# Latest

**URL:** https://discuss.elastic.co/latest.md?page=705

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 706

---

## [EuiTable and In memory table doesn't have scroll](https://discuss.elastic.co/t/euitable-and-in-memory-table-doesnt-have-scroll/329622)

<div class="topic-metadata">

**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\
**Replies:** 11\
**Last updated:** [April 19, 2023, 9:59pm UTC](https://discuss.elastic.co/t/euitable-and-in-memory-table-doesnt-have-scroll/329622 "2023-04-19T21:59:56Z")

</div>

Hi, I am using both EuiTable and in-memory tables Is there a scroll functionally for the same? I couldn't find any. When the no of columns is like 10-15, the table just keeps getting compressed, rather than having a h…

---

## [Alerting API for v7.10](https://discuss.elastic.co/t/alerting-api-for-v7-10/330294)

<div class="topic-metadata">

**Author:** [@Ewen\_Field](https://discuss.elastic.co/u/Ewen_Field)\
**Replies:** 3\
**Last updated:** [April 19, 2023, 9:56pm UTC](https://discuss.elastic.co/t/alerting-api-for-v7-10/330294 "2023-04-19T21:56:43Z")

</div>

Hey! Is there a way to collect Alert Rules and a history of Alerts via the API from ELK version 7.10 ? In the documentation the Alerting API is available only since the 7.13 version. Is there a way to get this data on t…

---

## [Use data view or direct index](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 7\
**Last updated:** [April 19, 2023, 9:22pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239 "2023-04-19T21:22:00Z")

</div>

I have 1000+ index myindex-\<date\>-00000x ( this is all rollover using ILM) in my REST calll should I use myindex-\* or use latest index by it's name like "myindex-\<date\>-00000x" most everytime I retrive data using @…

---

## [Can we extract the 7 days stored common value from the elastic search database and visulazize that information on kibana](https://discuss.elastic.co/t/can-we-extract-the-7-days-stored-common-value-from-the-elastic-search-database-and-visulazize-that-information-on-kibana/329883)

<div class="topic-metadata">

**Author:** [@Tanzeela](https://discuss.elastic.co/u/Tanzeela)\
**Replies:** 6\
**Last updated:** [April 19, 2023, 9:01pm UTC](https://discuss.elastic.co/t/can-we-extract-the-7-days-stored-common-value-from-the-elastic-search-database-and-visulazize-that-information-on-kibana/329883 "2023-04-19T21:01:19Z")

</div>

Hi @Andrew\_Tate , hope you are doing well. Can we write a query that will extract the common value that is stored in Elasticsearch for 7 days and create the visualisation for the extracted information? for example: da…

---

## [Metricbeat Default Dashboards TSVB and Histogram Display Issues after Upgrade from 7.17 to 8.7](https://discuss.elastic.co/t/metricbeat-default-dashboards-tsvb-and-histogram-display-issues-after-upgrade-from-7-17-to-8-7/329492)

<div class="topic-metadata">

**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Replies:** 3\
**Last updated:** [April 19, 2023, 8:51pm UTC](https://discuss.elastic.co/t/metricbeat-default-dashboards-tsvb-and-histogram-display-issues-after-upgrade-from-7-17-to-8-7/329492 "2023-04-19T20:51:57Z")

</div>

Hello, I recently upgraded my Elastic Stack from version 7.17 to 8.7, and I am experiencing issues with the default Metricbeat dashboards. The TSVB and Histogram visualizations are not displaying data correctly. I have …

---

## [I am facing issue to open kibana url in iframe](https://discuss.elastic.co/t/i-am-facing-issue-to-open-kibana-url-in-iframe/330215)

<div class="topic-metadata">

**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\
**Replies:** 1\
**Last updated:** [April 19, 2023, 8:25pm UTC](https://discuss.elastic.co/t/i-am-facing-issue-to-open-kibana-url-in-iframe/330215 "2023-04-19T20:25:14Z")

</div>

I have kibana setup in https and configuare previously. It is working fine for me. but when other user is login in webapplication they are getting errors. iframe src="https://1.2.111.111:8600/app/dashboards#/view/fe3f…

---

## [How to find difference between aggregate average and individual values](https://discuss.elastic.co/t/how-to-find-difference-between-aggregate-average-and-individual-values/330255)

