# Latest **URL:** https://discuss.elastic.co/latest.md?page=857 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 858 --- ## [Show first record of each group](https://discuss.elastic.co/t/show-first-record-of-each-group/319446)
**Author:** [@johnnyh](https://discuss.elastic.co/u/johnnyh)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 7:41am UTC](https://discuss.elastic.co/t/show-first-record-of-each-group/319446 "2022-12-15T07:41:21Z")
Hi guys, I have been trying to find a way perform group by, and then obtaining the first of each group. This set should also be filterable and sort-able, and should also be able to count each group. Wondering if what I… --- ## [FOR Weekly Index ISM Policy](https://discuss.elastic.co/t/for-weekly-index-ism-policy/321255)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 6:43am UTC](https://discuss.elastic.co/t/for-weekly-index-ism-policy/321255 "2022-12-15T06:43:14Z")
Hello Guys I am using Elasticsearch 7.10.2 I have 6 Data node Cluster in this Cluster I am Facing Space Issue so I set Index Policy for Daily Index but I am having Monthly and Weekly Index I want setup Automatically Del… --- ## [Windows event logs into the ECS format](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002)
**Author:** [@alex\_su](https://discuss.elastic.co/u/alex_su)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 5:53am UTC](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002 "2022-12-15T05:53:57Z")
Hello, I want to ask how to use python convert windows event logs into the ECS format. not use beats or logstash method. --- ## [Unable to Connect to ElasticSearch](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch/321254)
**Author:** [@makarand](https://discuss.elastic.co/u/makarand)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 5:51am UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch/321254 "2022-12-15T05:51:39Z")
Hi guys can you please look into this? It is taking too much of my time. This is an error regarding connection from nodeJs client to Elasticsearch. Trying to connect to elasticsearch domain using lambda and elasticse… --- ## [Authenticating with built-in users](https://discuss.elastic.co/t/authenticating-with-built-in-users/321246)
**Author:** [@zirota](https://discuss.elastic.co/u/zirota)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 4:55am UTC](https://discuss.elastic.co/t/authenticating-with-built-in-users/321246 "2022-12-15T04:55:08Z")
Hello, I ran into some problems with authenticating with built-in users (in this case elastic) on my cluster nodes other than the master. I have a cluster setup on 8.5.3: 3 master nodes 4 data nodes 2 coordinator node… --- ## [Circle radius propblem v8.5.3](https://discuss.elastic.co/t/circle-radius-propblem-v8-5-3/321091)
**Author:** [@Dat\_Le\_Tien](https://discuss.elastic.co/u/Dat_Le_Tien)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 3:08am UTC](https://discuss.elastic.co/t/circle-radius-propblem-v8-5-3/321091 "2022-12-15T03:08:52Z")
I'm trying to insert a location that is using a circle processor to generate the circle points. Location \[30, 10\] in the document is generated with the circle points properly. docs: Circle processor | Elasticsearch Guid… --- ## [\--ca-sha256 not working for Elastic Agent enrollment; error reported: "fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority"](https://discuss.elastic.co/t/ca-sha256-not-working-for-elastic-agent-enrollment-error-reported-fail-to-enroll-fail-to-execute-request-to-fleet-server-x509-certificate-signed-by-unknown-authority/320270)
**Author:** [@username11](https://discuss.elastic.co/u/username11)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 12:54am UTC](https://discuss.elastic.co/t/ca-sha256-not-working-for-elastic-agent-enrollment-error-reported-fail-to-enroll-fail-to-execute-request-to-fleet-server-x509-certificate-signed-by-unknown-authority/320270 "2022-12-15T00:54:18Z")
Hi. I am currently working on deploying Fleet + Elastic Agent in a test-ish environment. I've had success in enrolling the agents into Fleet as follows: sudo ./elastic-agent install --url=https://fleet1.local:8220 --enr… --- ## [Exporting data from a visualization](https://discuss.elastic.co/t/exporting-data-from-a-visualization/320976)
