# Latest **URL:** https://discuss.elastic.co/latest.md?page=893 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 894 --- ## [Elasticsearch: I have a dream](https://discuss.elastic.co/t/elasticsearch-i-have-a-dream/319108)
**Author:** [@asdasd](https://discuss.elastic.co/u/asdasd)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 9:35pm UTC](https://discuss.elastic.co/t/elasticsearch-i-have-a-dream/319108 "2022-11-16T21:35:15Z")
elasticsearch: I have a dream，To improve the comprehensive quality of every beginner, and finally make him a great elastic operation and maintenance personnel, we make it very difficult to connect kibana with Elasticsea… --- ## [Kibana Alerts Table Missing Columns](https://discuss.elastic.co/t/kibana-alerts-table-missing-columns/319122)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 5:42pm UTC](https://discuss.elastic.co/t/kibana-alerts-table-missing-columns/319122 "2022-11-16T17:42:15Z")
Hi, The alerts dashboard is showing alerts but there are no columns/values populating for each alert. I am able to view details for an alert, investigate in the timeline, etc but I am not able to see any alert details i… --- ## [Problem with aggregation returning most popular array entry among all documents](https://discuss.elastic.co/t/problem-with-aggregation-returning-most-popular-array-entry-among-all-documents/319127)
**Author:** [@Karol\_Radomski](https://discuss.elastic.co/u/Karol_Radomski)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 8:52pm UTC](https://discuss.elastic.co/t/problem-with-aggregation-returning-most-popular-array-entry-among-all-documents/319127 "2022-11-16T20:52:20Z")
Please help me solve aggregation issue: Lets say I have mapping (...) "properties": { "kidName": { "type": "keyword", "fields": { "txt": { "type": "text", } … --- ## [Gather AWS tags for host running Elastic Agent](https://discuss.elastic.co/t/gather-aws-tags-for-host-running-elastic-agent/319125)
**Author:** [@keiransteele](https://discuss.elastic.co/u/keiransteele)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 7:37pm UTC](https://discuss.elastic.co/t/gather-aws-tags-for-host-running-elastic-agent/319125 "2022-11-16T19:37:24Z")
Currently the only identifiable information when viewing a host in the fleet UI is the hostname and OS, there is some metadata available in the Observability UI (I think metrics needs to be enabled for this?) but there a… --- ## [Aggregation only over the search results](https://discuss.elastic.co/t/aggregation-only-over-the-search-results/319012)
**Author:** [@namespace-Pt](https://discuss.elastic.co/u/namespace-Pt)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 6:32pm UTC](https://discuss.elastic.co/t/aggregation-only-over-the-search-results/319012 "2022-11-16T18:32:57Z")
I found that the terms aggregations always inspect the entire collection, for example I use { "query": { "match": { "text field": "some text" } }, "aggs": { "agg-terms": {… --- ## [Routing error. Problems with "search\_explain" API 7.13.2](https://discuss.elastic.co/t/routing-error-problems-with-search-explain-api-7-13-2/319086)
**Author:** [@Joaquin\_Bahamonde](https://discuss.elastic.co/u/Joaquin_Bahamonde)\ **Replies:** 3\ **Last updated:** [November 16, 2022, 6:26pm UTC](https://discuss.elastic.co/t/routing-error-problems-with-search-explain-api-7-13-2/319086 "2022-11-16T18:26:49Z")
Hi there, I have a problem with elastic enterprise search API 8.5, specifically with the "search\_explain" API. My problem is the following, I did a cURL request to the endpoint specificied in the documentation, but the o… --- ## [I see the following message in logstash after enabling security on elaticsearch side](https://discuss.elastic.co/t/i-see-the-following-message-in-logstash-after-enabling-security-on-elaticsearch-side/319120)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 5:19pm UTC](https://discuss.elastic.co/t/i-see-the-following-message-in-logstash-after-enabling-security-on-elaticsearch-side/319120 "2022-11-16T17:19:45Z")
Hello, I am running elasticsearch cluster 7.9 with logstash to parse logfiles and ingest. After enabling security on elasticsearch I am seeing the following error messages into the logstash logs. \[ERROR\]\[logstash.licen… --- ## [Use Kibana on my local machine to monitor Metricbeat on a remote VM?](https://discuss.elastic.co/t/use-kibana-on-my-local-machine-to-monitor-metricbeat-on-a-remote-vm/317054)
