# Latest **URL:** https://discuss.elastic.co/latest.md?page=865 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 866 --- ## [Infinite extent for field “amount”: \[Infinity, -Infinity\]](https://discuss.elastic.co/t/infinite-extent-for-field-amount-infinity-infinity/319876)
**Author:** [@sieky](https://discuss.elastic.co/u/sieky)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 7:26pm UTC](https://discuss.elastic.co/t/infinite-extent-for-field-amount-infinity-infinity/319876 "2022-12-08T19:26:46Z")
I am a new to vega.I just follow vega website's tutorials and create a bar chart sucessfully.But,when I replace data source: "data": \[ { "name": "table", "values": \[ {"category": "A", "amount": 28}, {"category": "B", "a… --- ## [Is there an easy way to manage custom ingest pipeline and custom fields for Elastic Agent Integrations?](https://discuss.elastic.co/t/is-there-an-easy-way-to-manage-custom-ingest-pipeline-and-custom-fields-for-elastic-agent-integrations/319682)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 7:01pm UTC](https://discuss.elastic.co/t/is-there-an-easy-way-to-manage-custom-ingest-pipeline-and-custom-fields-for-elastic-agent-integrations/319682 "2022-12-08T19:01:37Z")
Hello, We are trying to find a way to manage custom ingest pipelines and fields/mappings for our integrations. As an example, we are using the Cisco Duo integration, this integration has the following ingest pipelines. … --- ## [Extract logs from the message field and create new separate runtime fields](https://discuss.elastic.co/t/extract-logs-from-the-message-field-and-create-new-separate-runtime-fields/320670)
**Author:** [@Ajmal\_Khalil](https://discuss.elastic.co/u/Ajmal_Khalil)\ **Replies:** 19\ **Last updated:** [December 8, 2022, 6:58pm UTC](https://discuss.elastic.co/t/extract-logs-from-the-message-field-and-create-new-separate-runtime-fields/320670 "2022-12-08T18:58:03Z")
Hi everyone, I'm using ELK stack version 8.4.0 and i need to extract logs data from message field that is something like "ERRORS" "EXCEPTIONS" etc and i want a new field for every extracted value so that i can easily cr… --- ## [Kibana not accessible in browser after allowing port in firewall-cmd](https://discuss.elastic.co/t/kibana-not-accessible-in-browser-after-allowing-port-in-firewall-cmd/316526)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 10:46pm UTC](https://discuss.elastic.co/t/kibana-not-accessible-in-browser-after-allowing-port-in-firewall-cmd/316526 "2022-10-13T22:46:18Z")
Hello, i have installed kibana in remote host from ssh. I tried curl from the host and it succeed. I tried to access it from browser, but it said ERR\_CONNECTION\_TIMED\_OUT. here is my firewalld # firewall-cmd --list-… --- ## [How query\_string work underlying](https://discuss.elastic.co/t/how-query-string-work-underlying/320807)
**Author:** [@hieple18](https://discuss.elastic.co/u/hieple18)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 6:01pm UTC](https://discuss.elastic.co/t/how-query-string-work-underlying/320807 "2022-12-08T18:01:52Z")
I am trying to figure out how query\_string work underlying. cause I want to compare performance of using query\_string with other solution I tried to deep dive into source code but no answer example I have a query { … --- ## [How to expose "demo" ECK elastic/kibana services on Kubernetes? loadbalancer?](https://discuss.elastic.co/t/how-to-expose-demo-eck-elastic-kibana-services-on-kubernetes-loadbalancer/320492)
**Author:** [@timb33](https://discuss.elastic.co/u/timb33)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 5:31pm UTC](https://discuss.elastic.co/t/how-to-expose-demo-eck-elastic-kibana-services-on-kubernetes-loadbalancer/320492 "2022-12-08T17:31:34Z")
Hi, I've following the quickstart demo (Quickstart | Elastic Cloud on Kubernetes \[2.5\] | Elastic) and have an ES I can port-forward to,but I want to be able to access my ES instance using e.g. a loadbalancer. Usually, I… --- ## [Connect filebeat to logstash](https://discuss.elastic.co/t/connect-filebeat-to-logstash/320399)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 5\ **Last updated:** [December 8, 2022, 5:00pm UTC](https://discuss.elastic.co/t/connect-filebeat-to-logstash/320399 "2022-12-08T17:00:30Z")
