# Latest

**URL:** https://discuss.elastic.co/latest.md?page=821

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 822

---

## [I want contribute to kibana](https://discuss.elastic.co/t/i-want-contribute-to-kibana/322845)

<div class="topic-metadata">

**Author:** [@dawn023349](https://discuss.elastic.co/u/dawn023349)\
**Replies:** 7\
**Last updated:** [January 15, 2023, 4:41pm UTC](https://discuss.elastic.co/t/i-want-contribute-to-kibana/322845 "2023-01-15T16:41:02Z")

</div>

I finished installing and testing the Linux version of Kibana. And I forked git repo. But "kibana\\src\\plugins\\data\\target\\public\\data.plugin.js" file did not exist. What should I do?

---

## [CompositeAggregation.aggregateAfter usage](https://discuss.elastic.co/t/compositeaggregation-aggregateafter-usage/323196)

<div class="topic-metadata">

**Author:** [@hmkhitaryan](https://discuss.elastic.co/u/hmkhitaryan)\
**Replies:** 0\
**Last updated:** [January 15, 2023, 11:56am UTC](https://discuss.elastic.co/t/compositeaggregation-aggregateafter-usage/323196 "2023-01-15T11:56:33Z")

</div>

Hello everyone. this is my code, where I want to gain pagination ability, for not getting the whole bucket list and not to overload RAM memory. But anyway, it's unclear to me: what is this actually 'afterKey' for, an…

---

## [Filebeat support required](https://discuss.elastic.co/t/filebeat-support-required/323181)

<div class="topic-metadata">

**Author:** [@Sagar\_Naik](https://discuss.elastic.co/u/Sagar_Naik)\
**Replies:** 13\
**Last updated:** [January 15, 2023, 4:35am UTC](https://discuss.elastic.co/t/filebeat-support-required/323181 "2023-01-15T04:35:53Z")

</div>

getting error : Jan 14 21:30:07 ndc3vmappelk05 filebeat\[2374\]: 2023-01-14T21:30:07.888+0530 ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://10.94.241.145:5043)): dial tcp 10.94…

---

## [Help me with logstash config (Feature Request)](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992)

<div class="topic-metadata">

**Author:** [@Md\_Shariful\_Islam](https://discuss.elastic.co/u/Md_Shariful_Islam)\
**Replies:** 4\
**Last updated:** [January 15, 2023, 5:30am UTC](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992 "2023-01-15T05:30:36Z")

</div>

I am using logstash aggregate filter and I want timeout value for infinite time. How to do that? Current config for aggregate filter given below if \[src\_ip\] { aggregate { task\_id =\> "%{src\_ip}" …

---

## [Unable to trigger a watcher alert when multiple conditions are met](https://discuss.elastic.co/t/unable-to-trigger-a-watcher-alert-when-multiple-conditions-are-met/319361)

<div class="topic-metadata">

**Author:** [@as-sre](https://discuss.elastic.co/u/as-sre)\
**Replies:** 0\
**Last updated:** [November 20, 2022, 9:40am UTC](https://discuss.elastic.co/t/unable-to-trigger-a-watcher-alert-when-multiple-conditions-are-met/319361 "2022-11-20T09:40:53Z")

</div>

I am trying to implement a logic in watcher to trigger an alert when multiple conditions are met. I have seen a couple of examples where it talks about checking the field ctx.payload.alert.hits.total, but I am sure it is…

---

## [Failed to start Elasticsearch](https://discuss.elastic.co/t/failed-to-start-elasticsearch/322433)

<div class="topic-metadata">

**Author:** [@alam02](https://discuss.elastic.co/u/alam02)\
**Replies:** 1\
**Last updated:** [January 15, 2023, 3:09am UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch/322433 "2023-01-15T03:09:50Z")

</div>

Hello i have kibana, logstash started but impossible to start elastic.service and i got this error code when i run systemctl start elastic.service. Also on the website i receive this message " kibana is not ready yet". …

---

## [Adding score to SearchHit via REST Template](https://discuss.elastic.co/t/adding-score-to-searchhit-via-rest-template/323154)

