# Latest **URL:** https://discuss.elastic.co/latest.md?page=871 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 872 --- ## [Kibana: how to set up alerts on a boolean field](https://discuss.elastic.co/t/kibana-how-to-set-up-alerts-on-a-boolean-field/318694)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 1:11pm UTC](https://discuss.elastic.co/t/kibana-how-to-set-up-alerts-on-a-boolean-field/318694 "2022-12-05T13:11:23Z")
Hi, I have a dataset that contains fields pertaining to a specific optical transport device. My dataset: "slot": "LM-1", "source": "1.3.1.8", "timestamp": 1668113939, "serial\_no": "xxxxxxxx", "hardware\_version": "001"… --- ## [How to special date time format to timestamp format](https://discuss.elastic.co/t/how-to-special-date-time-format-to-timestamp-format/320444)
**Author:** [@akif\_bal](https://discuss.elastic.co/u/akif_bal)\ **Replies:** 6\ **Last updated:** [December 5, 2022, 1:09pm UTC](https://discuss.elastic.co/t/how-to-special-date-time-format-to-timestamp-format/320444 "2022-12-05T13:09:56Z")
I have a log type that I cannot manipulate. How can I convert the Time format in the log to timestamp format? Example log: "0001 021222 095725 00240541029896158 11 00 00 0000000000 000 0" Date and time that comes with … --- ## [Some devices(routers/firewall) logs are not coming in ELK Kibana](https://discuss.elastic.co/t/some-devices-routers-firewall-logs-are-not-coming-in-elk-kibana/319610)
**Author:** [@Sivaramakrishhna\_Amb](https://discuss.elastic.co/u/Sivaramakrishhna_Amb)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 11:38am UTC](https://discuss.elastic.co/t/some-devices-routers-firewall-logs-are-not-coming-in-elk-kibana/319610 "2022-12-05T11:38:59Z")
Some devices(routers/firewall) logs are not coming in ELK Kibana protocol used is tcp --- ## [Rolling upgrades, master nodes & voting\_config\_exclusions](https://discuss.elastic.co/t/rolling-upgrades-master-nodes-voting-config-exclusions/320463)
**Author:** [@aidofitz](https://discuss.elastic.co/u/aidofitz)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 11:33am UTC](https://discuss.elastic.co/t/rolling-upgrades-master-nodes-voting-config-exclusions/320463 "2022-12-05T11:33:44Z")
Hi, We are planning to upgrade our v7.8 cluster to v7.17, in a rolling upgrade. The cluster has 22 nodes and all nodes have both Master and Data roles. We're planning to leave the currently elected master node till la… --- ## [Search\_after but with paging](https://discuss.elastic.co/t/search-after-but-with-paging/319886)
**Author:** [@daniel77](https://discuss.elastic.co/u/daniel77)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 10:55am UTC](https://discuss.elastic.co/t/search-after-but-with-paging/319886 "2022-12-05T10:55:04Z")
We know the from + size parameters in a search query are limited to 10000. In a search which returns 20k hits, and assuming each page is 1k results, it's impossible to retrieve any page beyond #10 (like page 11, from set… --- ## [Integration of ELK in TheHive](https://discuss.elastic.co/t/integration-of-elk-in-thehive/320455)
**Author:** [@Midiou\_00](https://discuss.elastic.co/u/Midiou_00)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 9:50am UTC](https://discuss.elastic.co/t/integration-of-elk-in-thehive/320455 "2022-12-05T09:50:29Z")
Hi everyone, I want to integrate ELK in Thehive SOAR. This is an open source SOAR. May somebody help me for the processus please ? --- ## [Do EQL deprecations also imply deprecation of the Java API?](https://discuss.elastic.co/t/do-eql-deprecations-also-imply-deprecation-of-the-java-api/320462)
**Author:** [@martinwun](https://discuss.elastic.co/u/martinwun)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 10:48am UTC](https://discuss.elastic.co/t/do-eql-deprecations-also-imply-deprecation-of-the-java-api/320462 "2022-12-05T10:48:50Z")
Hello, in the release notes for 7.13 it states the following in the section on "EQL deprecations": "The wildcard function is deprecated." What is not clear to me is whether or not this is also affecting the Java API… --- ## [\_update\_by\_query and error "no handler found for uri"](https://discuss.elastic.co/t/update-by-query-and-error-no-handler-found-for-uri/320457)