Hi! created openssl keys and copied to filebeat host in /etc/ssl/ folder: \[root@fbeat ssl\]# ls -l total 8 lrwxrwxrwx. 1 root root 16 Oct 23 20:02 certs -\> ../pki/tls/certs -rw-r--r--. 1 root root 1704 Nov 28 23:46 l… --- ## [Jboss logs module](https://discuss.elastic.co/t/jboss-logs-module/320813)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 4:59pm UTC](https://discuss.elastic.co/t/jboss-logs-module/320813 "2022-12-08T16:59:01Z")
Hello! which is the best module in filebeat to parse jboss logs? Thank you --- ## [Self-hosting and license](https://discuss.elastic.co/t/self-hosting-and-license/320767)
**Author:** [@leo\_girault](https://discuss.elastic.co/u/leo_girault)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 4:52pm UTC](https://discuss.elastic.co/t/self-hosting-and-license/320767 "2022-12-08T16:52:21Z")
Hi there, First I'm sorry if this question has already been answered but I've not been able to find this information neither on official Elasticsearch documentation nor on Discussion / Forums. So far we are using in my… --- ## [Active directory auth on premise ECK kibana](https://discuss.elastic.co/t/active-directory-auth-on-premise-eck-kibana/320695)
**Author:** [@Thomas.sec](https://discuss.elastic.co/u/Thomas.sec)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 4:32pm UTC](https://discuss.elastic.co/t/active-directory-auth-on-premise-eck-kibana/320695 "2022-12-08T16:32:22Z")
Hi, I use ECK on premise, it works well but I need use AD accounts to auth in kibana. I follow the ad-realm-configuration documentation, but all my tests end with this error: FATAL Error: \[config validation of \[xpack… --- ## [Using ElasticSearch(from ECK) storage with Azure remote storages](https://discuss.elastic.co/t/using-elasticsearch-from-eck-storage-with-azure-remote-storages/320797)
**Author:** [@OlLap](https://discuss.elastic.co/u/OlLap)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 2:09pm UTC](https://discuss.elastic.co/t/using-elasticsearch-from-eck-storage-with-azure-remote-storages/320797 "2022-12-08T14:09:26Z")
Hello, is it possible to use any of the Azure storage types (Files share or Blob container) with Elasticsearch installed on Azure Kubernetes Cluster? I tried with Azure Disks and everything works, but building Hot-Warm-… --- ## [Logstash | pubsub |Consume the early message instead of the oldest?](https://discuss.elastic.co/t/logstash-pubsub-consume-the-early-message-instead-of-the-oldest/320802)
**Author:** [@dfraz](https://discuss.elastic.co/u/dfraz)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 3:13pm UTC](https://discuss.elastic.co/t/logstash-pubsub-consume-the-early-message-instead-of-the-oldest/320802 "2022-12-08T15:13:50Z")
Hi Could it be possible to configure logstash to consume the early messages in Pubsub instead of the oldest ? thx for the help. --- ## [Update alert using index API](https://discuss.elastic.co/t/update-alert-using-index-api/320800)
**Author:** [@Med2](https://discuss.elastic.co/u/Med2)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 2:48pm UTC](https://discuss.elastic.co/t/update-alert-using-index-api/320800 "2022-12-08T14:48:03Z")
In order to retrieve all alerts that appear on kibana I used the "GET /.internal.alerts-security.alerts-\*/\_search" API. I know there is an API for updating indexes and was wondering if I can use it to update an alert in… --- ## [FIlebeat error-too many cases](https://discuss.elastic.co/t/filebeat-error-too-many-cases/320172)
**Author:** [@bharat97](https://discuss.elastic.co/u/bharat97)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-error-too-many-cases/320172 "2022-12-08T14:24:28Z")
Hi Community, My filebeat is crashing with this error. {"log.level":"info","@timestamp":"2022-11-30T14:39:55.579Z","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":185},"message":"Non-zero m… --- ## [How to setup elastic apm agent in Chalice framework (Python)](https://discuss.elastic.co/t/how-to-setup-elastic-apm-agent-in-chalice-framework-python/320793)
**Author:** [@Abhishek22](https://discuss.elastic.co/u/Abhishek22)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 1:54pm UTC](https://discuss.elastic.co/t/how-to-setup-elastic-apm-agent-in-chalice-framework-python/320793 "2022-12-08T13:54:23Z")
As we have chalice framework which we deploy to lambda (aws) but there is no any document on how to do the setup of APM agent on chalice framework python. As chalice don't use flask so it is getting difficult to add APM … --- ## [Push notification from Elasticsearch to Microsoft teams via Logstash pipeline](https://discuss.elastic.co/t/push-notification-from-elasticsearch-to-microsoft-teams-via-logstash-pipeline/320159)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 1:40pm UTC](https://discuss.elastic.co/t/push-notification-from-elasticsearch-to-microsoft-teams-via-logstash-pipeline/320159 "2022-12-08T13:40:16Z")