<div class="topic-metadata">

**Author:** [@timothystone](https://discuss.elastic.co/u/timothystone)\
**Replies:** 3\
**Last updated:** [January 15, 2023, 3:07am UTC](https://discuss.elastic.co/t/adding-score-to-searchhit-via-rest-template/323154 "2023-01-15T03:07:04Z")

</div>

I'm using a NativeSearchQuery with setTrackScores(true). This query is passed to the ElasticsearchRestTemplate#search(Query, Clazz) (inherited from AbstractElasticsearchTemplate#(Query, Clazz) The Clazz here is a typica…

---

## [Upload file / Pb formats](https://discuss.elastic.co/t/upload-file-pb-formats/323186)

<div class="topic-metadata">

**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\
**Replies:** 0\
**Last updated:** [January 14, 2023, 10:40pm UTC](https://discuss.elastic.co/t/upload-file-pb-formats/323186 "2023-01-14T22:40:06Z")

</div>

Bonjour, Je souhaiterais savoir s'il est possible lors de l'import d'un fichier csv via Kibana: De faire reconnaitre automatiquement un champ du type "15 janvier 2023 " comme un champ date pour elk De faire reconnaitr…

---

## [Merging fields of two index pattern](https://discuss.elastic.co/t/merging-fields-of-two-index-pattern/315564)

<div class="topic-metadata">

**Author:** [@random\_dash](https://discuss.elastic.co/u/random_dash)\
**Replies:** 1\
**Last updated:** [October 24, 2022, 2:19pm UTC](https://discuss.elastic.co/t/merging-fields-of-two-index-pattern/315564 "2022-10-24T14:19:49Z")

</div>

Hi, I have two data streams in Kibana with similar information. I am trying to aggregate them by creating a new index pattern. Each of them has a field "state". For one of them, the state can be \[passed, failed\], and f…

---

## [Field value not found in aggregatable field](https://discuss.elastic.co/t/field-value-not-found-in-aggregatable-field/323182)

<div class="topic-metadata">

**Author:** [@nnet](https://discuss.elastic.co/u/nnet)\
**Replies:** 2\
**Last updated:** [January 14, 2023, 8:40pm UTC](https://discuss.elastic.co/t/field-value-not-found-in-aggregatable-field/323182 "2023-01-14T20:40:16Z")

</div>

Hi folks, I'm at a loss to understand this. ELK stack 5.6. Using filebeat i send json logs of nginx to logstash where they're parsed and fed into elasticsearch. No errors, all seems good. In kibana I have a visualizat…

---

## [Logstash Elasticsearch filter Bad URI Exception](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176)

<div class="topic-metadata">

**Author:** [@eraste](https://discuss.elastic.co/u/eraste)\
**Replies:** 9\
**Last updated:** [January 14, 2023, 7:02pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176 "2023-01-14T19:02:12Z")

</div>

Hello Everyone. I have an exception in Logstash with Elasticsearch filter in the hosts parameter. When i give manually the hosts parameter like this, all thing is good, i don't get error : filter { elasticsearch {…

---

## [Kibana Cavas empty datatable](https://discuss.elastic.co/t/kibana-cavas-empty-datatable/317001)

<div class="topic-metadata">

**Author:** [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\
**Replies:** 4\
**Last updated:** [October 24, 2022, 1:46pm UTC](https://discuss.elastic.co/t/kibana-cavas-empty-datatable/317001 "2022-10-24T13:46:48Z")

</div>

Hi, I am facing strange issue. I have created canvas report like below. Anyway, I am getting random icons with exclamation marks, but when I reload data with Alt+R, they randomly disapear and reapear on different metric…

---

## [Print logs into a file before parsing with GROK](https://discuss.elastic.co/t/print-logs-into-a-file-before-parsing-with-grok/323145)

<div class="topic-metadata">

**Author:** [@danishbit09](https://discuss.elastic.co/u/danishbit09)\
**Replies:** 3\
**Last updated:** [January 14, 2023, 5:52pm UTC](https://discuss.elastic.co/t/print-logs-into-a-file-before-parsing-with-grok/323145 "2023-01-14T17:52:15Z")

</div>

Is there any option to store logs into a file before parsing it in GROK. Please suggest. Can I use logger.info() in Filter plugin.

