# Latest **URL:** https://discuss.elastic.co/latest.md?page=752 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 753 --- ## [Issue enrolling elastic agent in docker](https://discuss.elastic.co/t/issue-enrolling-elastic-agent-in-docker/325511)
**Author:** [@Anon](https://discuss.elastic.co/u/Anon)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 8:05pm UTC](https://discuss.elastic.co/t/issue-enrolling-elastic-agent-in-docker/325511 "2023-03-10T20:05:23Z")
I have "successfully" enrolled elastic agent. Kibana shows that the agent is Healthy for some time, until Endpoint Security starts communication with Elasticsearch. In logs I get following error. {"@timestamp":"2023-0… --- ## [How can I force the order of labels?](https://discuss.elastic.co/t/how-can-i-force-the-order-of-labels/327424)
**Author:** [@Wpq](https://discuss.elastic.co/u/Wpq)\ **Replies:** 2\ **Last updated:** [March 10, 2023, 7:29pm UTC](https://discuss.elastic.co/t/how-can-i-force-the-order-of-labels/327424 "2023-03-10T19:29:22Z")
I have data with a label priority that I show on a heatmap: The order at the bottom is not the one I would like to have (which is CRITICAL, HIGH, ...) How can I instruct Kibana to use a specific order for the labels… --- ## [Logstash second conf file is not taking](https://discuss.elastic.co/t/logstash-second-conf-file-is-not-taking/327354)
**Author:** [@ekambaram\_varathan](https://discuss.elastic.co/u/ekambaram_varathan)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 6:47pm UTC](https://discuss.elastic.co/t/logstash-second-conf-file-is-not-taking/327354 "2023-03-10T18:47:42Z")
I am using docker-compose version: v2.9.0. and version: '3.7' in docker-compose yml file and using the below command in logstash section., when i see the logstash logs only its taking the first conf file, second conf fil… --- ## [Using essql query results a second query against another index](https://discuss.elastic.co/t/using-essql-query-results-a-second-query-against-another-index/327396)
**Author:** [@dreynolds](https://discuss.elastic.co/u/dreynolds)\ **Replies:** 2\ **Last updated:** [March 10, 2023, 6:42pm UTC](https://discuss.elastic.co/t/using-essql-query-results-a-second-query-against-another-index/327396 "2023-03-10T18:42:26Z")
In Canvas I'm attempting to query an index, return the results of a specific column, and then query another index with the results of the original query. An example would be two indices: Index 1: login\_activity; two fi… --- ## [Disable enrolment-token requirement on initial startup of Elasticsearch and Kibana](https://discuss.elastic.co/t/disable-enrolment-token-requirement-on-initial-startup-of-elasticsearch-and-kibana/327399)
**Author:** [@Matt\_Johnston](https://discuss.elastic.co/u/Matt_Johnston)\ **Replies:** 6\ **Last updated:** [March 10, 2023, 6:08pm UTC](https://discuss.elastic.co/t/disable-enrolment-token-requirement-on-initial-startup-of-elasticsearch-and-kibana/327399 "2023-03-10T18:08:02Z")
Hello. I'm running Elasticsearch and Kibana via docker containers, whose images I'm building from the Dockerfiles from this repository: GitHub - elastic/dockerfiles: Dockerfiles for the official Elastic Stack images. On … --- ## [Time series line chart querying two different indexes](https://discuss.elastic.co/t/time-series-line-chart-querying-two-different-indexes/327233)
**Author:** [@Tom\_White](https://discuss.elastic.co/u/Tom_White)\ **Replies:** 2\ **Last updated:** [March 10, 2023, 4:58pm UTC](https://discuss.elastic.co/t/time-series-line-chart-querying-two-different-indexes/327233 "2023-03-10T16:58:48Z")
Hello, I would like to create a very simple time series line chart in Kibana. One line would be a filtered aggregation (count) from Index A, and the other line would be a filtered aggregation (count) from Index B. Is thi… --- ## [Alerting - OR condition in Log threshold rule type](https://discuss.elastic.co/t/alerting-or-condition-in-log-threshold-rule-type/327458)
**Author:** [@flalar](https://discuss.elastic.co/u/flalar)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 4:31pm UTC](https://discuss.elastic.co/t/alerting-or-condition-in-log-threshold-rule-type/327458 "2023-03-10T16:31:25Z")
We are currently migrating from the 3.party Elastalert package for alerting on data in Elasticsearch to the native Kibana Alerting capabilities. On that path we have come across the issue that it does not seem possible t… --- ## [Search functionality in Elastic Stack fails with a proxy error](https://discuss.elastic.co/t/search-functionality-in-elastic-stack-fails-with-a-proxy-error/327372)