**Author:** [@zivza](https://discuss.elastic.co/u/zivza)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 12:14am UTC](https://discuss.elastic.co/t/exporting-data-from-a-visualization/320976 "2022-12-15T00:14:52Z")
Hi, I'm new to Kibana, and I need to export some data from a table visualization (pull it once in a while, with the current time), using python. What I actually want, is basically a csv or a JSONI can turn to a pandas … --- ## [Edit protection for Kibana visuals or dashboards](https://discuss.elastic.co/t/edit-protection-for-kibana-visuals-or-dashboards/321238)
**Author:** [@Buddha](https://discuss.elastic.co/u/Buddha)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 12:04am UTC](https://discuss.elastic.co/t/edit-protection-for-kibana-visuals-or-dashboards/321238 "2022-12-15T00:04:07Z")
Hello, I was wondering if there was a way to protect Kibana visuals or dashboards from being edited? Even sending a warning if they open the object to not to edit it would be the bare minimal. Mike --- ## [Suricata filebeat logs not real time](https://discuss.elastic.co/t/suricata-filebeat-logs-not-real-time/321045)
**Author:** [@Adilla\_Rhiskani](https://discuss.elastic.co/u/Adilla_Rhiskani)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 2:57pm UTC](https://discuss.elastic.co/t/suricata-filebeat-logs-not-real-time/321045 "2022-12-12T14:57:00Z")
I have setup new cluster elasticsearch for IDS using suricata , I have set JVM for ingest, master, data01, data02 each 2GB. but when I start file beat I got this error {"log.level":"info","@timestamp":"2022-12-12T14:50:… --- ## [Python ZOPE Application Framework Integration to Elastic APM](https://discuss.elastic.co/t/python-zope-application-framework-integration-to-elastic-apm/315277)
**Author:** [@Dixit](https://discuss.elastic.co/u/Dixit)\ **Replies:** 52\ **Last updated:** [December 14, 2022, 11:53pm UTC](https://discuss.elastic.co/t/python-zope-application-framework-integration-to-elastic-apm/315277 "2022-12-14T23:53:51Z")
@lwintergerst @Bansriyar @ravindra ramnanani @rajesh @rajesh.balakrishnan@elastic.co Usecase – We are integrating the APM soln to our Product Ecosystem which involved Python, Messaging systems & DB. We have achieved 5… --- ## [Elasticsearch 8.5.3 ECK Services](https://discuss.elastic.co/t/elasticsearch-8-5-3-eck-services/321181)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 4:58am UTC](https://discuss.elastic.co/t/elasticsearch-8-5-3-eck-services/321181 "2022-12-14T04:58:40Z")
There are 4 kubernetes Services in the cluster: -es-data ClusterIP None \ 9200/TCP 22h -es-http ClusterIP 172.20.88.236 \ 9200/TCP 22h -es-i… --- ## [Automatically remove old reports](https://discuss.elastic.co/t/automatically-remove-old-reports/321201)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 2\ **Last updated:** [December 14, 2022, 11:46pm UTC](https://discuss.elastic.co/t/automatically-remove-old-reports/321201 "2022-12-14T23:46:22Z")
Hi the community. I've alerters that generates multiple report once per week sent per mail automatically. Reports older than 2 weeks are not necessary and I want to be able to setup an automatic cleaning of those report… --- ## [Caused by: javax.net.ssl.SSLHandshakeException: No available authentication scheme](https://discuss.elastic.co/t/caused-by-javax-net-ssl-sslhandshakeexception-no-available-authentication-scheme/321207)
**Author:** [@hello5346](https://discuss.elastic.co/u/hello5346)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 10:34am UTC](https://discuss.elastic.co/t/caused-by-javax-net-ssl-sslhandshakeexception-no-available-authentication-scheme/321207 "2022-12-14T10:34:30Z")
we have started a new ealsticsearch 3 node cluster with the following yaml. cluster.name: elk-aws node.name: ip-10-22-221-24 node.master: true node.data: true path.logs: /var/log/elasticsearch network.host: 10.22.221.2… --- ## [Getting data from lagging database](https://discuss.elastic.co/t/getting-data-from-lagging-database/321244)
**Author:** [@raunakraje](https://discuss.elastic.co/u/raunakraje)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 9:46pm UTC](https://discuss.elastic.co/t/getting-data-from-lagging-database/321244 "2022-12-14T21:46:51Z")
Hi Guys, I have 2 MSSQL databases a Production db(A) and a Backup db (B). Data from Production DB gets updated in Backup DB with a lag of 15 mins. I am trying to get data from Backup DB but due to this lag I am unable t… --- ## [IIS module under filebeat not populating fields in discover](https://discuss.elastic.co/t/iis-module-under-filebeat-not-populating-fields-in-discover/321242)
