# Latest **URL:** https://discuss.elastic.co/latest.md?page=804 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 805 --- ## [Failed to submit message: 'Connection to APM Server timed out (url: http://apm-server:8200/intake/v2/events, timeout: 10000.0 seconds)](https://discuss.elastic.co/t/failed-to-submit-message-connection-to-apm-server-timed-out-url-http-apm-server-8200-intake-v2-events-timeout-10000-0-seconds/324076)
**Author:** [@SELENAAA](https://discuss.elastic.co/u/SELENAAA)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 10:34pm UTC](https://discuss.elastic.co/t/failed-to-submit-message-connection-to-apm-server-timed-out-url-http-apm-server-8200-intake-v2-events-timeout-10000-0-seconds/324076 "2023-01-27T22:34:32Z")
Kibana version: Elasticsearch version: elastic-apm==6.13.2 APM Server version: APM Agent language and version: python Browser version: safari Original install method (e.g. download page, yum, deb, from source, etc.)… --- ## [Transform not aligning checkpoints with date histogram](https://discuss.elastic.co/t/transform-not-aligning-checkpoints-with-date-histogram/324063)
**Author:** [@ddolcimascolo](https://discuss.elastic.co/u/ddolcimascolo)\ **Replies:** 6\ **Last updated:** [January 27, 2023, 9:41pm UTC](https://discuss.elastic.co/t/transform-not-aligning-checkpoints-with-date-histogram/324063 "2023-01-27T21:41:07Z")
Hi all. I'm using pivot transforms to group data by a date histogram and a few other terms dimensions. The transforms are running in continuous mode using the ingest timestamp as the sync.time.field but I'm grouping on … --- ## [How to index only some of the fields of the entire document?](https://discuss.elastic.co/t/how-to-index-only-some-of-the-fields-of-the-entire-document/323910)
**Author:** [@lnaie](https://discuss.elastic.co/u/lnaie)\ **Replies:** 10\ **Last updated:** [January 27, 2023, 9:23pm UTC](https://discuss.elastic.co/t/how-to-index-only-some-of-the-fields-of-the-entire-document/323910 "2023-01-27T21:23:23Z")
Hi everyone, I have an indexing question related to EES app searching. Btw we are on the cloud offering v8.4. We are using the API to push documents into the search engine and we are actually sending to EES the whole d… --- ## [ElasticSearch-8-5-2 ingest-pipeline issue](https://discuss.elastic.co/t/elasticsearch-8-5-2-ingest-pipeline-issue/324114)
**Author:** [@Pierre\_LANCASTRE](https://discuss.elastic.co/u/Pierre_LANCASTRE)\ **Replies:** 10\ **Last updated:** [January 27, 2023, 5:32pm UTC](https://discuss.elastic.co/t/elasticsearch-8-5-2-ingest-pipeline-issue/324114 "2023-01-27T17:32:26Z")
Hi all, I recently posted a problem on ingest-pipelines working in testing mode but finally not working. I have the same issue and i m still stuck while I ve tried many tricks (remove special characters from syslog stri… --- ## [Replace one value with another logstash](https://discuss.elastic.co/t/replace-one-value-with-another-logstash/324130)
**Author:** [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\ **Replies:** 2\ **Last updated:** [January 27, 2023, 8:44pm UTC](https://discuss.elastic.co/t/replace-one-value-with-another-logstash/324130 "2023-01-27T20:44:05Z")
Hi, I was trying to convert the value of one field with another, for example: I currently have a field called "priority" and the value of that field is = 1, priority=1. What I want to do is change that value 1 to critic… --- ## [How could i manage types in new versions ? another way?](https://discuss.elastic.co/t/how-could-i-manage-types-in-new-versions-another-way/324134)
