# Latest **URL:** https://discuss.elastic.co/latest.md?page=823 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 824 --- ## [Logstash are not running properly](https://discuss.elastic.co/t/logstash-are-not-running-properly/323002)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 7\ **Last updated:** [January 13, 2023, 4:26am UTC](https://discuss.elastic.co/t/logstash-are-not-running-properly/323002 "2023-01-13T04:26:42Z")
Hi team, We are trying to get the live logs from DEV Environment for testing.. But after started the Logstash (7.16.1) service, it through a error. Please check the below error. at RUBY.\(/usr/shar… --- ## [Kibana\_task\_manager ALLOCATION\_FAILED](https://discuss.elastic.co/t/kibana-task-manager-allocation-failed/323081)
**Author:** [@kohkaw](https://discuss.elastic.co/u/kohkaw)\ **Replies:** 0\ **Last updated:** [January 13, 2023, 3:09am UTC](https://discuss.elastic.co/t/kibana-task-manager-allocation-failed/323081 "2023-01-13T03:09:27Z")
Hi everyone. I am encountering an error on Elasticsearch 7.17.3 deployed with k8s where the shard assignment fails for Kibana\_task\_manager. GET \_cat/shards?v&h=index,shard,prirep,state,unassigned.reason&s=state:asc in… --- ## [Add "Save Query" as one of Kibana sub-feature privileges](https://discuss.elastic.co/t/add-save-query-as-one-of-kibana-sub-feature-privileges/319017)
**Author:** [@bandodkarD](https://discuss.elastic.co/u/bandodkarD)\ **Replies:** 4\ **Last updated:** [November 18, 2022, 8:15am UTC](https://discuss.elastic.co/t/add-save-query-as-one-of-kibana-sub-feature-privileges/319017 "2022-11-18T08:15:38Z")
Hi Team, Is this feature available in recent versions of Kibana? # Add "Save Query" as one of Kibana sub-feature privileges If not is there a way for users with Read Only access to save query? --- ## [\[apm\]\[Help\]transactionSampleRate set to low whether exception information will be missed](https://discuss.elastic.co/t/apm-help-transactionsamplerate-set-to-low-whether-exception-information-will-be-missed/322988)
**Author:** [@ntmxglrtayl03](https://discuss.elastic.co/u/ntmxglrtayl03)\ **Replies:** 2\ **Last updated:** [January 13, 2023, 1:40am UTC](https://discuss.elastic.co/t/apm-help-transactionsamplerate-set-to-low-whether-exception-information-will-be-missed/322988 "2023-01-13T01:40:32Z")
I wanted to optimize performance by setting the sampling rate, but I was worried that I would miss exception messages from the program --- ## [Elastic Agent Container - Secrets Management](https://discuss.elastic.co/t/elastic-agent-container-secrets-management/323067)
**Author:** [@MoreCowBell](https://discuss.elastic.co/u/MoreCowBell)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 11:28pm UTC](https://discuss.elastic.co/t/elastic-agent-container-secrets-management/323067 "2023-01-12T23:28:10Z")
I'm looking to further harden the security of passing secrets into the elastic agent configuration at runtime. I'm wondering if the following would work. Scenario: Integration: Azure Active Directory Sensitive Values: … --- ## [How are write requests handled to an index in the RED state](https://discuss.elastic.co/t/how-are-write-requests-handled-to-an-index-in-the-red-state/323044)
**Author:** [@alee47](https://discuss.elastic.co/u/alee47)\ **Replies:** 2\ **Last updated:** [January 12, 2023, 10:20pm UTC](https://discuss.elastic.co/t/how-are-write-requests-handled-to-an-index-in-the-red-state/323044 "2023-01-12T22:20:52Z")
Hello, My organization uses Elasticsearch to power one of our services and regularly receive write requests into our cluster. We use the routing parameter on all search and write requests, so they are directed to a sing… --- ## [Is it possible to count elements of an array of two levels? array of arrays](https://discuss.elastic.co/t/is-it-possible-to-count-elements-of-an-array-of-two-levels-array-of-arrays/323047)
**Author:** [@jcornejo](https://discuss.elastic.co/u/jcornejo)\ **Replies:** 2\ **Last updated:** [January 12, 2023, 9:40pm UTC](https://discuss.elastic.co/t/is-it-possible-to-count-elements-of-an-array-of-two-levels-array-of-arrays/323047 "2023-01-12T21:40:46Z")
I need to count the elements of the campaign\_promotions.promotion\_prices array it's possible? "hits" : \[ { "\_index" : "dev\_scrap\_campaigns", "\_type" : "\_doc", "\_id" : "2t0k7oQBF4RU85fFCPX\_… --- ## [Missing authentication credentials when visiting localhost:9200 after running elasticsearch.bat](https://discuss.elastic.co/t/missing-authentication-credentials-when-visiting-localhost-9200-after-running-elasticsearch-bat/323018)