**Author:** [@Bhanuji\_paluri](https://discuss.elastic.co/u/Bhanuji_paluri)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 4:24pm UTC](https://discuss.elastic.co/t/search-functionality-in-elastic-stack-fails-with-a-proxy-error/327372 "2023-03-10T16:24:07Z")
when the search is filtered with indices of large size and with more no of days ex: more than 7 days. Steps to reproduce: Login to Kibana service: https://docklin-efk-ks.sel .rnd.internal.com/ select index pattern d… --- ## [Connect sql server database to elasticsearch](https://discuss.elastic.co/t/connect-sql-server-database-to-elasticsearch/327465)
**Author:** [@Farah\_Bhr](https://discuss.elastic.co/u/Farah_Bhr)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 4:23pm UTC](https://discuss.elastic.co/t/connect-sql-server-database-to-elasticsearch/327465 "2023-03-10T16:23:56Z")
I want to connect sql server database to elasticsearch without copying the sql data to elasticsearch, with a simple call of the sql data or simple connection , without loading the data from sql server to elasticsearch I… --- ## [Dashboard filtering](https://discuss.elastic.co/t/dashboard-filtering/327437)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 2\ **Last updated:** [March 10, 2023, 4:17pm UTC](https://discuss.elastic.co/t/dashboard-filtering/327437 "2023-03-10T16:17:40Z")
Hello, I want to add a filter that eliminates the records with type Disconnect and have user admin. So only for user admin to eliminate the Disconnect events. I've tried this, but it is not ok { "query": { "boo… --- ## [The stack cannot be started according to the instructions](https://discuss.elastic.co/t/the-stack-cannot-be-started-according-to-the-instructions/327431)
**Author:** [@alexanderzhirov](https://discuss.elastic.co/u/alexanderzhirov)\ **Replies:** 13\ **Last updated:** [March 10, 2023, 4:00pm UTC](https://discuss.elastic.co/t/the-stack-cannot-be-started-according-to-the-instructions/327431 "2023-03-10T16:00:14Z")
I'm trying to run the stack in docker according to this instruction. My .env: # Password for the 'elastic' user (at least 6 characters) ELASTIC\_PASSWORD=elastic # Password for the 'kibana\_system' user (at least 6 char… --- ## [RUM & APM Traces are not having same trace id](https://discuss.elastic.co/t/rum-apm-traces-are-not-having-same-trace-id/327029)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 4\ **Last updated:** [March 10, 2023, 3:31pm UTC](https://discuss.elastic.co/t/rum-apm-traces-are-not-having-same-trace-id/327029 "2023-03-10T15:31:53Z")
hello team, I came across the issue whee i am not getting same trace id for RUM & APM transaction. E.g. i initiate the transaction "add product to basket" and i get the transaction detail in APM (service - clothing) & … --- ## [Can i send message from logstash to pagerduty by http output plugin](https://discuss.elastic.co/t/can-i-send-message-from-logstash-to-pagerduty-by-http-output-plugin/326129)
**Author:** [@YasuhiroOkumura](https://discuss.elastic.co/u/YasuhiroOkumura)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 3:22pm UTC](https://discuss.elastic.co/t/can-i-send-message-from-logstash-to-pagerduty-by-http-output-plugin/326129 "2023-03-10T15:22:25Z")
Are there any having sample code using http output plugin of logstash to send message to pagerduty. Can I see the code. --- ## [Is it possible to move a one time snapshot to Glacier?](https://discuss.elastic.co/t/is-it-possible-to-move-a-one-time-snapshot-to-glacier/327455)
**Author:** [@John\_Newman1](https://discuss.elastic.co/u/John_Newman1)\ **Replies:** 4\ **Last updated:** [March 10, 2023, 2:41pm UTC](https://discuss.elastic.co/t/is-it-possible-to-move-a-one-time-snapshot-to-glacier/327455 "2023-03-10T14:41:09Z")
Hi, In the docs, it states that after snapshotting an index to S3 you shouldn't transition it to Glacier. I have a use case where I would like to snapshot an index as a one off event and store it as cheaply as possible,… --- ## [Nested aggregation Error](https://discuss.elastic.co/t/nested-aggregation-error/327451)
**Author:** [@Vivek\_Burman](https://discuss.elastic.co/u/Vivek_Burman)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 1:50pm UTC](https://discuss.elastic.co/t/nested-aggregation-error/327451 "2023-03-10T13:50:01Z")
So, I have my mappings as this and my query request object as referred to \[this link\](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-nested-aggregation.html) Query JSON { … --- ## [Error Loading data into ElasticSearch using Azure Data Factory - Zappysys connector](https://discuss.elastic.co/t/error-loading-data-into-elasticsearch-using-azure-data-factory-zappysys-connector/327442)