**Author:** [@nola](https://discuss.elastic.co/u/nola)\ **Replies:** 2\ **Last updated:** [October 19, 2022, 10:25pm UTC](https://discuss.elastic.co/t/use-kibana-on-my-local-machine-to-monitor-metricbeat-on-a-remote-vm/317054 "2022-10-19T22:25:14Z")
I have Metricbeat and Elasticsearch installed and running on an AWS EC2 instance. I have Kibana on my local machine. In kibana.yml, I have the server address for the elastic.hosts parameter, and am able to run queries … --- ## [How to drop DNS event if they are present into top 1 million file](https://discuss.elastic.co/t/how-to-drop-dns-event-if-they-are-present-into-top-1-million-file/318981)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 5\ **Last updated:** [November 16, 2022, 4:55pm UTC](https://discuss.elastic.co/t/how-to-drop-dns-event-if-they-are-present-into-top-1-million-file/318981 "2022-11-16T16:55:32Z")
Dear all, I'm wonderion how to configure a logstash pipeline that will handle my DNS logs. From that logs, there are lots of logs I don't want to see because I know they are legitimate. So I would like to have logstash… --- ## [Latest transform fails to fetch preview after running at 100% CPU for more than an hour](https://discuss.elastic.co/t/latest-transform-fails-to-fetch-preview-after-running-at-100-cpu-for-more-than-an-hour/318742)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [November 16, 2022, 4:51pm UTC](https://discuss.elastic.co/t/latest-transform-fails-to-fetch-preview-after-running-at-100-cpu-for-more-than-an-hour/318742 "2022-11-16T16:51:26Z")
Hello I am trying to create a transform from a filebeat 7.15 index on a 7.17 cluster with 4 nodes and sufficient RAM and CPU's. During normal operations the cluster runs smoothly with low CPU usages. In fact the setup i… --- ## [Access to aggregation results using kibana alerting](https://discuss.elastic.co/t/access-to-aggregation-results-using-kibana-alerting/319112)
**Author:** [@Youssef\_Mouadden](https://discuss.elastic.co/u/Youssef_Mouadden)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 4:45pm UTC](https://discuss.elastic.co/t/access-to-aggregation-results-using-kibana-alerting/319112 "2022-11-16T16:45:47Z")
Hello, I'm facing a problem with Kibana alerting: I defined my query DSL and defined an aggregation I want to access the result of the aggregation returned using the query. Kibana only suggest {{context.hits}} but I'm … --- ## [Searching logs by host name](https://discuss.elastic.co/t/searching-logs-by-host-name/316388)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 7\ **Last updated:** [November 16, 2022, 4:33pm UTC](https://discuss.elastic.co/t/searching-logs-by-host-name/316388 "2022-11-16T16:33:31Z")
I have a little quandary. I'd like my customers to easily search for logs by host name. ECS has a field, host.name exactly for that information, but it's keyword, and that requires users know the exact capitalization a… --- ## [Unable to edit settings for agent policy](https://discuss.elastic.co/t/unable-to-edit-settings-for-agent-policy/319096)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 3:32pm UTC](https://discuss.elastic.co/t/unable-to-edit-settings-for-agent-policy/319096 "2022-11-16T15:32:03Z")
Hi, I am trying to install an elastic agent on an apache web server. The problem is that the server is outside my system's network. In order to make it work, I added an output in the fleet settings which should send da… --- ## [Filebeat: send to multiple logstashes instances?](https://discuss.elastic.co/t/filebeat-send-to-multiple-logstashes-instances/319078)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-send-to-multiple-logstashes-instances/319078 "2022-11-16T15:04:59Z")
Dear community, is there some kind of trick / best practice if you want in filebeat to sent to multiple logstash putput instances? I know there is some limitation in place by libbeat, but perhaps there is something you … --- ## [How to Create a Rule Based on Time Range](https://discuss.elastic.co/t/how-to-create-a-rule-based-on-time-range/318998)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 8:06pm UTC](https://discuss.elastic.co/t/how-to-create-a-rule-based-on-time-range/318998 "2022-11-15T20:06:27Z")