<div class="topic-metadata">

**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\
**Replies:** 0\
**Last updated:** [April 18, 2023, 10:56pm UTC](https://discuss.elastic.co/t/how-to-find-difference-between-aggregate-average-and-individual-values/330255 "2023-04-18T22:56:26Z")

</div>

I have a field "y" in the Elasticsearch index and I would like to find sum(y-y.avg) using aggregations for each person in my index. I am able to calculate y.avg for a person using the below query but need help in calcula…

---

## [Can't see Kibana logs](https://discuss.elastic.co/t/cant-see-kibana-logs/330246)

<div class="topic-metadata">

**Author:** [@ishan.abhinit](https://discuss.elastic.co/u/ishan.abhinit)\
**Replies:** 7\
**Last updated:** [April 19, 2023, 7:15pm UTC](https://discuss.elastic.co/t/cant-see-kibana-logs/330246 "2023-04-19T19:15:40Z")

</div>

I had set up Elasticsearch and Kibana on Rocky Linux few months ago for a workshop. Everything worked fine then. I shut down the server after the workshop and restarted it last week. I don't see the logs appearing in Ki…

---

## [Keyword search not behaving as expected](https://discuss.elastic.co/t/keyword-search-not-behaving-as-expected/330328)

<div class="topic-metadata">

**Author:** [@developer3124](https://discuss.elastic.co/u/developer3124)\
**Replies:** 4\
**Last updated:** [April 19, 2023, 7:06pm UTC](https://discuss.elastic.co/t/keyword-search-not-behaving-as-expected/330328 "2023-04-19T19:06:52Z")

</div>

Hello, I'm having an issue with keyword search not behaving how I would expect from the docs. I can see that the following document exists in my index: { "\_index": "my-index", "\_type": "\_doc", "\_id": …

---

## [Sharepoint online connector content source - 403 after few days of connecting and validating](https://discuss.elastic.co/t/sharepoint-online-connector-content-source-403-after-few-days-of-connecting-and-validating/328287)

<div class="topic-metadata">

**Author:** [@amolpathak224](https://discuss.elastic.co/u/amolpathak224)\
**Replies:** 5\
**Last updated:** [April 19, 2023, 6:40pm UTC](https://discuss.elastic.co/t/sharepoint-online-connector-content-source-403-after-few-days-of-connecting-and-validating/328287 "2023-04-19T18:40:10Z")

</div>

I am using Elasticsearch 8.6 and have used Sharepoint enterprise source to connect our organization sharepoint online instance. I was able to successfully connect and sync the contents of the desired sites using the Azu…

---

## [Logstash, parsing a localised date with HTTPDATE](https://discuss.elastic.co/t/logstash-parsing-a-localised-date-with-httpdate/330297)

<div class="topic-metadata">

**Author:** [@GreenEyed](https://discuss.elastic.co/u/GreenEyed)\
**Replies:** 3\
**Last updated:** [April 19, 2023, 6:15pm UTC](https://discuss.elastic.co/t/logstash-parsing-a-localised-date-with-httpdate/330297 "2023-04-19T18:15:06Z")

</div>

Hi there, We have a library that is sending access logs to logstash with a "similar" to Apache format. We have created the regexp in grok to parse it but I have detected that the library is using the default format, loc…

---

## [How to split data into spaces](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229)

<div class="topic-metadata">

**Author:** [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)\
**Replies:** 9\
**Last updated:** [April 19, 2023, 5:15pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229 "2023-04-19T17:15:50Z")

</div>

Hello, let's imagine that I have a cluster with 5 nodes and each node is a client, I want these 5 to divide the data from these clients into spaces, I would also like to install packebeat and filebeat on each node and se…

---

## [ELK 7.6.2 Licensing](https://discuss.elastic.co/t/elk-7-6-2-licensing/330324)

<div class="topic-metadata">

**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Replies:** 1\
**Last updated:** [April 19, 2023, 5:07pm UTC](https://discuss.elastic.co/t/elk-7-6-2-licensing/330324 "2023-04-19T17:07:36Z")

</div>

Hello, We are using a very old version of ELK cluster 7.6.2 (with Basic license) in our environment. We plan to upgrade to the latest 8.6 version in future. With the 7.6.2 version in place we want to look into the pos…

