# Latest **URL:** https://discuss.elastic.co/latest.md?page=880 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 881 --- ## [How to find the button for creating a dashboard?](https://discuss.elastic.co/t/how-to-find-the-button-for-creating-a-dashboard/319976)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 11:24pm UTC](https://discuss.elastic.co/t/how-to-find-the-button-for-creating-a-dashboard/319976 "2022-11-28T23:24:20Z")
Hi, i am stuck in a fresh installed Cloud-Trial version having no option to create a dashboard. What i see if i click on the 3 stripes and then on "dashboard" is: But what i want to see is something l… --- ## [Result window is too large](https://discuss.elastic.co/t/result-window-is-too-large/319979)
**Author:** [@rayyanalbaz1](https://discuss.elastic.co/u/rayyanalbaz1)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 11:01pm UTC](https://discuss.elastic.co/t/result-window-is-too-large/319979 "2022-11-28T23:01:51Z")
Hello, I am facing an issue when using from and size to query the last page for example: my index contains 122000 documents if I specify size = 100 and from = 121000 I get the following error: {"type":"illegal\_argume… --- ## [Logstash Pipeline Tester 2.0 - Now more user friendly](https://discuss.elastic.co/t/logstash-pipeline-tester-2-0-now-more-user-friendly/319984)
**Author:** [@epacke](https://discuss.elastic.co/u/epacke)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 10:05pm UTC](https://discuss.elastic.co/t/logstash-pipeline-tester-2-0-now-more-user-friendly/319984 "2022-11-28T22:05:57Z")
Hi there! A few years ago I wrote a a tool for testing logstash pipelines. This year I did a complete redesign of the web interface using Material UI making it more user friendly. Basically it's a tool that: Gives yo… --- ## [Minimum\_should\_match ignore specific should property](https://discuss.elastic.co/t/minimum-should-match-ignore-specific-should-property/319982)
**Author:** [@hgr](https://discuss.elastic.co/u/hgr)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 9:33pm UTC](https://discuss.elastic.co/t/minimum-should-match-ignore-specific-should-property/319982 "2022-11-28T21:33:50Z")
Hi there, I have a query with 3 should filters, with different boost values, like this "should": \[ { "constant\_score": { "filter": { "term": { … --- ## [Result window is too large when using from and size](https://discuss.elastic.co/t/result-window-is-too-large-when-using-from-and-size/319978)
**Author:** [@rayyanalbaz1](https://discuss.elastic.co/u/rayyanalbaz1)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 9:16pm UTC](https://discuss.elastic.co/t/result-window-is-too-large-when-using-from-and-size/319978 "2022-11-28T21:16:48Z")
(topic deleted by author) --- ## [KQL Comprehensive Tutorial on Event Correlation Rules](https://discuss.elastic.co/t/kql-comprehensive-tutorial-on-event-correlation-rules/318669)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 3\ **Last updated:** [November 28, 2022, 8:05pm UTC](https://discuss.elastic.co/t/kql-comprehensive-tutorial-on-event-correlation-rules/318669 "2022-11-28T20:05:13Z")
I need to build some rather complex rules, but I'm just getting started with KQL. I haven't found any in-depth comprehensive tuts out there on event correlation. Everything is always brief and basic. Anyone know of any g… --- ## [Visualize changes of an aggregation result over time](https://discuss.elastic.co/t/visualize-changes-of-an-aggregation-result-over-time/319897)
**Author:** [@daverin](https://discuss.elastic.co/u/daverin)\ **Replies:** 2\ **Last updated:** [November 28, 2022, 7:53pm UTC](https://discuss.elastic.co/t/visualize-changes-of-an-aggregation-result-over-time/319897 "2022-11-28T19:53:48Z")
Hi there. I have been using Elastic for the past year but I am relatively new to Kibana. Basic info on my setup and usecase: I have my database records streaming into Elastic via Kafka Connect. When a record changes i… --- ## [EQL without pre defined field values](https://discuss.elastic.co/t/eql-without-pre-defined-field-values/318871)