**Author:** [@Anibal\_Ardid](https://discuss.elastic.co/u/Anibal_Ardid)\ **Replies:** 5\ **Last updated:** [January 27, 2023, 7:46pm UTC](https://discuss.elastic.co/t/how-could-i-manage-types-in-new-versions-another-way/324134 "2023-01-27T19:46:52Z")
Hi ! I'm new on elasticsearch indexing. And i'm trying to migrate from v5 to v8, i know this is a big change and challenge. I read about types are deprecated now. So , how could i manage my data ? Now I have 1 index… --- ## [Mutate a specific JSON field but not another](https://discuss.elastic.co/t/mutate-a-specific-json-field-but-not-another/324079)
**Author:** [@hexoffender](https://discuss.elastic.co/u/hexoffender)\ **Replies:** 3\ **Last updated:** [January 27, 2023, 8:18pm UTC](https://discuss.elastic.co/t/mutate-a-specific-json-field-but-not-another/324079 "2023-01-27T20:18:40Z")
Hello, I have data that looks like this. { "remote\_addr": "127.0.0.1", "time\_local": "26/Jan/2023:17:07:18 -0800", "request": "POST /abcd HTTP/1.1", "request\_method": "POST", "status": "200", "us… --- ## [Creating an index with existing index](https://discuss.elastic.co/t/creating-an-index-with-existing-index/323550)
**Author:** [@elrozario](https://discuss.elastic.co/u/elrozario)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 8:15pm UTC](https://discuss.elastic.co/t/creating-an-index-with-existing-index/323550 "2023-01-27T20:15:28Z")
Hello, I have many indexes named .ds-traces-apm-default-2022.12.12-000124 .ds-traces-apm-default-2022.12.17-000125 .ds-traces-apm-default-2022.12.20-000126 .ds-traces-apm-default-2022.12.22-000127 .ds-traces-apm-de… --- ## [Elastic search SaveJsontoEs Hadoop Libra dropping documents without throwing error or warning](https://discuss.elastic.co/t/elastic-search-savejsontoes-hadoop-libra-dropping-documents-without-throwing-error-or-warning/323384)
**Author:** [@Bhuvesh\_Seth](https://discuss.elastic.co/u/Bhuvesh_Seth)\ **Replies:** 8\ **Last updated:** [January 27, 2023, 7:51pm UTC](https://discuss.elastic.co/t/elastic-search-savejsontoes-hadoop-libra-dropping-documents-without-throwing-error-or-warning/323384 "2023-01-27T19:51:59Z")
Hi, we are using Elasticsearch Hadoop library to index the documents from Spark job. We are facing one weird issue where the documents are not getting indexed without throwing any error or exception. Method used: rdd.Sa… --- ## ["upgrade Assistant" is not visible under "management tab"](https://discuss.elastic.co/t/upgrade-assistant-is-not-visible-under-management-tab/324055)
**Author:** [@shahulyousuf](https://discuss.elastic.co/u/shahulyousuf)\ **Replies:** 2\ **Last updated:** [January 27, 2023, 6:18pm UTC](https://discuss.elastic.co/t/upgrade-assistant-is-not-visible-under-management-tab/324055 "2023-01-27T18:18:38Z")
Hey, I'm new to elasticsearch, I have installed elasticsearch 8.5.2 in single node and configured Kibana. Now I'm trying to upgrade to 8.6.1 through upgrade assistant as elastic user but cant find the upgrade assistant… --- ## [Provided Grok expressions do not match field value](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/324133)
**Author:** [@a.emrekaraman](https://discuss.elastic.co/u/a.emrekaraman)\ **Replies:** 0\ **Last updated:** [January 27, 2023, 6:04pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/324133 "2023-01-27T18:04:38Z")
Hi Team, I installed 7.12.1 filebeat and enabled apache module but I'm getting "error.message Provided Grok expressions do not match field value". I checked apache log format for my website.it seems like below; LogFo… --- ## [How to pass variable to the body section of script in webhook watcher?](https://discuss.elastic.co/t/how-to-pass-variable-to-the-body-section-of-script-in-webhook-watcher/324118)
**Author:** [@M\_S](https://discuss.elastic.co/u/M_S)\ **Replies:** 2\ **Last updated:** [January 27, 2023, 5:39pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-to-the-body-section-of-script-in-webhook-watcher/324118 "2023-01-27T17:39:48Z")
I have the following webhook watcher which creates OTRS ticket when there is a term "Error" in document. However right now the ticket body declared in script is a fixed string for now ( This is only a test). How to pa… --- ## [There is a way to use search\_after to restart an scroll?](https://discuss.elastic.co/t/there-is-a-way-to-use-search-after-to-restart-an-scroll/324128)