**Author:** [@Arthur\_Medforth](https://discuss.elastic.co/u/Arthur_Medforth)\ **Replies:** 2\ **Last updated:** [January 12, 2023, 9:21pm UTC](https://discuss.elastic.co/t/missing-authentication-credentials-when-visiting-localhost-9200-after-running-elasticsearch-bat/323018 "2023-01-12T21:21:30Z")
{"error":{"root\_cause":\[{"type":"security\_exception","reason":"missing authentication credentials for REST request \[/\]","header":{"WWW-Authenticate":\["Basic realm="security" charset="UTF-8"","ApiKey"\]}}\],"type":"security… --- ## [ElasticSearch 7.15.1 / Unhappy Cluster](https://discuss.elastic.co/t/elasticsearch-7-15-1-unhappy-cluster/322974)
**Author:** [@Devin\_Acosta](https://discuss.elastic.co/u/Devin_Acosta)\ **Replies:** 5\ **Last updated:** [January 12, 2023, 9:19pm UTC](https://discuss.elastic.co/t/elasticsearch-7-15-1-unhappy-cluster/322974 "2023-01-12T21:19:20Z")
I am trying to troubleshoot an Elasticsearch 7.15.1 cluster that has 3 master nodes, and 30+ data nodes. Recently we have seen where data nodes are complaining about "master not discovered yet" after the nodes have been … --- ## [Kibana can't connect to package directory](https://discuss.elastic.co/t/kibana-cant-connect-to-package-directory/316919)
**Author:** [@jpedroza2k20](https://discuss.elastic.co/u/jpedroza2k20)\ **Replies:** 5\ **Last updated:** [October 21, 2022, 1:53pm UTC](https://discuss.elastic.co/t/kibana-cant-connect-to-package-directory/316919 "2022-10-21T13:53:01Z")
I have seen this same issue on the forums twice (English and French) and there is no resolution listed. I get the following error: I can access the URL from the server in question (self hosted stack) and there is no … --- ## [How to make a blank space query?](https://discuss.elastic.co/t/how-to-make-a-blank-space-query/323062)
**Author:** [@sanil](https://discuss.elastic.co/u/sanil)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 8:57pm UTC](https://discuss.elastic.co/t/how-to-make-a-blank-space-query/323062 "2023-01-12T20:57:33Z")
Hey everyone, I am trying to make an Elasticsearch request with a blank space as the query. The query should literally be a blank space as such: " ". For example, the query looks like this : {query": ( ) OR (\* ). Howe… --- ## [Elastic Endpoint - Questionable snaps causing problems](https://discuss.elastic.co/t/elastic-endpoint-questionable-snaps-causing-problems/322582)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 3\ **Last updated:** [January 12, 2023, 8:48pm UTC](https://discuss.elastic.co/t/elastic-endpoint-questionable-snaps-causing-problems/322582 "2023-01-12T20:48:43Z")
Why is Endpoint creating snap shots on Windows Server 2016/19? This started with 8.5.1+ and has seriously messed up some of my legacy backups that relay on the windows snap shots manager to process. I've had several fail… --- ## [Compute a ratio of one-to-many sum aggregated values](https://discuss.elastic.co/t/compute-a-ratio-of-one-to-many-sum-aggregated-values/323058)
**Author:** [@fzar](https://discuss.elastic.co/u/fzar)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 8:12pm UTC](https://discuss.elastic.co/t/compute-a-ratio-of-one-to-many-sum-aggregated-values/323058 "2023-01-12T20:12:21Z")
hey, I am trying to compute a ratio of one-to-many sum aggregated values - obtained via a filters aggregation - against a top-level sum aggregated value without luck. Basically I want to compute a score for all docs (su… --- ## [Error making http request](https://discuss.elastic.co/t/error-making-http-request/323056)
**Author:** [@Myagmarsuren-a](https://discuss.elastic.co/u/Myagmarsuren-a)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 7:19pm UTC](https://discuss.elastic.co/t/error-making-http-request/323056 "2023-01-12T19:19:09Z")
I have issue. I added elastic-agent as fleet server. Also i installed elasticsearch and kibana using docker-compose. Then i wanted to monitor my kubernetes cluster with elastic agent with kubernetes integration in it. Wh… --- ## [ES is allocating indexes that are hot to nodes in the cold tier](https://discuss.elastic.co/t/es-is-allocating-indexes-that-are-hot-to-nodes-in-the-cold-tier/322972)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 9\ **Last updated:** [January 12, 2023, 7:07pm UTC](https://discuss.elastic.co/t/es-is-allocating-indexes-that-are-hot-to-nodes-in-the-cold-tier/322972 "2023-01-12T19:07:20Z")