**Author:** [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 7:45pm UTC](https://discuss.elastic.co/t/eql-without-pre-defined-field-values/318871 "2022-11-28T19:45:57Z")
Hi I am in a process of migrating correlation rules from a McAfee SIEM to Elastic Security and I am checking if it is possible to build the following use case in EQL: I am looking at events generated by a security solu… --- ## [TSL: Unable to connect to remote cluster, certificate missing "common-names"](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855)
**Author:** [@hkhalil](https://discuss.elastic.co/u/hkhalil)\ **Replies:** 5\ **Last updated:** [November 28, 2022, 5:51pm UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855 "2022-11-28T17:51:28Z")
Hi, We would like to use markdown to display images on our Kibana dashboards which are hosted in the cloud (i.e.: "Elastic Cloud"). Those images are confidential. As such, we cannot host them on a server accessible fro… --- ## [Filebeat shipping same (rotated) logs over and over](https://discuss.elastic.co/t/filebeat-shipping-same-rotated-logs-over-and-over/319357)
**Author:** [@ori45654](https://discuss.elastic.co/u/ori45654)\ **Replies:** 2\ **Last updated:** [November 28, 2022, 2:40pm UTC](https://discuss.elastic.co/t/filebeat-shipping-same-rotated-logs-over-and-over/319357 "2022-11-28T14:40:47Z")
Hey, I want tp ship .log files from one server to another through filebeat-8.4.2-windows, they're both windows servers. the log files are rotated, from xxx.log to xxx.lo\_ . I'm testing new configurations in filebeat.yml … --- ## [Observability - APM RUM user experience data on SPA route-change](https://discuss.elastic.co/t/observability-apm-rum-user-experience-data-on-spa-route-change/315993)
**Author:** [@john\_b](https://discuss.elastic.co/u/john_b)\ **Replies:** 3\ **Last updated:** [November 28, 2022, 4:21pm UTC](https://discuss.elastic.co/t/observability-apm-rum-user-experience-data-on-spa-route-change/315993 "2022-11-28T16:21:14Z")
I have a question that is a bit similar with APM is working, but not User Experience I'm using the rum agent for a VueJS (nuxt) SPA app and only getting experience data on page-load events and not on route-change. Is t… --- ## [Problem in elasticsearch-create-enrollment-token for Kibana](https://discuss.elastic.co/t/problem-in-elasticsearch-create-enrollment-token-for-kibana/319645)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 6\ **Last updated:** [November 28, 2022, 3:18pm UTC](https://discuss.elastic.co/t/problem-in-elasticsearch-create-enrollment-token-for-kibana/319645 "2022-11-28T15:18:49Z")
Hello all, I have a new installation of Elasticsearch 8.2 and KIbana 8.2 on my Windows Server. I have installed it on a Windows Server. Elasticsearch is up and running and configured to be an Windows Service. I can ac… --- ## [The length of the variable to display on visualization](https://discuss.elastic.co/t/the-length-of-the-variable-to-display-on-visualization/319510)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 5\ **Last updated:** [November 28, 2022, 1:37pm UTC](https://discuss.elastic.co/t/the-length-of-the-variable-to-display-on-visualization/319510 "2022-11-28T13:37:30Z")
Hi, i am sending a variable tag to the logs. I can see the variable value in elastic discovery but I am unable to see the value of that particular variable for a particular value on the lens table. if the length of the … --- ## [How does ELK APM Java Agent get Use details](https://discuss.elastic.co/t/how-does-elk-apm-java-agent-get-use-details/319924)
**Author:** [@sarthik](https://discuss.elastic.co/u/sarthik)\ **Replies:** 3\ **Last updated:** [November 28, 2022, 1:27pm UTC](https://discuss.elastic.co/t/how-does-elk-apm-java-agent-get-use-details/319924 "2022-11-28T13:27:47Z")
I want to know how exactly does APM agent extract user details from the request. I know it is with the help of bearer token, but how and where exactly can I find it so that I can modify it because in my case using an IA… --- ## [Fleet output](https://discuss.elastic.co/t/fleet-output/319834)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 3:42pm UTC](https://discuss.elastic.co/t/fleet-output/319834 "2022-11-25T15:42:17Z")
Is it possible to prevent Kibana from creating a default Fleet output? In my kibana.yml file that preconfigures Kibana before it gets installed I have created a custom fleet output doing the following: xpack.fleet.outp… --- ## [Ingest pipeline](https://discuss.elastic.co/t/ingest-pipeline/319931)