**Author:** [@gau\_prpce](https://discuss.elastic.co/u/gau_prpce)\ **Replies:** 0\ **Last updated:** [March 10, 2023, 10:58am UTC](https://discuss.elastic.co/t/error-loading-data-into-elasticsearch-using-azure-data-factory-zappysys-connector/327442 "2023-03-10T10:58:33Z")
I was trying to load data from azure postgresql to elasticsearch through ADF copy activity using Zappysys connector. Facing this issue. Failure happened on 'Sink' side. ErrorCode=UserErrorOdbcOperationFailed,'Type=Micr… --- ## [SLM cron expression](https://discuss.elastic.co/t/slm-cron-expression/327357)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 12:55pm UTC](https://discuss.elastic.co/t/slm-cron-expression/327357 "2023-03-10T12:55:36Z")
Hi Team, I am using a slm policy and wanted to add the cron expression such that it run on every 26th day. e.g for 1st month jan it run on 26/01/2023 and then run on +26 days that is 21/02/2023 and so on. Can someone pl… --- ## [How to create managed indexes with current date in names?](https://discuss.elastic.co/t/how-to-create-managed-indexes-with-current-date-in-names/327312)
**Author:** [@maar](https://discuss.elastic.co/u/maar)\ **Replies:** 4\ **Last updated:** [March 10, 2023, 12:46pm UTC](https://discuss.elastic.co/t/how-to-create-managed-indexes-with-current-date-in-names/327312 "2023-03-10T12:46:10Z")
How to setup ILM policies with dates in the names of the indexes? Here's the setup that works (without dates): PUT \_index\_template/index-test { "index\_patterns": \["index-test-\*"\], "template": { … --- ## [Boxplot, Title Y-axis](https://discuss.elastic.co/t/boxplot-title-y-axis/327441)
**Author:** [@joerg55](https://discuss.elastic.co/u/joerg55)\ **Replies:** 0\ **Last updated:** [March 10, 2023, 10:57am UTC](https://discuss.elastic.co/t/boxplot-title-y-axis/327441 "2023-03-10T10:57:50Z")
Hi community, the Y-title of my boxplot should be 'Percent'. But the Chart shows the Title like this: The source of the chart is this: { "$schema": "https://vega.github.io/schema/vega-lite/v5.json", "title": "Re… --- ## [How can I delete unnassigned shards?](https://discuss.elastic.co/t/how-can-i-delete-unnassigned-shards/327433)
**Author:** [@frankmehlhop.com](https://discuss.elastic.co/u/frankmehlhop.com)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 10:56am UTC](https://discuss.elastic.co/t/how-can-i-delete-unnassigned-shards/327433 "2023-03-10T10:56:03Z")
In my cluster there are unassigned shards which are not primary shards. I don't know why I have these secondary shards in my cluster. I didn't create them intentionally and I use the default configuration (elasticsearch… --- ## [How to remove the empty result set caused by bucket\_selector?](https://discuss.elastic.co/t/how-to-remove-the-empty-result-set-caused-by-bucket-selector/327430)
**Author:** [@Jinnrry](https://discuss.elastic.co/u/Jinnrry)\ **Replies:** 2\ **Last updated:** [March 10, 2023, 10:48am UTC](https://discuss.elastic.co/t/how-to-remove-the-empty-result-set-caused-by-bucket-selector/327430 "2023-03-10T10:48:13Z")
This operation will show you my problem. 1、Create Index PUT car { "mappings": { "properties": { "color": { "type": "keyword" }, "company": { "type": "keyword" }, "pri… --- ## [Not able to send data from filebeat to elastic cloud however with same settings it works on EFK stack on linux](https://discuss.elastic.co/t/not-able-to-send-data-from-filebeat-to-elastic-cloud-however-with-same-settings-it-works-on-efk-stack-on-linux/327390)
**Author:** [@sameer\_rathod](https://discuss.elastic.co/u/sameer_rathod)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 10:40am UTC](https://discuss.elastic.co/t/not-able-to-send-data-from-filebeat-to-elastic-cloud-however-with-same-settings-it-works-on-efk-stack-on-linux/327390 "2023-03-10T10:40:52Z")
I am using elastic cloud and when I used filebeat to send IIS logs from windows machine, elasticsearch only received the error logs and not even a single access logs from default directory. In last two days I tried setti… --- ## [Packetbeat isn't capture mysql network traffic](https://discuss.elastic.co/t/packetbeat-isnt-capture-mysql-network-traffic/327378)
