# Latest **URL:** https://discuss.elastic.co/latest.md?page=870 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 871 --- ## [Gaps in monitoring diagrams of cluster](https://discuss.elastic.co/t/gaps-in-monitoring-diagrams-of-cluster/320477)
**Author:** [@Erik\_Bors](https://discuss.elastic.co/u/Erik_Bors)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 3:17pm UTC](https://discuss.elastic.co/t/gaps-in-monitoring-diagrams-of-cluster/320477 "2022-12-05T15:17:33Z")
We can see on the Cluster Overview dashboard some gaps in the diagrams like SearchRate, Search Latency etc. Thanx for any help, where to look more for the details. In the logs there is nothing really wrong, often only … --- ## [Proper Monitoring of specific Field - Fields missing in Alerts & Insights Rules](https://discuss.elastic.co/t/proper-monitoring-of-specific-field-fields-missing-in-alerts-insights-rules/320510)
**Author:** [@afammartino](https://discuss.elastic.co/u/afammartino)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 1:02am UTC](https://discuss.elastic.co/t/proper-monitoring-of-specific-field-fields-missing-in-alerts-insights-rules/320510 "2022-12-06T01:02:03Z")
Hello, my goal is to monitor a specific value from an index in ELK. Concretely I would like to alert if the 95th percentile of my nginx request\_time is greater than some threshold. What is the best way to accomplish this… --- ## [How to "explore" labels from custom RUM transactions?](https://discuss.elastic.co/t/how-to-explore-labels-from-custom-rum-transactions/320520)
**Author:** [@Mike\_Cann](https://discuss.elastic.co/u/Mike_Cann)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 5:08am UTC](https://discuss.elastic.co/t/how-to-explore-labels-from-custom-rum-transactions/320520 "2022-12-06T05:08:01Z")
Hi, I have added a custom transaction to track average FPS for our game. I added three custom labels. I am not sure how I can search and graph the results of this however. Any help or link to appropriate docs appre… --- ## [Install Integration on one or multiple endpoints?](https://discuss.elastic.co/t/install-integration-on-one-or-multiple-endpoints/320511)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 1:23am UTC](https://discuss.elastic.co/t/install-integration-on-one-or-multiple-endpoints/320511 "2022-12-06T01:23:49Z")
Hello, How do we know if an Integration should be installed on one endpoint of multiple? Microsoft 365 Integration, if pushed to multiple endpoints, would be redundant and duplicate the data right? Elastic Defend,… --- ## [Display average of every 100 records](https://discuss.elastic.co/t/display-average-of-every-100-records/320521)
**Author:** [@Yungxin\_Shin](https://discuss.elastic.co/u/Yungxin_Shin)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 4:08am UTC](https://discuss.elastic.co/t/display-average-of-every-100-records/320521 "2022-12-06T04:08:33Z")
I want to display the average of every 100 records, which works similarly to grouping 100 records as a "batch"/"group". So far the moving average only works on the time field, is it possible to apply the moving average t… --- ## [Can i update child document while update parent document from script](https://discuss.elastic.co/t/can-i-update-child-document-while-update-parent-document-from-script/320515)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 3:20am UTC](https://discuss.elastic.co/t/can-i-update-child-document-while-update-parent-document-from-script/320515 "2022-12-06T03:20:07Z")
can i update special document while update a document? For example: i have 2 docs, doc parent A and doc child B. whenever i update doc child B, i want filed a1 of doc A have value v1. is it possible? cause as i know 1 … --- ## [Filebeat nginx module](https://discuss.elastic.co/t/filebeat-nginx-module/320400)
**Author:** [@amir\_Bialek](https://discuss.elastic.co/u/amir_Bialek)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 11:36pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module/320400 "2022-12-05T23:36:21Z")
Hello, I am trying to use filebeat with nginx module to collect logs from nginx-ingress-controller and send directly to elasti but I keep getting an error: Provided Grok expressions do not match field value: \[172.17.0.… --- ## [Kibana error while querying in Discover](https://discuss.elastic.co/t/kibana-error-while-querying-in-discover/318764)