**Author:** [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\ **Replies:** 2\ **Last updated:** [November 28, 2022, 1:19pm UTC](https://discuss.elastic.co/t/ingest-pipeline/319931 "2022-11-28T13:19:23Z")
Hi there, Im new to ELK, and trying to extract some custom log no covered by filebeat module into kibana. So I tried to create a ingest node pipeline between filebeat and ES. So on filebeat.yml: 1) Add the pipeline nam… --- ## [Unable Return Multiple Variables from a transform in Elasticsearch Watcher script](https://discuss.elastic.co/t/unable-return-multiple-variables-from-a-transform-in-elasticsearch-watcher-script/319816)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 2\ **Last updated:** [November 28, 2022, 1:18pm UTC](https://discuss.elastic.co/t/unable-return-multiple-variables-from-a-transform-in-elasticsearch-watcher-script/319816 "2022-11-28T13:18:34Z")
Hi team, I have written a watch script where I need to pass the total hits value from an es search query and also a variable that I have created using transform. I have referred the following link for this -- Watcher: M… --- ## [Messsage throws \[beats\_input\_codec\_plain\_applied, \_grokparsefailure\] although the Grok pattern is accepted in Dev Tools Debugger](https://discuss.elastic.co/t/messsage-throws-beats-input-codec-plain-applied-grokparsefailure-although-the-grok-pattern-is-accepted-in-dev-tools-debugger/319942)
**Author:** [@franknord](https://discuss.elastic.co/u/franknord)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 1:15pm UTC](https://discuss.elastic.co/t/messsage-throws-beats-input-codec-plain-applied-grokparsefailure-although-the-grok-pattern-is-accepted-in-dev-tools-debugger/319942 "2022-11-28T13:15:49Z")
In my Logstash configuration I have a block saying: else if \[fields\]\[source\] == "Scan4SoftwareAndLicenses" { grok { match =\> { "message" =\> "\\"MachineData\\",\\"%{WORD:host\_… --- ## [Fleet enroll with --ca-sha256](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 0\ **Last updated:** [November 27, 2022, 8:43pm UTC](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891 "2022-11-27T20:43:37Z")
Hello, I am trying to enroll an elastic-agent to a self managed fleet server using the --ca-sha256 parameter. I have setup the fleet server security following this guide: If I try to enroll the agent using the follo… --- ## [Max limit context value in Kibana Alerts](https://discuss.elastic.co/t/max-limit-context-value-in-kibana-alerts/319929)
**Author:** [@Danny\_Dijkzeul](https://discuss.elastic.co/u/Danny_Dijkzeul)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 9:45am UTC](https://discuss.elastic.co/t/max-limit-context-value-in-kibana-alerts/319929 "2022-11-28T09:45:10Z")
Hi, I have a short question. In the standard Kibana Alert, there is a way to represent the value as {{context.value}}. However in the message it is always limited to 10.000, is there a way to show the real value? --- ## [Greater throughput in Standalone nodes compared to Multiple instances in same Hardware](https://discuss.elastic.co/t/greater-throughput-in-standalone-nodes-compared-to-multiple-instances-in-same-hardware/319918)
**Author:** [@Ritik\_Singhal](https://discuss.elastic.co/u/Ritik_Singhal)\ **Replies:** 7\ **Last updated:** [November 28, 2022, 12:52pm UTC](https://discuss.elastic.co/t/greater-throughput-in-standalone-nodes-compared-to-multiple-instances-in-same-hardware/319918 "2022-11-28T12:52:07Z")
We found below mentioned stats using esrally on comparing multiple instances on same node with standalone instances .Everything was same including configs and cluster size . | … --- ## [Limo.anomali.com Threat Intelligence End of Life](https://discuss.elastic.co/t/limo-anomali-com-threat-intelligence-end-of-life/319951)
**Author:** [@Johnf](https://discuss.elastic.co/u/Johnf)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 12:36pm UTC](https://discuss.elastic.co/t/limo-anomali-com-threat-intelligence-end-of-life/319951 "2022-11-28T12:36:31Z")
I just noticed that the Filebeat Threat Intelligence module setting for limo.anomali.com was not working. Research indicated that the site is at End of Life Aug 2022. I did submit a request for the follow on replacement … --- ## [Elasticsearch Upgrade from 7.17.1 to 8.4.3](https://discuss.elastic.co/t/elasticsearch-upgrade-from-7-17-1-to-8-4-3/319872)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 11:37am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-from-7-17-1-to-8-4-3/319872 "2022-11-28T11:37:07Z")