Hi All, I want to send some notifications from Elasticsearch to Microsoft teams via logstash pipeline. Based on my knowledge, I should use http output plugin to connect to Microsoft teams and push notification under me… --- ## [Rollup jobs with distinct/unique count on metrics](https://discuss.elastic.co/t/rollup-jobs-with-distinct-unique-count-on-metrics/318606)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 2:12pm UTC](https://discuss.elastic.co/t/rollup-jobs-with-distinct-unique-count-on-metrics/318606 "2022-11-10T14:12:03Z")
Hello, i was trying to set up a rollup job in kibana. Is it possible to aggregate using unique/distinct count in metric? --- ## [Is there a way to see the script's console log on observability uptime monitor](https://discuss.elastic.co/t/is-there-a-way-to-see-the-scripts-console-log-on-observability-uptime-monitor/320496)
**Author:** [@ZaidMomin1](https://discuss.elastic.co/u/ZaidMomin1)\ **Replies:** 6\ **Last updated:** [December 8, 2022, 1:19pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-see-the-scripts-console-log-on-observability-uptime-monitor/320496 "2022-12-08T13:19:37Z")
Hi, Hope you're doing well! We have written the journey for monitoring the web app using playwright and Typescript. We are facing a difficulty to view the script's console.log written with the step, on the uptime monit… --- ## [Not able to delete Project monitor which is undefined](https://discuss.elastic.co/t/not-able-to-delete-project-monitor-which-is-undefined/320572)
**Author:** [@Deepak\_Vyas](https://discuss.elastic.co/u/Deepak_Vyas)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 1:17pm UTC](https://discuss.elastic.co/t/not-able-to-delete-project-monitor-which-is-undefined/320572 "2022-12-08T13:17:30Z")
Under same project ID "Kingmakers" i see two monitors with same name one is default and one is undefined. I am not able to delete undefined one. --- ## [Issue with nfs server, getting error where using repo.path](https://discuss.elastic.co/t/issue-with-nfs-server-getting-error-where-using-repo-path/320716)
**Author:** [@luis\_ernesto\_alcanta](https://discuss.elastic.co/u/luis_ernesto_alcanta)\ **Replies:** 3\ **Last updated:** [December 8, 2022, 12:32pm UTC](https://discuss.elastic.co/t/issue-with-nfs-server-getting-error-where-using-repo-path/320716 "2022-12-08T12:32:09Z")
Hi I try to use a nfs server to run some backups: I am configuring elastic.yml in next way: apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: quickstart namespace: rentallo-elastic sp… --- ## [How to resolve IP to hostname comming from Nginx access logs using nginx integration?](https://discuss.elastic.co/t/how-to-resolve-ip-to-hostname-comming-from-nginx-access-logs-using-nginx-integration/320788)
**Author:** [@DUGi](https://discuss.elastic.co/u/DUGi)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 12:31pm UTC](https://discuss.elastic.co/t/how-to-resolve-ip-to-hostname-comming-from-nginx-access-logs-using-nginx-integration/320788 "2022-12-08T12:31:19Z")
Hello, I have a question regarding nginx integration - access-log. I set it up and everything is working but I want to change source.ip to hostname. I'm using Fleet with agent and nginx integration. I added to Collec… --- ## [How to sync data from htttp\_poller](https://discuss.elastic.co/t/how-to-sync-data-from-htttp-poller/320787)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 12:29pm UTC](https://discuss.elastic.co/t/how-to-sync-data-from-htttp-poller/320787 "2022-12-08T12:29:18Z")
Hello, I am having 1 Billion data coming from an http API. The Api has pagination so that I can fetch data in batches. How can I implement that pagination in logstash using http\_poller plugin... My config file structur… --- ## [Central Config of APM agents in Kibana](https://discuss.elastic.co/t/central-config-of-apm-agents-in-kibana/320530)
