# Latest **URL:** https://discuss.elastic.co/latest.md?page=895 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 896 --- ## [How Periodic\_flush common setting helpful in ruby logstash filter?](https://discuss.elastic.co/t/how-periodic-flush-common-setting-helpful-in-ruby-logstash-filter/318980)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 6:45pm UTC](https://discuss.elastic.co/t/how-periodic-flush-common-setting-helpful-in-ruby-logstash-filter/318980 "2022-11-15T18:45:37Z")
I added periodic\_flush =\> true in ruby filter but I didn't found any difference. ruby { path =\> \ periodic\_flush =\> true } --- ## [Simple\_query\_string with first term having a + or - operator](https://discuss.elastic.co/t/simple-query-string-with-first-term-having-a-or-operator/318992)
**Author:** [@Geoff\_Mueller](https://discuss.elastic.co/u/Geoff_Mueller)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 6:31pm UTC](https://discuss.elastic.co/t/simple-query-string-with-first-term-having-a-or-operator/318992 "2022-11-15T18:31:39Z")
Question regarding the use of AND (+) and NOT (-) operators when using the simple\_query\_string query. It seems there is some inconsistent behavior when performing a query where the first term has an operator included in… --- ## [Date\_time\_exception: Field Year cannot be printed as the value -292275055 exceeds the maximum print width of 4\]](https://discuss.elastic.co/t/date-time-exception-field-year-cannot-be-printed-as-the-value-292275055-exceeds-the-maximum-print-width-of-4/318900)
**Author:** [@hchen1](https://discuss.elastic.co/u/hchen1)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 6:15pm UTC](https://discuss.elastic.co/t/date-time-exception-field-year-cannot-be-printed-as-the-value-292275055-exceeds-the-maximum-print-width-of-4/318900 "2022-11-15T18:15:28Z")
I got date\_time\_exception after disabling dynamic mapping and adding mapping for a Date attribute like this: "mappings": { "dynamic": false, ........ "updateDate": { "type": "date", … --- ## [Offset point labels on maps](https://discuss.elastic.co/t/offset-point-labels-on-maps/316927)
**Author:** [@Cory34](https://discuss.elastic.co/u/Cory34)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 4:50pm UTC](https://discuss.elastic.co/t/offset-point-labels-on-maps/316927 "2022-11-15T16:50:48Z")
Hi, is there a way to offset point labels on maps so we can display both the point icon and its label without one on top of the other? Thanks! --- ## [Send parts of a message to different Elasticsearch indices from a single Logstash instance](https://discuss.elastic.co/t/send-parts-of-a-message-to-different-elasticsearch-indices-from-a-single-logstash-instance/318950)
**Author:** [@powerful\_clouds](https://discuss.elastic.co/u/powerful_clouds)\ **Replies:** 4\ **Last updated:** [November 15, 2022, 4:14pm UTC](https://discuss.elastic.co/t/send-parts-of-a-message-to-different-elasticsearch-indices-from-a-single-logstash-instance/318950 "2022-11-15T16:14:06Z")
Suppose my message has fields A and B. I want to separately send each of the fields to the same ES instance, but to different indices. Is that possible? E.g. if this is the message: {"A": some text, "B": some more text},… --- ## [DLQ settings to handle bulk ingest encoding error](https://discuss.elastic.co/t/dlq-settings-to-handle-bulk-ingest-encoding-error/318802)
**Author:** [@tharris1](https://discuss.elastic.co/u/tharris1)\ **Replies:** 3\ **Last updated:** [November 15, 2022, 3:43pm UTC](https://discuss.elastic.co/t/dlq-settings-to-handle-bulk-ingest-encoding-error/318802 "2022-11-15T15:43:54Z")
I have a large set of archived data to ingest into Elastic and some of the log entries have encoding issues that building up and causing the logstash ingest pipeline to stall. I have DLQ enabled but still getting indefin… --- ## [Filebeat can not connect to elasticsearch and kibana can not see the data](https://discuss.elastic.co/t/filebeat-can-not-connect-to-elasticsearch-and-kibana-can-not-see-the-data/318975)
**Author:** [@liuxy](https://discuss.elastic.co/u/liuxy)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 3:40pm UTC](https://discuss.elastic.co/t/filebeat-can-not-connect-to-elasticsearch-and-kibana-can-not-see-the-data/318975 "2022-11-15T15:40:57Z")
Hello! I installed elasticsearch and kibana using docker on the server and filebeat on my pc. But when my filebeat tries to setup（filebeat setup）, it shows Exiting: couldn't connect to any of the configured Elasticsear… --- ## [Add file path as a field](https://discuss.elastic.co/t/add-file-path-as-a-field/318966)