**Author:** [@Priya\_Vardhan](https://discuss.elastic.co/u/Priya_Vardhan)\ **Replies:** 7\ **Last updated:** [December 14, 2022, 11:22pm UTC](https://discuss.elastic.co/t/iis-module-under-filebeat-not-populating-fields-in-discover/321242 "2022-12-14T23:22:40Z")
Hi All, I have enabled IIS module under filebeat after providing the log path for both access and error. I can see the IIS fields getting loaded in filebeat index, but it is not showing in discover. The data is not av… --- ## [Dec 15th, 2022: \[EN\] NLP: Using a Question Answering model to talk to your favorite Christmas song](https://discuss.elastic.co/t/dec-15th-2022-en-nlp-using-a-question-answering-model-to-talk-to-your-favorite-christmas-song/321125)
**Author:** [@Priscilla\_Parodi](https://discuss.elastic.co/u/Priscilla_Parodi)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 11:00pm UTC](https://discuss.elastic.co/t/dec-15th-2022-en-nlp-using-a-question-answering-model-to-talk-to-your-favorite-christmas-song/321125 "2022-12-14T23:00:00Z")
Natural language processing (NLP) is the branch of artificial intelligence (AI) that aims to understand human language as close as possible to human interpretation by combining computational linguistics with statistic… --- ## [Add Metric Aggregation inside the bucket aggregation query to get metrics of all buckets using DSL Query](https://discuss.elastic.co/t/add-metric-aggregation-inside-the-bucket-aggregation-query-to-get-metrics-of-all-buckets-using-dsl-query/321217)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 7:27pm UTC](https://discuss.elastic.co/t/add-metric-aggregation-inside-the-bucket-aggregation-query-to-get-metrics-of-all-buckets-using-dsl-query/321217 "2022-12-14T19:27:39Z")
Hi, I am able to get bucket aggregation results for below DSL Query,But I want to get metric aggregation for all buckets inside the same bucket aggregation query. Bucket aggrgation query: { "size": 0, "query":… --- ## [Can I run multiple Elasticsearch instances in one server?](https://discuss.elastic.co/t/can-i-run-multiple-elasticsearch-instances-in-one-server/321230)
**Author:** [@Lakshmi\_Kumari](https://discuss.elastic.co/u/Lakshmi_Kumari)\ **Replies:** 3\ **Last updated:** [December 14, 2022, 5:50pm UTC](https://discuss.elastic.co/t/can-i-run-multiple-elasticsearch-instances-in-one-server/321230 "2022-12-14T17:50:50Z")
Can I run multiple Elasticsearch instances in one server? -If yes, How can I install 2 Elasticsearch instances in a single Linux server. I am aware if we use "yum install" will be installed without any issue. Thanks i… --- ## [Abnormal Datafeeding detected in Anomaly Detection Jobs](https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 5:47pm UTC](https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672 "2022-12-14T17:47:58Z")
Hi Team, There are a couple of machine learning jobs currently running in our ELK environment. With this, we have configured watcher alerts also, based on the record-level anomaly score. Since a few days back, we've bee… --- ## [Metricbeats reported version mismatch](https://discuss.elastic.co/t/metricbeats-reported-version-mismatch/321071)
**Author:** [@serge1](https://discuss.elastic.co/u/serge1)\ **Replies:** 6\ **Last updated:** [December 14, 2022, 5:17pm UTC](https://discuss.elastic.co/t/metricbeats-reported-version-mismatch/321071 "2022-12-14T17:17:00Z")
Hello! I'm installing beats v. 8.5.1 on my machines. When I query installed version with /var/lib/metricbeat/metricbeat version, it reports itself as 8.5.1. However in Humio where I ship the metrics, Agent version is po… --- ## [Scrollbar disappeared in Vega](https://discuss.elastic.co/t/scrollbar-disappeared-in-vega/320428)
**Author:** [@victorhmorales](https://discuss.elastic.co/u/victorhmorales)\ **Replies:** 3\ **Last updated:** [December 14, 2022, 5:05pm UTC](https://discuss.elastic.co/t/scrollbar-disappeared-in-vega/320428 "2022-12-14T17:05:59Z")
Hello, I'm using a graphic developed in Vega in my Dashboard. The "autosize" property is set to "fit-x". It used to show a vertical scrollbar when I was running Elastic 8.3, but since I upgraded to 8.4 and now to 8.5 (8… --- ## [Logstash jdbc input state](https://discuss.elastic.co/t/logstash-jdbc-input-state/321192)