**Author:** [@tarund](https://discuss.elastic.co/u/tarund)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 12:26pm UTC](https://discuss.elastic.co/t/central-config-of-apm-agents-in-kibana/320530 "2022-12-08T12:26:22Z")
Hi Team, I have multiple java agents running for several applications on different servers. Currently, the config is specified in properties file. I want to be able to update some of the dynamic configs from Kibana for s… --- ## [How to create multiple dense vector field?](https://discuss.elastic.co/t/how-to-create-multiple-dense-vector-field/320514)
**Author:** [@sungwon1110](https://discuss.elastic.co/u/sungwon1110)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 12:24pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-dense-vector-field/320514 "2022-12-08T12:24:35Z")
Im trying to create multiple dense vector field. This is my mapping code: { "mappings": { "properties": { "ABSTRACT\_vector": { "type": "dense\_vector", "dims": 384 }, "BACKGROUND\_vector": { "type": "dense\_vector… --- ## [High memory usage of Metricbeat in Kubernetes](https://discuss.elastic.co/t/high-memory-usage-of-metricbeat-in-kubernetes/320784)
**Author:** [@beatman](https://discuss.elastic.co/u/beatman)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 12:24pm UTC](https://discuss.elastic.co/t/high-memory-usage-of-metricbeat-in-kubernetes/320784 "2022-12-08T12:24:02Z")
Hi, Continuing the discussion from High memory usage of Metricbeat in Kubernetes: I'm facing exactly the same problem with metricbeat consuming memory until it gets OOM-killed. This happens on all three k8s clusters I… --- ## [Parsing key value pairs from 2 seperate fields into several fields in ingest pipeline](https://discuss.elastic.co/t/parsing-key-value-pairs-from-2-seperate-fields-into-several-fields-in-ingest-pipeline/320782)
**Author:** [@DennisLC](https://discuss.elastic.co/u/DennisLC)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 12:11pm UTC](https://discuss.elastic.co/t/parsing-key-value-pairs-from-2-seperate-fields-into-several-fields-in-ingest-pipeline/320782 "2022-12-08T12:11:44Z")
I have just started ingesting 0365 audit logs, and I have come across the following field: o365.audit.ExtraProperties.value that I would like to parse out to several fields (as it contains comma seperated values) in my… --- ## [Problem connection LogStash to ElasticSearch in DockerCompose](https://discuss.elastic.co/t/problem-connection-logstash-to-elasticsearch-in-dockercompose/320773)
**Author:** [@mabsIpca](https://discuss.elastic.co/u/mabsIpca)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 11:15am UTC](https://discuss.elastic.co/t/problem-connection-logstash-to-elasticsearch-in-dockercompose/320773 "2022-12-08T11:15:03Z")
Hi everyone, I am currently developing a little project for university essay with educational purposes. In this project, I'm trying to use rabbit mq to send Log messages to Logstash from a Spring Boot Backend. Currentl… --- ## [Manipulating Nested Fields](https://discuss.elastic.co/t/manipulating-nested-fields/320768)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 10:44am UTC](https://discuss.elastic.co/t/manipulating-nested-fields/320768 "2022-12-08T10:44:45Z")
Hi, Given a field \[field\]\[sub-field\], how can I move the value from "sub-field" to field? That is, convert this from an object to a string? I've tried: mutate { covert =\> { "field" =\> "string" } } and: mutate {… --- ## [Delete index older than a week](https://discuss.elastic.co/t/delete-index-older-than-a-week/320737)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 23\ **Last updated:** [December 8, 2022, 10:26am UTC](https://discuss.elastic.co/t/delete-index-older-than-a-week/320737 "2022-12-08T10:26:15Z")
Currently i have logs from 5 to 6 servers coming to elk. I want to delete all indices older than a week. what is the best way to achieve this? i went through ILM but didn't get the exact way to do this --- ## [Performance: Sorting / Filtering by runtime fields](https://discuss.elastic.co/t/performance-sorting-filtering-by-runtime-fields/320540)
**Author:** [@kennyprisjakt](https://discuss.elastic.co/u/kennyprisjakt)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 9:58am UTC](https://discuss.elastic.co/t/performance-sorting-filtering-by-runtime-fields/320540 "2022-12-08T09:58:38Z")
Hey, I'm looking into getting price conversions up to date in my indices. Price data: Updated index time Price conversions: Updated in query time (via runtime fields) The data for the currency conversion changes ofte… [Previous page](https://discuss.elastic.co/latest.md?page=864) [Next page](https://discuss.elastic.co/latest.md?page=866)