**Author:** [@Matan\_Malka](https://discuss.elastic.co/u/Matan_Malka)\ **Replies:** 5\ **Last updated:** [November 15, 2022, 3:40pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966 "2022-11-15T15:40:53Z")
Hey guys, Is it possible to add a field for the file path? input{ file{ path =\> \[ "/bitnami/jenkins/jenkins\_home/jobs/create-machine/builds/\*\*/log", "/bitnami/jenkins/jenkins\_home/jobs/delete-machine/builds/\*\*/log"… --- ## [Auditbeat Connection Refused](https://discuss.elastic.co/t/auditbeat-connection-refused/318809)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 4\ **Last updated:** [November 15, 2022, 3:21pm UTC](https://discuss.elastic.co/t/auditbeat-connection-refused/318809 "2022-11-15T15:21:33Z")
I'm trying to learn how to set up auditbeat on the same server as my elasticsearch and kibana instance verison 8.5 which is running off of ubuntu 20.04. But when I do a systemctl start auditbeat.service, I get the error… --- ## [Plot a table with custom rule based color in background](https://discuss.elastic.co/t/plot-a-table-with-custom-rule-based-color-in-background/318844)
**Author:** [@Tukaram](https://discuss.elastic.co/u/Tukaram)\ **Replies:** 9\ **Last updated:** [November 15, 2022, 2:45pm UTC](https://discuss.elastic.co/t/plot-a-table-with-custom-rule-based-color-in-background/318844 "2022-11-15T14:45:03Z")
Hi, I want to plot a table with custom rule based color for each cell. so, for below table, if debt is more than income, it should be red. if income is more than debt, it should be green. is this possible? how? --- ## [Logstash Pipeline with elasticsearch output missing in Stack Monitoring](https://discuss.elastic.co/t/logstash-pipeline-with-elasticsearch-output-missing-in-stack-monitoring/318439)
**Author:** [@peet](https://discuss.elastic.co/u/peet)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 12:23pm UTC](https://discuss.elastic.co/t/logstash-pipeline-with-elasticsearch-output-missing-in-stack-monitoring/318439 "2022-11-15T12:23:54Z")
Hi! We are currently setting up monitoring for our Logstash instances. Metricbeat on the Logstash is configured as described in the instructions: - module: logstash metricsets: - node - node\_stats xpack.en… --- ## [Logstash document\_id for 3 joined tables](https://discuss.elastic.co/t/logstash-document-id-for-3-joined-tables/318896)
**Author:** [@Swati\_Kanade](https://discuss.elastic.co/u/Swati_Kanade)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 11:58am UTC](https://discuss.elastic.co/t/logstash-document-id-for-3-joined-tables/318896 "2022-11-15T11:58:15Z")
Hi, I am new to ELK stack search. I have created an index by joining 3 tables - message, message\_recipient and message\_attachments - using inner join on message and message\_recipient and left outer join on message\_attach… --- ## [Unable to collect Windows logs through WinLogBeat & ElasticSearch 7.17](https://discuss.elastic.co/t/unable-to-collect-windows-logs-through-winlogbeat-elasticsearch-7-17/318897)
**Author:** [@tranceptor](https://discuss.elastic.co/u/tranceptor)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 7:07pm UTC](https://discuss.elastic.co/t/unable-to-collect-windows-logs-through-winlogbeat-elasticsearch-7-17/318897 "2022-11-14T19:07:41Z")
Hello, I've just installed GrayLog + Elasticsearch and I need to collect Windows logs from a Windows machine. I installed WinLogBeat following this instructions: \[Grant access using API keys | Winlogbeat Reference \[8.5\] … --- ## [Math calculation in kibana to visualize](https://discuss.elastic.co/t/math-calculation-in-kibana-to-visualize/316970)
**Author:** [@Nanditha](https://discuss.elastic.co/u/Nanditha)\ **Replies:** 3\ **Last updated:** [October 19, 2022, 10:07am UTC](https://discuss.elastic.co/t/math-calculation-in-kibana-to-visualize/316970 "2022-10-19T10:07:09Z")
I need to calculate below math calculations and visualize it in dashboard. When i push new data it should calculate the same and change. Can anyone please help on this. precision = tp/ (tp + fp) recall = tp/tp + fn Fal… --- ## [Elastic-agent not fond when running in Docker](https://discuss.elastic.co/t/elastic-agent-not-fond-when-running-in-docker/318948)
**Author:** [@Philip\_Davies1](https://discuss.elastic.co/u/Philip_Davies1)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 10:44am UTC](https://discuss.elastic.co/t/elastic-agent-not-fond-when-running-in-docker/318948 "2022-11-15T10:44:29Z")
Hi All, I am running my ELK setup on a Docker Swarm cluster and I have Kibana, Elasticsearch, Metricbeats all up and running fine. I am trying to setup fleet and deploy my first elastic agent. The container for docker… --- ## [Get most recent hit by some field on Discover](https://discuss.elastic.co/t/get-most-recent-hit-by-some-field-on-discover/318824)