---

## [Elastic Logging Plugin for Docker: is the connection encrypted?](https://discuss.elastic.co/t/elastic-logging-plugin-for-docker-is-the-connection-encrypted/323177)

<div class="topic-metadata">

**Author:** [@kthy](https://discuss.elastic.co/u/kthy)\
**Replies:** 1\
**Last updated:** [January 14, 2023, 4:54pm UTC](https://discuss.elastic.co/t/elastic-logging-plugin-for-docker-is-the-connection-encrypted/323177 "2023-01-14T16:54:51Z")

</div>

This question is about the Elastic Logging Plugin for Docker, which doesn't have it's own category on the Elastic forums as far as I can see, but since it is based on Beats I'm posting here. Apologies if misplaced. My q…

---

## [Elastic Agent installation options for AWS integration](https://discuss.elastic.co/t/elastic-agent-installation-options-for-aws-integration/323148)

<div class="topic-metadata">

**Author:** [@javaripa](https://discuss.elastic.co/u/javaripa)\
**Replies:** 1\
**Last updated:** [January 14, 2023, 4:47pm UTC](https://discuss.elastic.co/t/elastic-agent-installation-options-for-aws-integration/323148 "2023-01-14T16:47:59Z")

</div>

I'm ready to setup AWS Integration on my existing Elastic Cloud deployment. As far as I can understand, I need to install an Elastic Agent on a specific host. Can I install it in AWS somehow? If yes, what are the avail…

---

## [Load Eland dataframe partially by query](https://discuss.elastic.co/t/load-eland-dataframe-partially-by-query/323180)

<div class="topic-metadata">

**Author:** [@mruiter](https://discuss.elastic.co/u/mruiter)\
**Replies:** 0\
**Last updated:** [January 14, 2023, 2:15pm UTC](https://discuss.elastic.co/t/load-eland-dataframe-partially-by-query/323180 "2023-01-14T14:15:13Z")

</div>

I'm trying to fetch data from Elasticsearch into an Eland dataframe partially, because it takes too much time to load the entire index. The following works, except for the \_query\_compiler. The official Eland docs contai…

---

## [Kibana Iframe Share Issue with Xframe and SameSite Cookie](https://discuss.elastic.co/t/kibana-iframe-share-issue-with-xframe-and-samesite-cookie/316824)

<div class="topic-metadata">

**Author:** [@hidanny](https://discuss.elastic.co/u/hidanny)\
**Replies:** 1\
**Last updated:** [October 24, 2022, 12:49pm UTC](https://discuss.elastic.co/t/kibana-iframe-share-issue-with-xframe-and-samesite-cookie/316824 "2022-10-24T12:49:34Z")

</div>

Hello all, This may be a super dumb question. For reference, I am using latest React and Google Chrome. Also, to note, this is working completely fine in Firefox. Just not in Google Chrome. Essentially, I am trying to …

---

## [Can an ID of an index be not null but empty?](https://discuss.elastic.co/t/can-an-id-of-an-index-be-not-null-but-empty/323167)

<div class="topic-metadata">

**Author:** [@Java2avaj](https://discuss.elastic.co/u/Java2avaj)\
**Replies:** 3\
**Last updated:** [January 14, 2023, 11:46am UTC](https://discuss.elastic.co/t/can-an-id-of-an-index-be-not-null-but-empty/323167 "2023-01-14T11:46:05Z")

</div>

Just a question if by default, an id of an index be empty string value “”? If yes, how to prevent from saving an empty id?