I'm trying to create a rule that detects when users login outside business hours (7AM-6PM). I believe this can be done with machine Learning, but I don not have that type of subscription. So, I've tried several ways, alb… --- ## [Elastic support STIX and/or TAXII](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076)
**Author:** [@oyuskeseliev](https://discuss.elastic.co/u/oyuskeseliev)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 3:01pm UTC](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076 "2022-11-16T15:01:40Z")
Hi all, i’m trying to find out if Elastic has support for STIX/TAXII. I do not see any info about this in the documentation, does anyone know? regards Ognyan --- ## [Deprecated Log](https://discuss.elastic.co/t/deprecated-log/319091)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 2:49pm UTC](https://discuss.elastic.co/t/deprecated-log/319091 "2022-11-16T14:49:52Z")
Hello, i'm trying to patch the deprecated settings in my ES cluster v.7.13.x. I runned into these 2 deprecated settings: \[2022-11-16T15:03:23,504\]\[DEPRECATION\]\[o.e.d.c.s.Settings \] \[es-md-01\] \[xpack.security.htt… --- ## [Map의 키가 도큐먼트마다 다른 경우 인덱스 패턴 작성 방법을 알고 싶습니다](https://discuss.elastic.co/t/map/319041)
**Author:** [@ChangJoo\_Park](https://discuss.elastic.co/u/ChangJoo_Park)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:54pm UTC](https://discuss.elastic.co/t/map/319041 "2022-11-16T13:54:14Z")
제가 다루는 도큐먼트 규격은 아래와 같습니다. { // ... 기타 데이터들 photos: { "\<해시된 아이디 1\>": { // "\<해시된 아이디 1\>" 과 연관된 데이터 }, "\<해시된 아이디 1\>": { // "\<해시된 아이디 1\>" 과 연관된 데이터 }, } } 제가 원하는 결과는 키바나 -\> Stack Management -\> 인… --- ## [Filebeat version \> 7.13.X did not correctly process logs from AWS S3 Bucket](https://discuss.elastic.co/t/filebeat-version-7-13-x-did-not-correctly-process-logs-from-aws-s3-bucket/317631)
**Author:** [@anyon486](https://discuss.elastic.co/u/anyon486)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-version-7-13-x-did-not-correctly-process-logs-from-aws-s3-bucket/317631 "2022-11-16T13:50:01Z")
Hi All! I work with filebeat to push logs from AWS RDS databases to a local instance of Elasticsearch. To do this, I configured AWS RDS to publish logs to specific Cloudwatch Log Group/Log Stream, and use AWS Kinesis F… --- ## [Elasticsearch 8.05.00.00 ODBC connection error](https://discuss.elastic.co/t/elasticsearch-8-05-00-00-odbc-connection-error/318341)
**Author:** [@Gianluca\_De\_Pasquale](https://discuss.elastic.co/u/Gianluca_De_Pasquale)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:35pm UTC](https://discuss.elastic.co/t/elasticsearch-8-05-00-00-odbc-connection-error/318341 "2022-11-16T13:35:17Z")
Hi, I want to try out the Elasticsearch ODBC driver for importing data from Microsoft Power Bi . After installation, I created a system DSN configuration, but when I tested the connection, I got the following error : Un… --- ## [Elasticsearch 7.7](https://discuss.elastic.co/t/elasticsearch-7-7/319079)
**Author:** [@Tiger1](https://discuss.elastic.co/u/Tiger1)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:12pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7/319079 "2022-11-16T13:12:26Z")
I'm trying to deploy elasticsearch 7.7 cluster, there's problem: \[es2\] master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes \[es1,… --- ## [Using conditions in watcher](https://discuss.elastic.co/t/using-conditions-in-watcher/318956)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 5\ **Last updated:** [November 16, 2022, 12:55pm UTC](https://discuss.elastic.co/t/using-conditions-in-watcher/318956 "2022-11-16T12:55:41Z")
Hi All, I am trying to add conditions in a watcher. If the value of the ctx.payload.value is less than 100, it should print a particular message "Within the limit". And if not than it should print another message "Limi… --- ## [Put a rule that will allow me to detect brute force](https://discuss.elastic.co/t/put-a-rule-that-will-allow-me-to-detect-brute-force/319080)
**Author:** [@buhu698](https://discuss.elastic.co/u/buhu698)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 12:40pm UTC](https://discuss.elastic.co/t/put-a-rule-that-will-allow-me-to-detect-brute-force/319080 "2022-11-16T12:40:52Z")
Hello, can you help me to put a rule that will allow me to detect brute force. type of rule ( event correlation or indicator match ). From the Kali machine, I run the following command: Hydra –L /usr/share/wordlists/… --- ## [Extract multiple substrings from a field using grok](https://discuss.elastic.co/t/extract-multiple-substrings-from-a-field-using-grok/319071)