**Author:** [@Guillermo\_Garcia1](https://discuss.elastic.co/u/Guillermo_Garcia1)\ **Replies:** 0\ **Last updated:** [January 27, 2023, 5:13pm UTC](https://discuss.elastic.co/t/there-is-a-way-to-use-search-after-to-restart-an-scroll/324128 "2023-01-27T17:13:45Z")
It is possible to start an scroll with search\_after ? The idea is to : Create an scroll with a good "sort" Iterate thanks to the scroll\_id and process each batch of docs If when asking for the next batch, a "search\_con… --- ## [How to detect incorrect OID in SNMP input plugin?](https://discuss.elastic.co/t/how-to-detect-incorrect-oid-in-snmp-input-plugin/324062)
**Author:** [@scantron](https://discuss.elastic.co/u/scantron)\ **Replies:** 2\ **Last updated:** [January 27, 2023, 4:56pm UTC](https://discuss.elastic.co/t/how-to-detect-incorrect-oid-in-snmp-input-plugin/324062 "2023-01-27T16:56:28Z")
When using the SNMP input plugin, I am trying to detect when an OID does not work on the given host. For instance, when using snmpget in the command line with an OID that does not correspond to the given host, it would r… --- ## [Why do get results for some strings within a field, but not others?](https://discuss.elastic.co/t/why-do-get-results-for-some-strings-within-a-field-but-not-others/324011)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 4:53pm UTC](https://discuss.elastic.co/t/why-do-get-results-for-some-strings-within-a-field-but-not-others/324011 "2023-01-27T16:53:11Z")
I can search for ERROR within the message field, but if I try transactionId, I get no hits.. --- ## [Missing log events for deleted files within a folder using Auditbeat 8.6 for Windows file integrity](https://discuss.elastic.co/t/missing-log-events-for-deleted-files-within-a-folder-using-auditbeat-8-6-for-windows-file-integrity/324123)
**Author:** [@cyber\_lc51](https://discuss.elastic.co/u/cyber_lc51)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 4:47pm UTC](https://discuss.elastic.co/t/missing-log-events-for-deleted-files-within-a-folder-using-auditbeat-8-6-for-windows-file-integrity/324123 "2023-01-27T16:47:18Z")
I am using Auditbeat 8.6 for Windows file integrity and have noticed that when I delete a folder, the event is captured and shows that the folder was deleted, but there are no logs of the individual files within the dele… --- ## [Latency (No data to display) APM Kibana](https://discuss.elastic.co/t/latency-no-data-to-display-apm-kibana/324042)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 2\ **Last updated:** [January 27, 2023, 4:37pm UTC](https://discuss.elastic.co/t/latency-no-data-to-display-apm-kibana/324042 "2023-01-27T16:37:40Z")
Kibana version : 8.5.2 Elasticsearch version : 8.5.2 APM Server version : 8.6 APM Agent language and version : APM Real User Monitoring JavaScript Agent. Angular Integration. 5.x I can't get latency data. While … --- ## [Elastic Agent "chown" issues on Mac](https://discuss.elastic.co/t/elastic-agent-chown-issues-on-mac/321337)
**Author:** [@kshort](https://discuss.elastic.co/u/kshort)\ **Replies:** 7\ **Last updated:** [January 27, 2023, 4:33pm UTC](https://discuss.elastic.co/t/elastic-agent-chown-issues-on-mac/321337 "2023-01-27T16:33:24Z")
I have an issue when adding the elastic-agent on a Mac. I am following the "Install Elastic Agent on your host" instructions provided for Mac by my agent policy. When starting URL enrollment I get the error: "Error: fai… --- ## [Work with multiples inputs/outputs in microsoft-logstash-output-azure-loganalytics plugin](https://discuss.elastic.co/t/work-with-multiples-inputs-outputs-in-microsoft-logstash-output-azure-loganalytics-plugin/324068)