Hello, I am upgrading the Elasticsearch instance from 7.5.1 to 8.4.3 but it's not working. I have created an Elasticsearch instance in Ubuntu 18.04 with version 7.5.1 and created a sample index and populated the data. … --- ## [Java exclude framework related classes](https://discuss.elastic.co/t/java-exclude-framework-related-classes/319940)
**Author:** [@APandey](https://discuss.elastic.co/u/APandey)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 11:28am UTC](https://discuss.elastic.co/t/java-exclude-framework-related-classes/319940 "2022-11-28T11:28:14Z")
Hello everyone, How can we filter out framework related classes from the final stack trace that we get for a transaction? For reference, { "stacktrace" : \[ { "exclude\_from\_gro… --- ## [Any esrally track which can index and query at the same time](https://discuss.elastic.co/t/any-esrally-track-which-can-index-and-query-at-the-same-time/319772)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 11:19am UTC](https://discuss.elastic.co/t/any-esrally-track-which-can-index-and-query-at-the-same-time/319772 "2022-11-28T11:19:19Z")
I watched two videos here (Quantitative Cluster Sizing | Elastic / Using Rally to Get Your Elasticsearch Cluster Size Right | Elastic Videos) and both of them emphasize the importance of testing indexing and querying a… --- ## [Getting error on starting elasticsearch ingest.geoip.downloader.enabled: false](https://discuss.elastic.co/t/getting-error-on-starting-elasticsearch-ingest-geoip-downloader-enabled-false/319388)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 24\ **Last updated:** [November 28, 2022, 9:26am UTC](https://discuss.elastic.co/t/getting-error-on-starting-elasticsearch-ingest-geoip-downloader-enabled-false/319388 "2022-11-28T09:26:05Z")
Hi, I have installed elk stack 8.5.1. with authentication without https on elasticsearch xpack.security.http.ssl: enabled: false keystore.path: certs/http.p12 When i start elasticsearch and kibana it shows active, … --- ## [Elasticsearch service fails](https://discuss.elastic.co/t/elasticsearch-service-fails/319650)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 5\ **Last updated:** [November 28, 2022, 9:20am UTC](https://discuss.elastic.co/t/elasticsearch-service-fails/319650 "2022-11-28T09:20:32Z")
Hi i have elk 8.5.1 installed on a machine with 8 gb ram and 50 gb hardisk. i've set jvm options to 2g for elasticsearch and 2g for logstash. I've elk stack +filebeat installed here. and i am getting logs from jenkins, n… --- ## [Can we use basic Elasticsearch for commercial use](https://discuss.elastic.co/t/can-we-use-basic-elasticsearch-for-commercial-use/319710)
**Author:** [@lhy507613824](https://discuss.elastic.co/u/lhy507613824)\ **Replies:** 7\ **Last updated:** [November 28, 2022, 9:10am UTC](https://discuss.elastic.co/t/can-we-use-basic-elasticsearch-for-commercial-use/319710 "2022-11-28T09:10:40Z")
Can we use basic Elasticsearch8.5 for commercial use --- ## [How to get the cpu usage of a user process?](https://discuss.elastic.co/t/how-to-get-the-cpu-usage-of-a-user-process/319919)
**Author:** [@sourabh\_rawat](https://discuss.elastic.co/u/sourabh_rawat)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 8:46am UTC](https://discuss.elastic.co/t/how-to-get-the-cpu-usage-of-a-user-process/319919 "2022-11-28T08:46:25Z")
Hi, I am trying to get the CPU usage of a process running in the user context but the process is not showing on the metrics overview page, I am able to get the details of processes which are running in the root context … --- ## [Disable scroll instructions on map](https://discuss.elastic.co/t/disable-scroll-instructions-on-map/317625)
**Author:** [@Cory34](https://discuss.elastic.co/u/Cory34)\ **Replies:** 5\ **Last updated:** [November 1, 2022, 12:56am UTC](https://discuss.elastic.co/t/disable-scroll-instructions-on-map/317625 "2022-11-01T00:56:00Z")
How do we disable the "Use control + scroll to zoom the map..." message which appears on the map? Thanks. [Previous page](https://discuss.elastic.co/latest.md?page=879) [Next page](https://discuss.elastic.co/latest.md?page=881)