---

## [Central Elastic Stack setup for a company with 10+ applications using Elasticsearch](https://discuss.elastic.co/t/central-elastic-stack-setup-for-a-company-with-10-applications-using-elasticsearch/329800)

<div class="topic-metadata">

**Author:** [@murat3](https://discuss.elastic.co/u/murat3)\
**Replies:** 7\
**Last updated:** [April 19, 2023, 5:03pm UTC](https://discuss.elastic.co/t/central-elastic-stack-setup-for-a-company-with-10-applications-using-elasticsearch/329800 "2023-04-19T17:03:57Z")

</div>

Hello all, I am trying to understand the setup of a (central) Elastic Stack cluster used by 10+ projects and 20+ applications. Our applications consist of frontend web and Java backend applications. One Cluster Is one…

---

## [Start Elasticsearch with preloaded index](https://discuss.elastic.co/t/start-elasticsearch-with-preloaded-index/330299)

<div class="topic-metadata">

**Author:** [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\
**Replies:** 1\
**Last updated:** [April 19, 2023, 4:54pm UTC](https://discuss.elastic.co/t/start-elasticsearch-with-preloaded-index/330299 "2023-04-19T16:54:53Z")

</div>

Is there any way we can start the elasticsearch instance with a preloaded index data? Just like we do in postgres: Creating a Docker image with a preloaded database | Coding with Coffee

---

## [How to monitor core usage metrics on Oracle 19c when multiple SIDs on a host](https://discuss.elastic.co/t/how-to-monitor-core-usage-metrics-on-oracle-19c-when-multiple-sids-on-a-host/328957)

<div class="topic-metadata">

**Author:** [@James\_Whittington](https://discuss.elastic.co/u/James_Whittington)\
**Replies:** 1\
**Last updated:** [April 19, 2023, 4:41pm UTC](https://discuss.elastic.co/t/how-to-monitor-core-usage-metrics-on-oracle-19c-when-multiple-sids-on-a-host/328957 "2023-04-19T16:41:14Z")

</div>

I have a delima on how to approach monitoring some key usage based metrics on a Oracle Database server where multiple SIDs reside. We use elastic cloud, version at 8.6, currently just using fleet managed elastic agents. …

---

## [Filebaet and logstash encoding problem](https://discuss.elastic.co/t/filebaet-and-logstash-encoding-problem/330223)

<div class="topic-metadata">

**Author:** [@maks1001281](https://discuss.elastic.co/u/maks1001281)\
**Replies:** 15\
**Last updated:** [April 19, 2023, 3:00pm UTC](https://discuss.elastic.co/t/filebaet-and-logstash-encoding-problem/330223 "2023-04-19T15:00:01Z")

</div>

Hello, I can't understand why Logstash doesn't analyze logs from filebeat correctly, I see strange errors like: JSON parsing error, source data now in message field {:message=\>"Unexpected character ('\*' (code 42)): expe…

---

## [Project synthetics service.name](https://discuss.elastic.co/t/project-synthetics-service-name/330282)

<div class="topic-metadata">

**Author:** [@jasonwhetton](https://discuss.elastic.co/u/jasonwhetton)\
**Replies:** 1\
**Last updated:** [April 19, 2023, 2:43pm UTC](https://discuss.elastic.co/t/project-synthetics-service-name/330282 "2023-04-19T14:43:55Z")

</div>

Hi, It it possible right now to provide the related APM service name for project based synthetics? // Jason

---

## [Curl: (7) Failed to connect to 10.x.x.x port 5601: Connection refused](https://discuss.elastic.co/t/curl-7-failed-to-connect-to-10-x-x-x-port-5601-connection-refused/330138)

<div class="topic-metadata">

**Author:** [@ram\_222](https://discuss.elastic.co/u/ram_222)\
**Replies:** 11\
**Last updated:** [April 19, 2023, 2:43pm UTC](https://discuss.elastic.co/t/curl-7-failed-to-connect-to-10-x-x-x-port-5601-connection-refused/330138 "2023-04-19T14:43:35Z")