**Author:** [@Rafael\_Oliveira](https://discuss.elastic.co/u/Rafael_Oliveira)\ **Replies:** 3\ **Last updated:** [January 27, 2023, 4:08pm UTC](https://discuss.elastic.co/t/work-with-multiples-inputs-outputs-in-microsoft-logstash-output-azure-loganalytics-plugin/324068 "2023-01-27T16:08:19Z")
I'm working with microsoft-logstash-output-azure-loganalytics plugin and have to receive different inputs and send to different output based on tags or port. Is is possible? Let's my config file: input { tcp { … --- ## [APM Kibana how to use .keyword field](https://discuss.elastic.co/t/apm-kibana-how-to-use-keyword-field/324113)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 3:39pm UTC](https://discuss.elastic.co/t/apm-kibana-how-to-use-keyword-field/324113 "2023-01-27T15:39:09Z")
Kibana version : 8.5.2 Elasticsearch version : 8.5.2 APM Server version : 8.6 APM Agent language and version : APM Real User Monitoring JavaScript Agent. Angular Integration. 5.x When I go in Observability APM, I… --- ## [Clustering / horizontal Scaling of Enterprise Search (Workplace and App Search)](https://discuss.elastic.co/t/clustering-horizontal-scaling-of-enterprise-search-workplace-and-app-search/324092)
**Author:** [@sebastianboelling](https://discuss.elastic.co/u/sebastianboelling)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 3:14pm UTC](https://discuss.elastic.co/t/clustering-horizontal-scaling-of-enterprise-search-workplace-and-app-search/324092 "2023-01-27T15:14:21Z")
Hi, I need to horizontal scale Enterprise Search (Workplace and App Search). That means to set up multiple nodes (a Cluster) which intercooperate and distribute the load, similar for Elasticsearch or Kibana. How to do … --- ## [Kibana 7.10 - "Evidence of administrator activity being logged and monitoring."](https://discuss.elastic.co/t/kibana-7-10-evidence-of-administrator-activity-being-logged-and-monitoring/324059)
**Author:** [@cade.carpenter](https://discuss.elastic.co/u/cade.carpenter)\ **Replies:** 3\ **Last updated:** [January 27, 2023, 2:23pm UTC](https://discuss.elastic.co/t/kibana-7-10-evidence-of-administrator-activity-being-logged-and-monitoring/324059 "2023-01-27T14:23:42Z")
Hello everyone, I am assisting in data gathering for an upcoming audit and I am trying to use Kibana to search for 'Evidence of admin activity being logged' but I cannot seem to grasp the needed search parameters. I am… --- ## [java.lang.NullPointerException: Cannot invoke "java.util.List.stream()" because the return value of "org.elasticsearch.indices.NodeIndicesStats.getShardStats(org.elasticsearch.index.Index)" is null](https://discuss.elastic.co/t/java-lang-nullpointerexception-cannot-invoke-java-util-list-stream-because-the-return-value-of-org-elasticsearch-indices-nodeindicesstats-getshardstats-org-elasticsearch-index-index-is-null/324091)
**Author:** [@sasvmware](https://discuss.elastic.co/u/sasvmware)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 2:12pm UTC](https://discuss.elastic.co/t/java-lang-nullpointerexception-cannot-invoke-java-util-list-stream-because-the-return-value-of-org-elasticsearch-indices-nodeindicesstats-getshardstats-org-elasticsearch-index-index-is-null/324091 "2023-01-27T14:12:40Z")
Hi We are getting below in prod \[2023-01-26T23:55:54,079\]\[ERROR\]\[o.e.x.m.c.c.ClusterStatsCollector\] \[xxx-prd-elkmd1.xxxxxx.com\] collector \[cluster\_stats\] failed to collect data java.lang.NullPointerException: Cannot i… --- ## [Multi Search with "AND" operation among them](https://discuss.elastic.co/t/multi-search-with-and-operation-among-them/323776)