**Author:** [@Mahdi\_Moazami](https://discuss.elastic.co/u/Mahdi_Moazami)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 3:43pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-state/321192 "2022-12-14T15:43:48Z")
Hi there elastic team, Suppose i have multiple pipelines each with one jdbc input. each of them execute a sql query that uses the value of sql\_last\_value to fetch only updated data and each pipeline file targets a speci… --- ## [How to access Kibana in different VM](https://discuss.elastic.co/t/how-to-access-kibana-in-different-vm/321224)
**Author:** [@Vivek\_Arumugam](https://discuss.elastic.co/u/Vivek_Arumugam)\ **Replies:** 3\ **Last updated:** [December 14, 2022, 3:37pm UTC](https://discuss.elastic.co/t/how-to-access-kibana-in-different-vm/321224 "2022-12-14T15:37:19Z")
Hi Team, I have installed Kibana and Elasticsearch in server. I am able access Kibana in same machine. But in different VM it not working. Please help me out --- ## [Log collector solution](https://discuss.elastic.co/t/log-collector-solution/320964)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 2\ **Last updated:** [December 14, 2022, 3:32pm UTC](https://discuss.elastic.co/t/log-collector-solution/320964 "2022-12-14T15:32:48Z")
Hi TL;DR: need log collector for file with minimum configuration, and support different conditions. I have 3 servers that generate log file daily with size about 12GB (12\*3=36GB) How can I gather these files on centra… --- ## [Filebeat Docker - Elasticsearch Host Issue](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083)
**Author:** [@mwsprotte](https://discuss.elastic.co/u/mwsprotte)\ **Replies:** 6\ **Last updated:** [December 14, 2022, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083 "2022-12-14T15:18:04Z")
Hello Everyone! I'm trying to run Filebeat in a Docker Container folowing this documentation: https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html#\_run\_the\_filebeat\_setup but in the second step, … --- ## [Drill down in bar vertical stacked in Lens Visuaization gives incorrect output from the parent dashboard](https://discuss.elastic.co/t/drill-down-in-bar-vertical-stacked-in-lens-visuaization-gives-incorrect-output-from-the-parent-dashboard/320627)
**Author:** [@Diya\_19](https://discuss.elastic.co/u/Diya_19)\ **Replies:** 3\ **Last updated:** [December 14, 2022, 2:08pm UTC](https://discuss.elastic.co/t/drill-down-in-bar-vertical-stacked-in-lens-visuaization-gives-incorrect-output-from-the-parent-dashboard/320627 "2022-12-14T14:08:45Z")
I have created a bar vertical stacked graph to get the response status codes (HTTP 200s, 300s, 400s and 500s). I have applied a drill down through which we can filter through the http code in the drill down dashboard whi… --- ## [How to aggregate data across multiple fields?](https://discuss.elastic.co/t/how-to-aggregate-data-across-multiple-fields/318943)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 4\ **Last updated:** [November 16, 2022, 3:14pm UTC](https://discuss.elastic.co/t/how-to-aggregate-data-across-multiple-fields/318943 "2022-11-16T15:14:59Z")
Hi! I'm fairly new to Kibana. I'm trying to perform data aggregation across multiple fields, but don't seem to be approaching the problem the right way. Example use case: I have data about house prices. E.g. house "a" … --- ## [Unable to enable saml for cloud deployment with Azure](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517)
**Author:** [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\ **Replies:** 4\ **Last updated:** [December 14, 2022, 1:33pm UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517 "2022-12-14T13:33:38Z")
Hello There, I am trying to enable saml for cloud deployment running with 8.3.2 version by following the below docs As a first step I am trying to add the below configuration in elasticsearch yml file. xpack.securi… --- ## [Recompute event.hash for documents in cold indices](https://discuss.elastic.co/t/recompute-event-hash-for-documents-in-cold-indices/321203)
**Author:** [@ivo.raisr](https://discuss.elastic.co/u/ivo.raisr)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 9:55am UTC](https://discuss.elastic.co/t/recompute-event-hash-for-documents-in-cold-indices/321203 "2022-12-14T09:55:42Z")
For certain datasets which contain important log events, logstash pipeline computes event.hash, using fingerprint filter with SHA256 method and a key, over all the event fields. The events are then ingested into elastics… [Previous page](https://discuss.elastic.co/latest.md?page=856) [Next page](https://discuss.elastic.co/latest.md?page=858)