---

## [Plot a table based on aggregate key values](https://discuss.elastic.co/t/plot-a-table-based-on-aggregate-key-values/322635)

<div class="topic-metadata">

**Author:** [@Tukaram](https://discuss.elastic.co/u/Tukaram)\
**Replies:** 2\
**Last updated:** [January 14, 2023, 9:46am UTC](https://discuss.elastic.co/t/plot-a-table-based-on-aggregate-key-values/322635 "2023-01-14T09:46:35Z")

</div>

Hi and HNY! I am looking to put this kind of data every 30 minutes to Kibana under 1 index. data1- {key: 'key1', user: 'A', manager: 'C', cnt1: 2, cnt2:4} data2- {key: 'key2', user: 'B', manager: 'C', cnt1: 4, cnt2:5} …

---

## [Clarification on \`docs.deleted\` in regards to data deletion compliance requirements](https://discuss.elastic.co/t/clarification-on-docs-deleted-in-regards-to-data-deletion-compliance-requirements/323160)

<div class="topic-metadata">

**Author:** [@alee47](https://discuss.elastic.co/u/alee47)\
**Replies:** 1\
**Last updated:** [January 14, 2023, 9:26am UTC](https://discuss.elastic.co/t/clarification-on-docs-deleted-in-regards-to-data-deletion-compliance-requirements/323160 "2023-01-14T09:26:50Z")

</div>

My organization uses Elasticsearch to store and index information for one of our services. We have an internal compliance requirement to delete data whenever a user of our service requests their data to be deleted. In or…

---

## [Create visualize builder gauge using conditional value from document](https://discuss.elastic.co/t/create-visualize-builder-gauge-using-conditional-value-from-document/316371)

<div class="topic-metadata">

**Author:** [@carollyl](https://discuss.elastic.co/u/carollyl)\
**Replies:** 1\
**Last updated:** [October 24, 2022, 11:49am UTC](https://discuss.elastic.co/t/create-visualize-builder-gauge-using-conditional-value-from-document/316371 "2022-10-24T11:49:26Z")

</div>

I'd like to dynamically set the value for the gauge according to the source data. How do I access the source data that has a variable named 'func'. Appreciate your advice. if (params.\_source\['func'\] == 'secret1') { para…

---

## [Is it possible to remove the UUID appended by SLM policies to snapshot names?](https://discuss.elastic.co/t/is-it-possible-to-remove-the-uuid-appended-by-slm-policies-to-snapshot-names/323172)

<div class="topic-metadata">

**Author:** [@nvnsv](https://discuss.elastic.co/u/nvnsv)\
**Replies:** 0\
**Last updated:** [January 14, 2023, 4:21am UTC](https://discuss.elastic.co/t/is-it-possible-to-remove-the-uuid-appended-by-slm-policies-to-snapshot-names/323172 "2023-01-14T04:21:09Z")

</div>

Hello! I was able to get SLM implemented however, I saw that there is a UUID appended to each snapshot name. Is it possible to remove that UUID? my policy runs every four hours and its named to be exact to the second \<s…

---

## [Range Slider](https://discuss.elastic.co/t/range-slider/317068)

<div class="topic-metadata">

**Author:** [@linhz](https://discuss.elastic.co/u/linhz)\
**Replies:** 6\
**Last updated:** [October 24, 2022, 11:19am UTC](https://discuss.elastic.co/t/range-slider/317068 "2022-10-24T11:19:34Z")

</div>

Hi. Does the topic cover come with negative value for ranger slider. Anyone could share with me how to input the negative value or any documents? I have input a + value, but when input "-" it have the error status.

---

## [Detection rules - new installation](https://discuss.elastic.co/t/detection-rules-new-installation/323165)

<div class="topic-metadata">

**Author:** [@hobbyist](https://discuss.elastic.co/u/hobbyist)\
**Replies:** 1\
**Last updated:** [January 14, 2023, 1:57am UTC](https://discuss.elastic.co/t/detection-rules-new-installation/323165 "2023-01-14T01:57:38Z")

</div>

How do I enable the Detection Engine and import the baseline detection rules in Kibana? I installed the oss version of 7.10.2 on an ubuntu server version 22.04.