**Author:** [@StevenMartins](https://discuss.elastic.co/u/StevenMartins)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 10:38am UTC](https://discuss.elastic.co/t/update-by-query-and-error-no-handler-found-for-uri/320457 "2022-12-05T10:38:08Z")
When I use \_update\_by\_query call with Postman, it's works well : but with Talend (java) I get this error : {"error":"no handler found for uri \[/.ent-search-engine-documents-hot-data/update\_by\_query\] and method \[POST… --- ## [Kibana import CSV only return partial data](https://discuss.elastic.co/t/kibana-import-csv-only-return-partial-data/319255)
**Author:** [@Virendra\_Negi](https://discuss.elastic.co/u/Virendra_Negi)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 10:28am UTC](https://discuss.elastic.co/t/kibana-import-csv-only-return-partial-data/319255 "2022-12-05T10:28:57Z")
I see there is already a reference ticket around this Reporting - CSV Export: contains partial data nothing conclusive came out from it, Hence creating a new one. the OP in the previous post is correct Kibana does not r… --- ## [Auto delete index on the basis of index size](https://discuss.elastic.co/t/auto-delete-index-on-the-basis-of-index-size/316186)
**Author:** [@Mangesh\_Mathe](https://discuss.elastic.co/u/Mangesh_Mathe)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 9:51pm UTC](https://discuss.elastic.co/t/auto-delete-index-on-the-basis-of-index-size/316186 "2022-10-10T21:51:40Z")
I Want to delete two different production index if it exceeds 50GB size. I tried to use ILM policy on the basis of index size, I tried rollover condition with hot phase max\_size 50GB and then delete phase after 1 hour. … --- ## [How to alert based on filter query count? Index Threshold Rule Type?](https://discuss.elastic.co/t/how-to-alert-based-on-filter-query-count-index-threshold-rule-type/319119)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-alert-based-on-filter-query-count-index-threshold-rule-type/319119 "2022-12-05T10:12:03Z")
I want to set up an alert in Kibana Observability where if the number of records returned for event.dataset: login and event.outcome: failure is greater than 10 for the past minute, then set the alert rule to active. I'… --- ## [ILM Policy Clarification](https://discuss.elastic.co/t/ilm-policy-clarification/318229)
**Author:** [@gbandasha](https://discuss.elastic.co/u/gbandasha)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 10:00am UTC](https://discuss.elastic.co/t/ilm-policy-clarification/318229 "2022-12-05T10:00:07Z")
Hello Team, Firstly I would like to define my flow, my setup uses all three components ELK, and the data is sent from a Big Data Platform to Kafka from which logstash reads and sends it to elastic. So I planned to setup… --- ## [Spaces on Kibana](https://discuss.elastic.co/t/spaces-on-kibana/318315)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 9:32am UTC](https://discuss.elastic.co/t/spaces-on-kibana/318315 "2022-12-05T09:32:32Z")
Hi, This is regarding spaces on the Kibana. To restrict access on spaces. I read like , we need to create a role and an user . Assign the space roll to the user. I followed the steps and create a role and an user. Assi… --- ## [Dec 5th, 2022: \[EN\] On-season troubleshooting](https://discuss.elastic.co/t/dec-5th-2022-en-on-season-troubleshooting/319857)
**Author:** [@gmarouli](https://discuss.elastic.co/u/gmarouli)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 8:00am UTC](https://discuss.elastic.co/t/dec-5th-2022-en-on-season-troubleshooting/319857 "2022-12-05T08:00:03Z")
While many people are singing "It's the Most Wonderful Time of the Year...", I catch myself making a small adjustment: "It's the Most Exciting Time of the Year..." I live in the Netherlands and the mid November to m… --- ## [2 nodes logstash](https://discuss.elastic.co/t/2-nodes-logstash/320012)
**Author:** [@maxxl](https://discuss.elastic.co/u/maxxl)\ **Replies:** 9\ **Last updated:** [December 5, 2022, 6:26am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012 "2022-12-05T06:26:35Z")
1 logstash works fine 2 logstash, wrong view in kibana --- ## [Need to bypass authentication in kibana as dashboards are embedd using iframes in custom website](https://discuss.elastic.co/t/need-to-bypass-authentication-in-kibana-as-dashboards-are-embedd-using-iframes-in-custom-website/316539)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 3\ **Last updated:** [November 7, 2022, 6:19am UTC](https://discuss.elastic.co/t/need-to-bypass-authentication-in-kibana-as-dashboards-are-embedd-using-iframes-in-custom-website/316539 "2022-11-07T06:19:06Z")
