Logstash since Logstash has not created an index in Elastic Search. There are no errors in logs. Filebeat logs also do not indicate nor mention Logstash connection (not sure i… [Previous page](https://discuss.elastic.co/latest.md?page=422) [Next page](https://discuss.elastic.co/latest.md?page=424)