I can't figure out how to diagnose what is happening here. I am using a hot/warm/cold data tier model but ES keeps allocating indexes to my overloaded cold tier when they are still in the hot phase (being actively writt… --- ## [Bucket\_path for array key](https://discuss.elastic.co/t/bucket-path-for-array-key/323052)
**Author:** [@rbrc](https://discuss.elastic.co/u/rbrc)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 6:44pm UTC](https://discuss.elastic.co/t/bucket-path-for-array-key/323052 "2023-01-12T18:44:45Z")
I'm doing some agg queries against indexes where each doc has a locationId, and using a terms agg on that locationId to bucket the results. The problem is I want the NAME for that location, so I'm also doing a filter agg… --- ## [Event creation and processing times differ](https://discuss.elastic.co/t/event-creation-and-processing-times-differ/323051)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 5:45pm UTC](https://discuss.elastic.co/t/event-creation-and-processing-times-differ/323051 "2023-01-12T17:45:27Z")
Hi, let's talk about the config first: elk 7.17.5 (8 cpu, 20 ram, 2.5T disk space) and another host with filebeat 7.17.8 with zeek and suricata module enabled. I am using suricata and zeek as ids, i noticed that suricat… --- ## [Network Scan](https://discuss.elastic.co/t/network-scan/322835)
**Author:** [@Gurban](https://discuss.elastic.co/u/Gurban)\ **Replies:** 5\ **Last updated:** [January 12, 2023, 5:43pm UTC](https://discuss.elastic.co/t/network-scan/322835 "2023-01-12T17:43:35Z")
How should I write Elastic rule that detect if more than 10 unique destinations were accessed from same source IP within 1 minutes. Best Regards --- ## [Cisco IOS Elastic-agent no longer retrieving data](https://discuss.elastic.co/t/cisco-ios-elastic-agent-no-longer-retrieving-data/323050)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 5:31pm UTC](https://discuss.elastic.co/t/cisco-ios-elastic-agent-no-longer-retrieving-data/323050 "2023-01-12T17:31:23Z")
After the recent update to the Cisco 1.11.0 elastic agent, data is no longer being processed from the connected Cisco devices. In version 1.10.0 this was working. When looking at netstat on the device that should be rec… --- ## [Aggregate document and "cumulate" fields](https://discuss.elastic.co/t/aggregate-document-and-cumulate-fields/323046)
**Author:** [@Fariddev](https://discuss.elastic.co/u/Fariddev)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 5:00pm UTC](https://discuss.elastic.co/t/aggregate-document-and-cumulate-fields/323046 "2023-01-12T17:00:15Z")
Hi, i would like to know if it's possible to aggregate documents and cumulate other fields in an array like this : Documents : { "type": "fruit", "article": "apple", "price": 5 } { "type": "fruit", "article"… --- ## [5.4 observability Custom Logs is not using the custom configuration my\_mysql\_pipeline](https://discuss.elastic.co/t/5-4-observability-custom-logs-is-not-using-the-custom-configuration-my-mysql-pipeline/323045)
**Author:** [@Jsarath](https://discuss.elastic.co/u/Jsarath)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 5:00pm UTC](https://discuss.elastic.co/t/5-4-observability-custom-logs-is-not-using-the-custom-configuration-my-mysql-pipeline/323045 "2023-01-12T17:00:12Z")
I have deleted and tried to enter the custom log with the custom config of pipeline: my\_mysql\_pipeline. It is supposed to not show the message field, but it still is when I go to Log streamline. Any idea why this is happ… --- ## [Filebeat ERROR x509: certificate signed by unknown authority](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 24\ **Last updated:** [January 12, 2023, 4:38pm UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861 "2023-01-12T16:38:15Z")
Hi! in my filebeat.yaml I configured output.elasticsearch: section like this tyoutput.elasticsearch: # Array of hosts to connect to. hosts: \["10.142.77.174:9200"\] # Protocol - either \`http\` (default) or \`https\`… --- ## [Space and data retention question](https://discuss.elastic.co/t/space-and-data-retention-question/322403)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 11\ **Last updated:** [January 12, 2023, 4:20pm UTC](https://discuss.elastic.co/t/space-and-data-retention-question/322403 "2023-01-12T16:20:47Z")