**Author:** [@pradeepjanga](https://discuss.elastic.co/u/pradeepjanga)\ **Replies:** 5\ **Last updated:** [January 26, 2023, 9:24pm UTC](https://discuss.elastic.co/t/multi-search-with-and-operation-among-them/323776 "2023-01-26T21:24:28Z")
We have a use case where we need to perform multiple query with AND operation between textbox and OR operation within textbox. Is there any way to achieve them in APP SEARCH? we have 3 text box where user can enter mult… --- ## [Logstash starting error with JSON codec plugin](https://discuss.elastic.co/t/logstash-starting-error-with-json-codec-plugin/324100)
**Author:** [@sbocquet](https://discuss.elastic.co/u/sbocquet)\ **Replies:** 2\ **Last updated:** [January 27, 2023, 1:43pm UTC](https://discuss.elastic.co/t/logstash-starting-error-with-json-codec-plugin/324100 "2023-01-27T13:43:49Z")
Hi, I'm trying to send some logs with rsyslog in JSON format to my logstash v8.6 server, but it seems that there is a problem with my JSON codec. Here is the error log : \[2023-01-27T11:31:47,917\]\[INFO \]\[logstash.runne… --- ## [Integración con Microsoft Exchange Online Message Trace](https://discuss.elastic.co/t/integracion-con-microsoft-exchange-online-message-trace/324111)
**Author:** [@Gonzalo\_Sandoval\_A](https://discuss.elastic.co/u/Gonzalo_Sandoval_A)\ **Replies:** 0\ **Last updated:** [January 27, 2023, 1:29pm UTC](https://discuss.elastic.co/t/integracion-con-microsoft-exchange-online-message-trace/324111 "2023-01-27T13:29:49Z")
Hi, I need to integrate the Microsoft Exchange Online Message Trace, I am using the elastic agent integration and I don't know which url to put, please help as I think there is missing information and I am not very rela… --- ## [Add message in Kibana login page](https://discuss.elastic.co/t/add-message-in-kibana-login-page/324110)
**Author:** [@ismael\_boumedien](https://discuss.elastic.co/u/ismael_boumedien)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 1:24pm UTC](https://discuss.elastic.co/t/add-message-in-kibana-login-page/324110 "2023-01-27T13:24:49Z")
Hi, We want to add a message in Kibana login page. We are using Kibana 5.6.8, Is't possible. If yes please advice us. Regards Ismaël --- ## [Logstash 8.5.2 how to parse special character in a string value](https://discuss.elastic.co/t/logstash-8-5-2-how-to-parse-special-character-in-a-string-value/324107)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 3\ **Last updated:** [January 27, 2023, 1:14pm UTC](https://discuss.elastic.co/t/logstash-8-5-2-how-to-parse-special-character-in-a-string-value/324107 "2023-01-27T13:14:10Z")
Parsing a value of string field http://127.0.0.1:27336/notify logstash maps in Elastic search index many values for the original string. In this case values are http, 127.0.0.1, 27336 and notify. When it encounters t… --- ## [Data streams vs ILM when using Fleet](https://discuss.elastic.co/t/data-streams-vs-ilm-when-using-fleet/324017)
**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\ **Replies:** 3\ **Last updated:** [January 26, 2023, 2:59pm UTC](https://discuss.elastic.co/t/data-streams-vs-ilm-when-using-fleet/324017 "2023-01-26T14:59:34Z")
Hello, We are moving away from Beats towards the Centralised Elastic Agent / Fleet but struggling to understand the concept behind how the new approach is meant to work with ILM. We have multiple infrastructures to pull… --- ## [Target field in ndjson](https://discuss.elastic.co/t/target-field-in-ndjson/324014)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 3\ **Last updated:** [January 27, 2023, 12:25pm UTC](https://discuss.elastic.co/t/target-field-in-ndjson/324014 "2023-01-27T12:25:49Z")
Hi! I have a log file with json records like { "request": { "foo": "bar" }, "response": { "foo": "bar" } } and the following configuration for filebeat - type: filestream paths: - /path/to/file … [Previous page](https://discuss.elastic.co/latest.md?page=803) [Next page](https://discuss.elastic.co/latest.md?page=805)