**Author:** [@Ivan\_Picca](https://discuss.elastic.co/u/Ivan_Picca)\ **Replies:** 2\ **Last updated:** [March 10, 2023, 10:12am UTC](https://discuss.elastic.co/t/packetbeat-isnt-capture-mysql-network-traffic/327378 "2023-03-10T10:12:57Z")
hey guys. I'm stuck. I got this problem. I've configured packetbeat to capture network traffic. I've 1 server contains elk stack and another host where i' ve installed packetbeat and mysql. The main idea is forward pack… --- ## [How to roll up RUM data](https://discuss.elastic.co/t/how-to-roll-up-rum-data/326927)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 5\ **Last updated:** [March 10, 2023, 10:07am UTC](https://discuss.elastic.co/t/how-to-roll-up-rum-data/326927 "2023-03-10T10:07:10Z")
Hi all, we are using an Elastic deployment for collecting apm & rum data of a website. It is used for a project where we are improving the user experience. The project will take a few weeks/months so we want to rollup t… --- ## [How to Add Another Host To Kibana On Different Device or Server](https://discuss.elastic.co/t/how-to-add-another-host-to-kibana-on-different-device-or-server/327250)
**Author:** [@Tw1cUser](https://discuss.elastic.co/u/Tw1cUser)\ **Replies:** 4\ **Last updated:** [March 10, 2023, 9:39am UTC](https://discuss.elastic.co/t/how-to-add-another-host-to-kibana-on-different-device-or-server/327250 "2023-03-10T09:39:40Z")
I want add more host to my kibana on windows server 2019, but i have no idea how to do it. Anyone can help me with that simple question? --- ## [Finding similar/related news articles process](https://discuss.elastic.co/t/finding-similar-related-news-articles-process/327427)
**Author:** [@cyril\_g](https://discuss.elastic.co/u/cyril_g)\ **Replies:** 0\ **Last updated:** [March 10, 2023, 9:12am UTC](https://discuss.elastic.co/t/finding-similar-related-news-articles-process/327427 "2023-03-10T09:12:15Z")
Hello, I am working on a news app in the gaming industry and I would like to be able to identify headlines/ articles with titles about the same subject. One thing to note is that games and platforms have many alternati… --- ## [Cannot race. too many values to unpack (expected 2) error while benchmarking](https://discuss.elastic.co/t/cannot-race-too-many-values-to-unpack-expected-2-error-while-benchmarking/327214)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 8\ **Last updated:** [March 10, 2023, 9:02am UTC](https://discuss.elastic.co/t/cannot-race-too-many-values-to-unpack-expected-2-error-while-benchmarking/327214 "2023-03-10T09:02:08Z")
/ /\_/ / \_\_ \`/ / / / / / \[pod/benchmark-rb8nf/benchmark\] / \_, \_/ /\_/ / / / /\_/ / \[pod/benchmark-rb8nf/benchmark\] /\_/ |\_|\\\_\_,\_/\_/\_/\\\_\_, / \[pod/benchmark-rb8nf/benchmark\] /\_\_\_\_/ \[pod/benchmark-rb8nf/benchma… --- ## [How Exclude option in kibana tag cloud works?](https://discuss.elastic.co/t/how-exclude-option-in-kibana-tag-cloud-works/327365)
**Author:** [@Mehran\_Goodarzi](https://discuss.elastic.co/u/Mehran_Goodarzi)\ **Replies:** 0\ **Last updated:** [March 9, 2023, 1:40pm UTC](https://discuss.elastic.co/t/how-exclude-option-in-kibana-tag-cloud-works/327365 "2023-03-09T13:40:04Z")
Hi there, I have a field called "Ticket Text" that has fielddata enabled, the field contains paragraphs of text, when I use Exclude option to exclude words like : "at","in", "the" does it exclude only the word or the w… --- ## [How much user can login at same time for basic license ELK version 8.0.0](https://discuss.elastic.co/t/how-much-user-can-login-at-same-time-for-basic-license-elk-version-8-0-0/327383)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 3\ **Last updated:** [March 10, 2023, 8:21am UTC](https://discuss.elastic.co/t/how-much-user-can-login-at-same-time-for-basic-license-elk-version-8-0-0/327383 "2023-03-10T08:21:59Z")
Hi Team, I am using basic license of ELK version 8.0.0 , wanted to know how many user can login at same time we are using a docker image for setting it up. --- ## [Elastic Agent with custom log integration](https://discuss.elastic.co/t/elastic-agent-with-custom-log-integration/327341)
**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\ **Replies:** 10\ **Last updated:** [March 10, 2023, 7:53am UTC](https://discuss.elastic.co/t/elastic-agent-with-custom-log-integration/327341 "2023-03-10T07:53:37Z")
Hi, Ran into issue which is quite puzzling. Referred to the official docs and some topics in this forum but it did not help. I am trying to ingest custom logs via integration within elastic agent. Everything is working… [Previous page](https://discuss.elastic.co/latest.md?page=751) [Next page](https://discuss.elastic.co/latest.md?page=753)