**Author:** [@Matan\_Malka](https://discuss.elastic.co/u/Matan_Malka)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 12:26pm UTC](https://discuss.elastic.co/t/extract-multiple-substrings-from-a-field-using-grok/319071 "2022-11-16T12:26:13Z")
Hi, I'm trying to extract the job name ("create-machine") and the build number ("\*\*") from the file path but it is not possible to use duplicate keys. Do you have any other suggestions? input{ file{ path =\> \[ "/bi… --- ## [Kubernetes elastic search and kibana communication issue](https://discuss.elastic.co/t/kubernetes-elastic-search-and-kibana-communication-issue/317023)
**Author:** [@Siva\_Priya](https://discuss.elastic.co/u/Siva_Priya)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 9:47pm UTC](https://discuss.elastic.co/t/kubernetes-elastic-search-and-kibana-communication-issue/317023 "2022-10-19T21:47:11Z")
Am trying to set up the Elasticsearch and kibana in Kubernetes cluster as per the instructions mentioned in How to run Elastic Cloud on Kubernetes from Azure Kubernetes Service | Elastic Blog. Everything is fine But I am… --- ## [Timezone issue](https://discuss.elastic.co/t/timezone-issue/318620)
**Author:** [@MahithaSarala](https://discuss.elastic.co/u/MahithaSarala)\ **Replies:** 10\ **Last updated:** [November 16, 2022, 12:12pm UTC](https://discuss.elastic.co/t/timezone-issue/318620 "2022-11-16T12:12:32Z")
In our current kibana setup , the timezone has been set to browser timezone. This dashboard is live for users in India as well as users in Ireland . The kibana setup is live and linked to spinnaker to monitor the pipelin… --- ## [Update Elasticsearch and Kibana](https://discuss.elastic.co/t/update-elasticsearch-and-kibana/319027)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 6\ **Last updated:** [November 16, 2022, 11:55am UTC](https://discuss.elastic.co/t/update-elasticsearch-and-kibana/319027 "2022-11-16T11:55:48Z")
Hello, I am running on a local server Elasticsearch in version 7.16 and Kibana in version 7.17 I want both to be updated to version 8.5. I have read, that I should use the Update Assistance in the wiki However, when I… --- ## [Search for documents containing words with and without dots (e.g. “ceo”, “c.e.o”, “c.e.o.”)](https://discuss.elastic.co/t/search-for-documents-containing-words-with-and-without-dots-e-g-ceo-c-e-o-c-e-o/319035)
**Author:** [@revencu](https://discuss.elastic.co/u/revencu)\ **Replies:** 11\ **Last updated:** [November 16, 2022, 11:43am UTC](https://discuss.elastic.co/t/search-for-documents-containing-words-with-and-without-dots-e-g-ceo-c-e-o-c-e-o/319035 "2022-11-16T11:43:04Z")
{ "query":{ "match":{ "title": "ceo" } } } this query returns docs that only contain "ceo", "Ceo", "CEO". But the index has values like "c.e.o.", "C.E.O.", "c.e.o" How to set up a query so th… --- ## [How to use condition in canvas markdown render](https://discuss.elastic.co/t/how-to-use-condition-in-canvas-markdown-render/319069)
**Author:** [@tofpad](https://discuss.elastic.co/u/tofpad)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 11:33am UTC](https://discuss.elastic.co/t/how-to-use-condition-in-canvas-markdown-render/319069 "2022-11-16T11:33:09Z")
Hi all, I want to hide a part of the content of a markdown render if there are no entries in my query result. For that i try tu use if in my markdown but i can't make it to work. filters | essql query={string "selec… --- ## [ODBC connected to Power BI not doing "query folding"](https://discuss.elastic.co/t/odbc-connected-to-power-bi-not-doing-query-folding/318028)
**Author:** [@Raul\_Uria](https://discuss.elastic.co/u/Raul_Uria)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 11:15am UTC](https://discuss.elastic.co/t/odbc-connected-to-power-bi-not-doing-query-folding/318028 "2022-11-16T11:15:47Z")
Hi, we´re trying ODBC driver, using it to connect PowerBI to Elasticsearch. We can see data into PowerBI, but performance is less than optimal, it seems like driver is not making "query folding" as "View native query" o… [Previous page](https://discuss.elastic.co/latest.md?page=892) [Next page](https://discuss.elastic.co/latest.md?page=894)