Hello All, I want to know possible ways to bypass basic authentication that is enabled in kibana. Issue: I have custom website that has dashboards integrated using iframes.Now Issue is whenever the user logins to webs… --- ## [GC on elastic search data nodes and node automatically reconnect from the cluster](https://discuss.elastic.co/t/gc-on-elastic-search-data-nodes-and-node-automatically-reconnect-from-the-cluster/319426)
**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 4:23am UTC](https://discuss.elastic.co/t/gc-on-elastic-search-data-nodes-and-node-automatically-reconnect-from-the-cluster/319426 "2022-12-05T04:23:47Z")
Hi Team, we are getting the below alerts in elasticsearch data nodes. \[2022-11-20T21:27:36,237\]\[INFO \]\[o.e.m.j.JvmGcMonitorService\] \[esnode1\] \[gc\]\[438806\] overhead, spent \[276ms\] collecting in the last \[1s\] \[2022-11-2… --- ## [The limit of Data stream](https://discuss.elastic.co/t/the-limit-of-data-stream/320255)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 12:37am UTC](https://discuss.elastic.co/t/the-limit-of-data-stream/320255 "2022-12-05T00:37:12Z")
I had to choose between data stream and index strategy with alias and found es doc which helps to determine whether use data stream or not If you frequently update or delete existing time series data, use an index alias… --- ## [Can't start elasticsearch 8.5 with docker](https://discuss.elastic.co/t/cant-start-elasticsearch-8-5-with-docker/318029)
**Author:** [@FatNerd](https://discuss.elastic.co/u/FatNerd)\ **Replies:** 13\ **Last updated:** [December 5, 2022, 12:36am UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-8-5-with-docker/318029 "2022-12-05T00:36:46Z")
I'm trying to execute the docker-compose.yml from this page Install Elasticsearch with Docker | Elasticsearch Guide \[8.5\] | Elastic In the .env file, I left everything to default except the two passwords Ther first se… --- ## [Backup Centralized Pipeline Management](https://discuss.elastic.co/t/backup-centralized-pipeline-management/318294)
**Author:** [@heric](https://discuss.elastic.co/u/heric)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 7:09am UTC](https://discuss.elastic.co/t/backup-centralized-pipeline-management/318294 "2022-11-07T07:09:15Z")
Hi, Is there any API / command that we can use to backup logstash pipelines that are created in centralized pipeline management ? i have quite a lot of pipelines and copy paste from centralized pipeline management will… --- ## [Kibana pod stopped after restoring the index pattern](https://discuss.elastic.co/t/kibana-pod-stopped-after-restoring-the-index-pattern/320229)
**Author:** [@MahithaSarala](https://discuss.elastic.co/u/MahithaSarala)\ **Replies:** 7\ **Last updated:** [December 4, 2022, 9:18pm UTC](https://discuss.elastic.co/t/kibana-pod-stopped-after-restoring-the-index-pattern/320229 "2022-12-04T21:18:33Z")
Hi Team, We have deleted the data from index in elasticvue , we had backup so we have restored the index pattern now kibana pod not running after restoring . please find the kibana pod logs {"type":"log","@timestamp":… --- ## [Provision ILM policy for elastic agent streams](https://discuss.elastic.co/t/provision-ilm-policy-for-elastic-agent-streams/320348)
**Author:** [@PaulusTM](https://discuss.elastic.co/u/PaulusTM)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 10:04am UTC](https://discuss.elastic.co/t/provision-ilm-policy-for-elastic-agent-streams/320348 "2022-12-02T10:04:58Z")
Hi folks, I'm new to Elastic Agent configuration and running the latest ECK build on Kubernetes. While I really like to visibility Fleet offers, it seems I'm unable to provision custom ILM policies like I can with Beat… --- ## [Node is disconnected from cluster and does not join existing cluster (ES 7.16.2)](https://discuss.elastic.co/t/node-is-disconnected-from-cluster-and-does-not-join-existing-cluster-es-7-16-2/320357)