---

## [Signal status change time](https://discuss.elastic.co/t/signal-status-change-time/317301)

<div class="topic-metadata">

**Author:** [@Faycal\_B](https://discuss.elastic.co/u/Faycal_B)\
**Replies:** 0\
**Last updated:** [October 24, 2022, 9:12am UTC](https://discuss.elastic.co/t/signal-status-change-time/317301 "2022-10-24T09:12:35Z")

</div>

The signal api only return kibana.alert.workflow\_status field for the signal status change, is there a way to get a timestamp of the status change ?

---

## [Machine Learning (Anomaly Detection) Random Sampling Support](https://discuss.elastic.co/t/machine-learning-anomaly-detection-random-sampling-support/323158)

<div class="topic-metadata">

**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Replies:** 0\
**Last updated:** [January 13, 2023, 8:17pm UTC](https://discuss.elastic.co/t/machine-learning-anomaly-detection-random-sampling-support/323158 "2023-01-13T20:17:41Z")

</div>

Hi All, I was wondering if anyone knows if/how to use random sampling with machine learning anomaly detection? Use Case I would like to monitor data rates sent by various agents to various indices/data streams and wou…

---

## [Sign "+" was treated as wildcard in Elasticsearch API GET Search](https://discuss.elastic.co/t/sign-was-treated-as-wildcard-in-elasticsearch-api-get-search/323074)

<div class="topic-metadata">

**Author:** [@SooperTee](https://discuss.elastic.co/u/SooperTee)\
**Replies:** 2\
**Last updated:** [January 13, 2023, 6:20pm UTC](https://discuss.elastic.co/t/sign-was-treated-as-wildcard-in-elasticsearch-api-get-search/323074 "2023-01-13T18:20:07Z")

</div>

I was trying to access my Elasticsearch topic with API GET. please see below sample query. https://localhost:9200/my\_topic/\_search?pretty&q=trade.tradeType:"Delta +1" The problem with this search is that the result ret…

---

## [Logstash Plugin](https://discuss.elastic.co/t/logstash-plugin/323120)

<div class="topic-metadata">

**Author:** [@anik-27](https://discuss.elastic.co/u/anik-27)\
**Replies:** 8\
**Last updated:** [January 13, 2023, 5:25pm UTC](https://discuss.elastic.co/t/logstash-plugin/323120 "2023-01-13T17:25:38Z")

</div>

Hello friends, Is this possible to write a Logstash plugin for fetching data in Javascript just as we can do with Java ?

---

## [Log all queries from Kibana 8.3 with custom data](https://discuss.elastic.co/t/log-all-queries-from-kibana-8-3-with-custom-data/321424)

<div class="topic-metadata">

**Author:** [@Anthony\_Gaskins1](https://discuss.elastic.co/u/Anthony_Gaskins1)\
**Replies:** 0\
**Last updated:** [December 16, 2022, 5:50pm UTC](https://discuss.elastic.co/t/log-all-queries-from-kibana-8-3-with-custom-data/321424 "2022-12-16T17:50:29Z")

</div>

I want to make a plugin that captures all of the queries to elasticsearch and logs them with some custom information. How do I intercept the queries so I can add my info?

---

## [Docs discrepancy in 'Change the index name' vs filebeat.reference.yml](https://discuss.elastic.co/t/docs-discrepancy-in-change-the-index-name-vs-filebeat-reference-yml/323152)

<div class="topic-metadata">

**Author:** [@brsolomon](https://discuss.elastic.co/u/brsolomon)\
**Replies:** 0\
**Last updated:** [January 13, 2023, 3:58pm UTC](https://discuss.elastic.co/t/docs-discrepancy-in-change-the-index-name-vs-filebeat-reference-yml/323152 "2023-01-13T15:58:49Z")

</div>

From Change the index name | Filebeat Reference \[8.6\] | Elastic output.elasticsearch.index: "customname-%{\[agent.version\]}" setup.template.name: "customname" setup.template.pattern: "customname-%{\[agent.version\]}" From…

[Previous page](https://discuss.elastic.co/latest.md?page=820)

[Next page](https://discuss.elastic.co/latest.md?page=822)