**Author:** [@Michael\_Sanchez](https://discuss.elastic.co/u/Michael_Sanchez)\ **Replies:** 34\ **Last updated:** [December 5, 2022, 10:00pm UTC](https://discuss.elastic.co/t/kibana-error-while-querying-in-discover/318764 "2022-12-05T22:00:28Z")
Hello team, I'm seeing the following error while making a search in "Discover": search\_phase\_execution\_exception Error: Bad Request at Fetch.\_callee3$ (kibana/36063/bundles/core/core.entry.js:6:59535) at l (k… --- ## [Enterprise Login page fail loading HTTP 431](https://discuss.elastic.co/t/enterprise-login-page-fail-loading-http-431/320501)
**Author:** [@Hemant\_Bhavsar](https://discuss.elastic.co/u/Hemant_Bhavsar)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 9:07pm UTC](https://discuss.elastic.co/t/enterprise-login-page-fail-loading-http-431/320501 "2022-12-05T21:07:06Z")
I have installed Enterprise Search v7.15.5 for testing. When I am trying to access the login page, I am getting the below error. I tried adding several Jetty webserver option in JVM Argument. However, I'm still getting e… --- ## [Xpath fails to extract](https://discuss.elastic.co/t/xpath-fails-to-extract/320479)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 8:36pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479 "2022-12-05T20:36:49Z")
Hi, i need extract one value from a parsed XML, my logstash configuration is xml { source =\> "contentRequest" target =\> "contentRequest\_field" store\_xml =\> false xpath =\> \[ "/datianagrafici/datipersonali… --- ## [Data not appearing in dashboards](https://discuss.elastic.co/t/data-not-appearing-in-dashboards/317582)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 2\ **Last updated:** [November 8, 2022, 2:08am UTC](https://discuss.elastic.co/t/data-not-appearing-in-dashboards/317582 "2022-11-08T02:08:32Z")
Hi, I have two filebeat indices/datastreams: filebeat-8.4.0 filebeat-8.4.0-custom These are both targeted by a Data View : filebeat-\* Using this data view in Discover, I can see all the events from both indices, how… --- ## [Moving indices to Docker](https://discuss.elastic.co/t/moving-indices-to-docker/320069)
**Author:** [@Jozef](https://discuss.elastic.co/u/Jozef)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 7:56pm UTC](https://discuss.elastic.co/t/moving-indices-to-docker/320069 "2022-12-05T19:56:09Z")
Hi, I am currently trying to test the overhead a docker container adds to query latency, among other tests requiring a containerized ES. In order to do this I am creating a container and mounting the folder containing th… --- ## [Kubernetes integration logs missing](https://discuss.elastic.co/t/kubernetes-integration-logs-missing/320495)
**Author:** [@Vojtech\_Vavra](https://discuss.elastic.co/u/Vojtech_Vavra)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 6:56pm UTC](https://discuss.elastic.co/t/kubernetes-integration-logs-missing/320495 "2022-12-05T18:56:47Z")
Hi I have installed ECK (quickstart) with Kubernetes integration to watch logs from cluster containers. However, I can see only logs from namespace where ECK is installed. I have changed path to aks k8s logs from /v… --- ## [ECE Platform upgrade from 2.13.2 to 3.3.0 failed and stuck during rollback](https://discuss.elastic.co/t/ece-platform-upgrade-from-2-13-2-to-3-3-0-failed-and-stuck-during-rollback/320491)
**Author:** [@mahesthogarpally](https://discuss.elastic.co/u/mahesthogarpally)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 6:34pm UTC](https://discuss.elastic.co/t/ece-platform-upgrade-from-2-13-2-to-3-3-0-failed-and-stuck-during-rollback/320491 "2022-12-05T18:34:07Z")
I tried to upgrade the ece platform version from 2.13.2 to 3.3 using "elastic-cloud-enterprise.sh" script,The upgrade failed and it got stuck during rollback.I tried to restart frc-runner-runner and now i see all the all… --- ## [Connecting FSCrawler to Workplace Enterprise Search](https://discuss.elastic.co/t/connecting-fscrawler-to-workplace-enterprise-search/319871)