</div>

Here, I provide the Procedure what I follow to setup a Elastic Search and Kibana on GCP Vm's: Created a 2 Vm's of Es and Kibana with Reserved Internal and External Ip's. Successfully Deployed Es and Kibana Debian packa…

---

## [Shards failures - illegal\_argument\_exception](https://discuss.elastic.co/t/shards-failures-illegal-argument-exception/330311)

<div class="topic-metadata">

**Author:** [@dpecak](https://discuss.elastic.co/u/dpecak)\
**Replies:** 0\
**Last updated:** [April 19, 2023, 2:03pm UTC](https://discuss.elastic.co/t/shards-failures-illegal-argument-exception/330311 "2023-04-19T14:03:17Z")

</div>

I have fresh installation of ELK stack with Filebeat and Metricbeat. When I try to open predefined dashboard (for example "\[Filebeat System\] SSH login attempts ECS"), I see many shard failures: Fielddata is disabled on …

---

## [Enterprise App Search UI Configuration](https://discuss.elastic.co/t/enterprise-app-search-ui-configuration/329384)

<div class="topic-metadata">

**Author:** [@aisyaharifin](https://discuss.elastic.co/u/aisyaharifin)\
**Replies:** 10\
**Last updated:** [April 19, 2023, 1:30pm UTC](https://discuss.elastic.co/t/enterprise-app-search-ui-configuration/329384 "2023-04-19T13:30:25Z")

</div>

Hello, I want to ask, how do I configure my Search UI in tabular format? Thank you.

---

## [Handler for externaltraffic definition not working](https://discuss.elastic.co/t/handler-for-externaltraffic-definition-not-working/330308)

<div class="topic-metadata">

**Author:** [@ccaillet](https://discuss.elastic.co/u/ccaillet)\
**Replies:** 0\
**Last updated:** [April 19, 2023, 1:21pm UTC](https://discuss.elastic.co/t/handler-for-externaltraffic-definition-not-working/330308 "2023-04-19T13:21:55Z")

</div>

Hi all, WIth ECK 2.7.0, I've created a cluster and specifying the type LoadBalancer on http service Spec for elasticsearch object, but the externalTrafficPolicy directive is not handled correctly here is the sample of …

---

## [Retrieval of data on the dashboard is done after hours](https://discuss.elastic.co/t/retrieval-of-data-on-the-dashboard-is-done-after-hours/330237)

<div class="topic-metadata">

**Author:** [@FTOR](https://discuss.elastic.co/u/FTOR)\
**Replies:** 5\
**Last updated:** [April 19, 2023, 12:28pm UTC](https://discuss.elastic.co/t/retrieval-of-data-on-the-dashboard-is-done-after-hours/330237 "2023-04-19T12:28:15Z")

</div>

I have a problem with the data recovery on the dashboard. It gets hours to get the data from Elasticsearch to the Dashboard. I get the right datas on the devTools, but I can not have a real time data on the dashboard. Do…

---

## [Hiding results in Data Table visualisation based on the count](https://discuss.elastic.co/t/hiding-results-in-data-table-visualisation-based-on-the-count/330303)

<div class="topic-metadata">

**Author:** [@Jakub\_J](https://discuss.elastic.co/u/Jakub_J)\
**Replies:** 0\
**Last updated:** [April 19, 2023, 12:17pm UTC](https://discuss.elastic.co/t/hiding-results-in-data-table-visualisation-based-on-the-count/330303 "2023-04-19T12:17:15Z")

</div>

Hello hive mind, After some time I reached a dead end, thus i'd like to ask you assistance from the gurus. here's what I try to achieve. I have an index pattern which includes (amongst others) ProductionID (String). I…

---

## [Help me in Vega Sorting using transform lookup joined field on encoding Y-axis](https://discuss.elastic.co/t/help-me-in-vega-sorting-using-transform-lookup-joined-field-on-encoding-y-axis/330298)

<div class="topic-metadata">

**Author:** [@Nabeel\_Ahmed\_NAK](https://discuss.elastic.co/u/Nabeel_Ahmed_NAK)\
**Replies:** 0\
**Last updated:** [April 19, 2023, 11:35am UTC](https://discuss.elastic.co/t/help-me-in-vega-sorting-using-transform-lookup-joined-field-on-encoding-y-axis/330298 "2023-04-19T11:35:23Z")