Good Afternoon and Happy New Year to all my Elastic Stack friends and Guru's. I have been having an issue with my Elasticsearch and syslog retention. In the /var/lib/elasticsearch/log folder I have 4.3 Terrabytes of sp… --- ## [Rollup index name with date math](https://discuss.elastic.co/t/rollup-index-name-with-date-math/317161)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 0\ **Last updated:** [October 21, 2022, 3:30am UTC](https://discuss.elastic.co/t/rollup-index-name-with-date-math/317161 "2022-10-21T03:30:19Z")
Hello, i tried to create rollup index in rollup job with rollup index name using date math, example of index name: my-log-%{+YYYY.MM.dd}, but kibana returned "Request failed with a 500 error. runtime\_exception: Could not… --- ## [Unable to access nested fields in vegalite](https://discuss.elastic.co/t/unable-to-access-nested-fields-in-vegalite/322551)
**Author:** [@pridhvi\_raj](https://discuss.elastic.co/u/pridhvi_raj)\ **Replies:** 1\ **Last updated:** [January 12, 2023, 3:03pm UTC](https://discuss.elastic.co/t/unable-to-access-nested-fields-in-vegalite/322551 "2023-01-12T15:03:17Z")
I am working on a dataset it contains application\_Id, status of each application and date columns and for each application\_Id representing its status as(start,declined,inProgress). I need to get the latest row of each a… --- ## [Exclude logs on kibana](https://discuss.elastic.co/t/exclude-logs-on-kibana/322968)
**Author:** [@khadija70](https://discuss.elastic.co/u/khadija70)\ **Replies:** 2\ **Last updated:** [January 12, 2023, 2:22pm UTC](https://discuss.elastic.co/t/exclude-logs-on-kibana/322968 "2023-01-12T14:22:15Z")
Hi , I need to exclude some logs , and stop showing them on kibana , those logs are based on a filter like : aut . All the logs containing a word on the filter have not to be shown on kibana . Could you please provi… --- ## [Kibana problem visualize scripted fields](https://discuss.elastic.co/t/kibana-problem-visualize-scripted-fields/322934)
**Author:** [@Anonym123](https://discuss.elastic.co/u/Anonym123)\ **Replies:** 6\ **Last updated:** [January 12, 2023, 2:01pm UTC](https://discuss.elastic.co/t/kibana-problem-visualize-scripted-fields/322934 "2023-01-12T14:01:27Z")
Hello im trying to convert an integer field like "1,676,274,668" to an Date/Datetime field and visualize it afterwards with Kibana. I use a scripted field which can be seen on the next picture. Here everything look… --- ## [Which port is my logstash using?](https://discuss.elastic.co/t/which-port-is-my-logstash-using/323021)
**Author:** [@waitangi](https://discuss.elastic.co/u/waitangi)\ **Replies:** 3\ **Last updated:** [January 12, 2023, 1:41pm UTC](https://discuss.elastic.co/t/which-port-is-my-logstash-using/323021 "2023-01-12T13:41:15Z")
Hello all I have a running server where logstash is working. In my pipelines.yml there's a line path.config: "/etc/logstash/conf.d/\*.conf" - this points to a directory where my configuration is. The directory contains … --- ## [Kibana bar chart colours are different from saved](https://discuss.elastic.co/t/kibana-bar-chart-colours-are-different-from-saved/322767)
**Author:** [@KristinaRaja](https://discuss.elastic.co/u/KristinaRaja)\ **Replies:** 11\ **Last updated:** [January 12, 2023, 1:22pm UTC](https://discuss.elastic.co/t/kibana-bar-chart-colours-are-different-from-saved/322767 "2023-01-12T13:22:15Z")
Wondering if anyone can answer this question and maybe help guide me in the right direction... Our product leverages Kibana within an iframe and we are on version 7.17.6 cloud. In the dashboards that we've built, we a… --- ## [Kibana - Changing the color/font of Aggregation/Lens Bar Chart?](https://discuss.elastic.co/t/kibana-changing-the-color-font-of-aggregation-lens-bar-chart/322936)
**Author:** [@mohammedniyaz](https://discuss.elastic.co/u/mohammedniyaz)\ **Replies:** 3\ **Last updated:** [January 12, 2023, 1:18pm UTC](https://discuss.elastic.co/t/kibana-changing-the-color-font-of-aggregation-lens-bar-chart/322936 "2023-01-12T13:18:59Z")
Hi Team, In Kibana 8.5 Version - I'm using lens/Aggregate Bar chart to visualize my data. I want to change the color/font of those X-Axis & Y-Axis available in the widget. Is that possible to change ? [Previous page](https://discuss.elastic.co/latest.md?page=822) [Next page](https://discuss.elastic.co/latest.md?page=824)