**Author:** [@Hoang\_Quan\_Nguyen](https://discuss.elastic.co/u/Hoang_Quan_Nguyen)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 5:37pm UTC](https://discuss.elastic.co/t/connecting-fscrawler-to-workplace-enterprise-search/319871 "2022-12-05T17:37:21Z")
Hi, I'm currently using FSCrawler connecting to Workplace Enterprise Search. The FSCrawler was working and connecting to my personal deployment's Enterprise Search. However, when I tried with my company deployment, I re… --- ## [Hello, I am a newbie . I am looking for a solution where I can search with keywords from millions of pdfs](https://discuss.elastic.co/t/hello-i-am-a-newbie-i-am-looking-for-a-solution-where-i-can-search-with-keywords-from-millions-of-pdfs/320376)
**Author:** [@hithasreenivas](https://discuss.elastic.co/u/hithasreenivas)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 5:36pm UTC](https://discuss.elastic.co/t/hello-i-am-a-newbie-i-am-looking-for-a-solution-where-i-can-search-with-keywords-from-millions-of-pdfs/320376 "2022-12-05T17:36:07Z")
This category relates to the Enterprise Search set of products - App Search, Site Search and Workplace Search. If your question relates to core Elasticsearch functionality, please head over to the #elastic-stack:elastic… --- ## [How can i exclude 0 from an uniqe count?](https://discuss.elastic.co/t/how-can-i-exclude-0-from-an-uniqe-count/320471)
**Author:** [@Jakomo04](https://discuss.elastic.co/u/Jakomo04)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 4:46pm UTC](https://discuss.elastic.co/t/how-can-i-exclude-0-from-an-uniqe-count/320471 "2022-12-05T16:46:48Z")
Hi, I have to do a Visualization that only shows the data over 10 of an unique count i tried "clamp(unique\_count('info.job-id.keyword') - 10, 0, 1) \* unique\_count('info.job-id.keyword')" . Now i have all the data under … --- ## [Logstash multiline and clone](https://discuss.elastic.co/t/logstash-multiline-and-clone/320478)
**Author:** [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 4:28pm UTC](https://discuss.elastic.co/t/logstash-multiline-and-clone/320478 "2022-12-05T16:28:40Z")
I am sending some information from filebeat using one kind of multiline pattern. At some point, I realized I need to use another multiline pattern based on the log\_source. My idea was clone the beat and if the log\_sour… --- ## [Dashboard panels don't show data though underlying visualizations appear to work](https://discuss.elastic.co/t/dashboard-panels-dont-show-data-though-underlying-visualizations-appear-to-work/318588)
**Author:** [@jenrem](https://discuss.elastic.co/u/jenrem)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 3:44pm UTC](https://discuss.elastic.co/t/dashboard-panels-dont-show-data-though-underlying-visualizations-appear-to-work/318588 "2022-12-05T15:44:41Z")
Some panels on a dashboard no longer show data though when you go in to edit the visualization, it does show the data. The affected visualizations are based on follower indexes that had stopped receiving data from… --- ## [Insert ML Job Swimlane](https://discuss.elastic.co/t/insert-ml-job-swimlane/318258)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 3:29pm UTC](https://discuss.elastic.co/t/insert-ml-job-swimlane/318258 "2022-11-07T15:29:52Z")
I would like to insert the anomaly timeline swimlane visualization (for ML jobs) into Kibana Canvas workpad. I see that I can insert it into a dashboard, but don't see a way to use in Canvas. And apparently, it does not … --- ## [Rollover of Index and delete delta data as per customer configuration](https://discuss.elastic.co/t/rollover-of-index-and-delete-delta-data-as-per-customer-configuration/320452)
**Author:** [@atpr](https://discuss.elastic.co/u/atpr)\ **Replies:** 3\ **Last updated:** [December 5, 2022, 2:48pm UTC](https://discuss.elastic.co/t/rollover-of-index-and-delete-delta-data-as-per-customer-configuration/320452 "2022-12-05T14:48:32Z")
Hi Experts, I have customer requirement where each customer can opt XGB of data or Y days of data and n no of records. Customer is saying they only want this much, if more data is coming, please delete oldest among all.… --- ## [APM agent php issue](https://discuss.elastic.co/t/apm-agent-php-issue/314998)