</div>

Hi I need help in dynamic sort of "asc" and "desc" based upon 3 fields which I need to select one by one from select option front. Currently I'm sorting on the basis of any particular field hardcoded given field. Proble…

---

## [PDF's are not getting indexed in AppSearch when crawling it using AppSearch Web Crawler](https://discuss.elastic.co/t/pdfs-are-not-getting-indexed-in-appsearch-when-crawling-it-using-appsearch-web-crawler/329932)

<div class="topic-metadata">

**Author:** [@Disha\_Bodade](https://discuss.elastic.co/u/Disha_Bodade)\
**Replies:** 6\
**Last updated:** [April 19, 2023, 11:18am UTC](https://discuss.elastic.co/t/pdfs-are-not-getting-indexed-in-appsearch-when-crawling-it-using-appsearch-web-crawler/329932 "2023-04-19T11:18:52Z")

</div>

Hi Team, I have some PDF documents in my domain sitemap, and while crawling it, Appsearch web crawler logs shows message. \[2023-04-13T08:11:53.831+00:00\]\[844759\]\[49052\]\[crawler\]\[WARN\]: \[crawl:6437b871e4f7669ec8fc6df1\] …

---

## [Rollup Job - New data not Rolled Up](https://discuss.elastic.co/t/rollup-job-new-data-not-rolled-up/330006)

<div class="topic-metadata">

**Author:** [@Vitor\_Nilson](https://discuss.elastic.co/u/Vitor_Nilson)\
**Replies:** 3\
**Last updated:** [April 19, 2023, 11:17am UTC](https://discuss.elastic.co/t/rollup-job-new-data-not-rolled-up/330006 "2023-04-19T11:17:27Z")

</div>

Hello, I'm currently creating a rollup job to reduce storage costs in my company. The rollup job worked well, grouped by the fields that I specified. The problem is that only data older than 7 days is being rolled up t…

---

## [Uptime Monitors - Synthetic Monitors (Orphaned)](https://discuss.elastic.co/t/uptime-monitors-synthetic-monitors-orphaned/330036)

<div class="topic-metadata">

**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\
**Replies:** 4\
**Last updated:** [April 19, 2023, 10:00am UTC](https://discuss.elastic.co/t/uptime-monitors-synthetic-monitors-orphaned/330036 "2023-04-19T10:00:30Z")

</div>

Hi, For some reason I have Uptime Monitors which are orphaned as I am not running any Browser Synthetic Integrations from within Fleet. Would like to somehow remove these. Kibana version: 8.7

---

## [Fleet Server Unable to Communicate to Elasticsearch Due to Bad Certificate](https://discuss.elastic.co/t/fleet-server-unable-to-communicate-to-elasticsearch-due-to-bad-certificate/328038)

<div class="topic-metadata">

**Author:** [@Kowshik\_Islam](https://discuss.elastic.co/u/Kowshik_Islam)\
**Replies:** 4\
**Last updated:** [April 19, 2023, 9:13am UTC](https://discuss.elastic.co/t/fleet-server-unable-to-communicate-to-elasticsearch-due-to-bad-certificate/328038 "2023-04-19T09:13:03Z")

</div>

Hi, I am having trouble with having my fleet server communicate with elasticsearch cluster. My current stack has have 2 EC2 instance for Elasticsearch (es01, es02), 1 EC2 Instance for Kibana and 1 EC2 instance for Fleet …

---

## [Metricbeat Docker - Containers missing](https://discuss.elastic.co/t/metricbeat-docker-containers-missing/330280)

<div class="topic-metadata">

**Author:** [@thibaut\_a](https://discuss.elastic.co/u/thibaut_a)\
**Replies:** 0\
**Last updated:** [April 19, 2023, 9:01am UTC](https://discuss.elastic.co/t/metricbeat-docker-containers-missing/330280 "2023-04-19T09:01:17Z")

</div>

Hi, I have some containers running on a Debian server. I have installed Metricbeat and activated the Docker module (config below), but in Kibana dashboards, some are missing. I should see 7 lines (1 per started container…

[Previous page](https://discuss.elastic.co/latest.md?page=704)

[Next page](https://discuss.elastic.co/latest.md?page=706)