**Author:** [@Pooja2](https://discuss.elastic.co/u/Pooja2)\ **Replies:** 1\ **Last updated:** [December 4, 2022, 9:15pm UTC](https://discuss.elastic.co/t/node-is-disconnected-from-cluster-and-does-not-join-existing-cluster-es-7-16-2/320357 "2022-12-04T21:15:10Z")
Hi Team, We have an elasticsearch(ES 7.16.2) cluster of 3 nodes in which one node(node-3) is randomly disconnected from the cluster. Node info: node-1 = master, data (currently master) node-2 = master, data node-3 =… --- ## [How to properly monitor containerized databases?](https://discuss.elastic.co/t/how-to-properly-monitor-containerized-databases/320401)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 0\ **Last updated:** [December 3, 2022, 12:50am UTC](https://discuss.elastic.co/t/how-to-properly-monitor-containerized-databases/320401 "2022-12-03T00:50:21Z")
I'm in the the middle of testing how well deploying a MariaDB Galera cluster per app works in a Docker Swarm stack. The idea being that we can tweak each Galera cluster to fit each individual apps needs, have them be hi… --- ## [Retrieve records and update a field at the same time](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/320432)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 1\ **Last updated:** [December 4, 2022, 7:12pm UTC](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/320432 "2022-12-04T19:12:44Z")
We did not get a response the first time. Hopefully someone can give us some guidance this time. Is there anyway when making a query in Elasticsearch, to update a field (such as say a counter++) in each record that is s… --- ## [ECE customer containers](https://discuss.elastic.co/t/ece-customer-containers/320372)
**Author:** [@stobbe](https://discuss.elastic.co/u/stobbe)\ **Replies:** 5\ **Last updated:** [December 4, 2022, 5:50pm UTC](https://discuss.elastic.co/t/ece-customer-containers/320372 "2022-12-04T17:50:31Z")
Hello, Simple question, running ECE, I thought it would be nice to be able to start a custom container with Logstash as an iexample. This could be used for the elastic agent traffic pipeline. Is this possible? KR Henk … --- ## [Modify the max bucket to report an error](https://discuss.elastic.co/t/modify-the-max-bucket-to-report-an-error/320414)
**Author:** [@Tonyhu\_T](https://discuss.elastic.co/u/Tonyhu_T)\ **Replies:** 12\ **Last updated:** [December 4, 2022, 12:51pm UTC](https://discuss.elastic.co/t/modify-the-max-bucket-to-report-an-error/320414 "2022-12-04T12:51:05Z")
I use the following command to modify max bucket: PUT \_cluster/settings { "persistent": { "search.max\_buckets": 500000 } } But received the following error message: { "error" : { "root\_cause" : \[ {… --- ## [PHP APM Agent — Log HTTP headers and payload under transaction metadata](https://discuss.elastic.co/t/php-apm-agent-log-http-headers-and-payload-under-transaction-metadata/316810)
**Author:** [@Its\_Anton](https://discuss.elastic.co/u/Its_Anton)\ **Replies:** 1\ **Last updated:** [December 4, 2022, 10:31am UTC](https://discuss.elastic.co/t/php-apm-agent-log-http-headers-and-payload-under-transaction-metadata/316810 "2022-12-04T10:31:27Z")
Hi! Is there a way to log HTTP headers and payload under transaction metadata for PHP agent? I could not find any solution to how to do that. --- ## [Issues in scalling elastic search, version conflicts](https://discuss.elastic.co/t/issues-in-scalling-elastic-search-version-conflicts/320424)
**Author:** [@Manav\_Motwani](https://discuss.elastic.co/u/Manav_Motwani)\ **Replies:** 6\ **Last updated:** [December 4, 2022, 10:31am UTC](https://discuss.elastic.co/t/issues-in-scalling-elastic-search-version-conflicts/320424 "2022-12-04T10:31:15Z")
I will describe my problem as simple as possible, so we have a index which stores product details, but we have 2 primary keys one is product id (unique for every product) and other is city id (we need city id because we … --- ## [Can't get data from php agent inside a container](https://discuss.elastic.co/t/cant-get-data-from-php-agent-inside-a-container/320202)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [December 4, 2022, 10:27am UTC](https://discuss.elastic.co/t/cant-get-data-from-php-agent-inside-a-container/320202 "2022-12-04T10:27:52Z")
Kibana version: 7.17.5 Elasticsearch version: 7.17.5 APM Server version: 7.17.5 APM Agent language and version: 1.6.2 Original install method (e.g. download page, yum, deb, from source, etc.) and version: Curl from… [Previous page](https://discuss.elastic.co/latest.md?page=870) [Next page](https://discuss.elastic.co/latest.md?page=872)