**Author:** [@Pragadeeswar\_Padmana](https://discuss.elastic.co/u/Pragadeeswar_Padmana)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 2:27pm UTC](https://discuss.elastic.co/t/apm-agent-php-issue/314998 "2022-12-05T14:27:07Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [Tune for indexing speed](https://discuss.elastic.co/t/tune-for-indexing-speed/318873)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 10\ **Last updated:** [December 5, 2022, 2:15pm UTC](https://discuss.elastic.co/t/tune-for-indexing-speed/318873 "2022-12-05T14:15:37Z")
Hey Everyone, We're having some issues optimizing the indexing speed on our cluster. Try as we might, we can't go over 200k/s. Here are the things we tried: Increasing the amount of documents used in a bulk request - … --- ## [The Windows x86\_64 MSI file for Packetbeat 8.3.2 won't work with default\_route](https://discuss.elastic.co/t/the-windows-x86-64-msi-file-for-packetbeat-8-3-2-wont-work-with-default-route/320446)
**Author:** [@beejaygee](https://discuss.elastic.co/u/beejaygee)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 2:12pm UTC](https://discuss.elastic.co/t/the-windows-x86-64-msi-file-for-packetbeat-8-3-2-wont-work-with-default-route/320446 "2022-12-05T14:12:42Z")
The Windows x86\_64 MSI file for Packetbeat 8.3.2 won't work with default\_route setting. I have found that if I compile the v8.3.2 source and swap the exe out for my compiled version that it works as expected. If I use th… --- ## [ASP.NET on .NET Framework in IIS 10 Configuration (not working)](https://discuss.elastic.co/t/asp-net-on-net-framework-in-iis-10-configuration-not-working/320137)
**Author:** [@aysekisik\_kisilan](https://discuss.elastic.co/u/aysekisik_kisilan)\ **Replies:** 6\ **Last updated:** [December 5, 2022, 2:07pm UTC](https://discuss.elastic.co/t/asp-net-on-net-framework-in-iis-10-configuration-not-working/320137 "2022-12-05T14:07:04Z")
Hi, I wanted to test apm .net but I couldn't run the MVC ASP.NET .net framework (with Profiler Auto instrumentation). Do I need any code changes? I followed the general steps here for IIS10 Kibana version: 8.5.1 … --- ## [64 Gb limit for per NODE](https://discuss.elastic.co/t/64-gb-limit-for-per-node/319950)
**Author:** [@Kamran\_Ahmadzade](https://discuss.elastic.co/u/Kamran_Ahmadzade)\ **Replies:** 11\ **Last updated:** [December 5, 2022, 2:03pm UTC](https://discuss.elastic.co/t/64-gb-limit-for-per-node/319950 "2022-12-05T14:03:54Z")
Why do we have 64 GB limit for per node in cluster ? --- ## [ASP dotnet manual log correlation not working](https://discuss.elastic.co/t/asp-dotnet-manual-log-correlation-not-working/320367)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 2:00pm UTC](https://discuss.elastic.co/t/asp-dotnet-manual-log-correlation-not-working/320367 "2022-12-05T14:00:40Z")
TIP 1: select at least one tag that further categorizes your topic. For example server for APM Server related questions, java for questions regarding the Elastic APM Java agent, or ui for questions about the APM App with… --- ## [Logstash netscaler citrix input](https://discuss.elastic.co/t/logstash-netscaler-citrix-input/319571)
**Author:** [@perezdev](https://discuss.elastic.co/u/perezdev)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 1:58pm UTC](https://discuss.elastic.co/t/logstash-netscaler-citrix-input/319571 "2022-12-05T13:58:41Z")
Hello, I'm trying to collect logs from Netscaler Citrix using ipfix protocol, but I'm not able to decode properly the message. This is my input configuration file: input { udp { port =\> 9913 codec =\> netflow… --- ## [What is External Alerts Detection Rule?](https://discuss.elastic.co/t/what-is-external-alerts-detection-rule/316817)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 1:53pm UTC](https://discuss.elastic.co/t/what-is-external-alerts-detection-rule/316817 "2022-12-05T13:53:19Z")
Hello, what exactly is "External Alerts" in the SIEM rules? It doesn't do anything for us. --- ## [Unable to install Fleet Server](https://discuss.elastic.co/t/unable-to-install-fleet-server/319110)
**Author:** [@leschev](https://discuss.elastic.co/u/leschev)\ **Replies:** 20\ **Last updated:** [December 5, 2022, 1:51pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-server/319110 "2022-12-05T13:51:59Z")
Hello! I am trying to install Fleet Server with my self-hosted ELK. So, I have the error: sudo ./elastic-agent install -f --fleet-server-es=https://\*\*\*\*.org:9200 --fleet-server-service-token=AAEAAWV\*\*\*\* --fleet-serv… [Previous page](https://discuss.elastic.co/latest.md?page=869) [Next page](https://discuss.elastic.co/latest.md?page=871)