**Author:** [@liorh](https://discuss.elastic.co/u/liorh)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 10:30am UTC](https://discuss.elastic.co/t/get-most-recent-hit-by-some-field-on-discover/318824 "2022-11-15T10:30:23Z")
Hi Attached is a screenshot of my Discover. How can I make it to show me only the most recent row per event.transactionId? I marked those rows. Thank you very much --- ## [Clean up Indices? ..... free some storage](https://discuss.elastic.co/t/clean-up-indices-free-some-storage/318925)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 4\ **Last updated:** [November 15, 2022, 8:06am UTC](https://discuss.elastic.co/t/clean-up-indices-free-some-storage/318925 "2022-11-15T08:06:14Z")
storage utilised over 90% and until now I haven't cleaned up any indices. What would be the perfect way to clean up indices or delete some old index data ? I've searched a lot but there's too much confusion over the in… --- ## [Logstash Pipeline for Sql Server Varbinary Column](https://discuss.elastic.co/t/logstash-pipeline-for-sql-server-varbinary-column/318944)
**Author:** [@ArvindSarkania](https://discuss.elastic.co/u/ArvindSarkania)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 9:25am UTC](https://discuss.elastic.co/t/logstash-pipeline-for-sql-server-varbinary-column/318944 "2022-11-15T09:25:49Z")
Hello Sir I am facing issue with Logstash Pipline WIth JDBC plug in I have a task to insert data into elasticsearch with varbinary input. This is my Conf file input { #columns\_charset =\> { "column0" =\> "UTF8" } jdbc… --- ## [Want to know stable latest elastic version](https://discuss.elastic.co/t/want-to-know-stable-latest-elastic-version/318939)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 9:24am UTC](https://discuss.elastic.co/t/want-to-know-stable-latest-elastic-version/318939 "2022-11-15T09:24:18Z")
We are planning to build ELK cluster in our environment. Need to know which is the latest stable version is good to setup ? --- ## [Creating an enrich policy from collapsed data](https://discuss.elastic.co/t/creating-an-enrich-policy-from-collapsed-data/318629)
**Author:** [@cwe](https://discuss.elastic.co/u/cwe)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 8:23am UTC](https://discuss.elastic.co/t/creating-an-enrich-policy-from-collapsed-data/318629 "2022-11-15T08:23:34Z")
Hi Elastic community I have an index containing many documents per host.id describing the currently running software. This information might change over time, due to software updates. I can use a collapse query to get … --- ## [How to query with GROUP BY and COUNT(\*)](https://discuss.elastic.co/t/how-to-query-with-group-by-and-count/318936)
**Author:** [@Remon\_Andrew](https://discuss.elastic.co/u/Remon_Andrew)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 8:20am UTC](https://discuss.elastic.co/t/how-to-query-with-group-by-and-count/318936 "2022-11-15T08:20:29Z")
Hi all, I have this query that I used to run on MySQL: SELECT from\_mobile\_number, event\_name, COUNT(\*) AS count FROM analytics\_events WHERE date \>= '2022-10-01 00:00:00' AND date \<= '2022-09-30 23:59:59' AND from\_mobil… --- ## [Fleet Agent - CEF Integration - Is there any way to listen on TCP?](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915)
**Author:** [@scanlan](https://discuss.elastic.co/u/scanlan)\ **Replies:** 3\ **Last updated:** [November 15, 2022, 7:57am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915 "2022-11-15T07:57:52Z")
I'm ingesting CEF based logs from another SIEM and utilizing the "Common Event Format (CEF)" integration. It is only able to receive CEF events via input file, or via UDP listener. There is no TCP listener option. A… --- ## [Watcher Email output](https://discuss.elastic.co/t/watcher-email-output/318793)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 7:27am UTC](https://discuss.elastic.co/t/watcher-email-output/318793 "2022-11-15T07:27:25Z")
{ "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ "metricbeat-\*" \], … --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/318924)
**Author:** [@giri1](https://discuss.elastic.co/u/giri1)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 7:10am UTC](https://discuss.elastic.co/t/elasticsearch/318924 "2022-11-15T07:10:12Z")
hey search\_as\_type is not working when i connect it through java. Completion is showing error when i used it with bool query --- ## [Index Pattern error in Kibana 7.10.2](https://discuss.elastic.co/t/index-pattern-error-in-kibana-7-10-2/316888)
**Author:** [@abhi474](https://discuss.elastic.co/u/abhi474)\ **Replies:** 2\ **Last updated:** [October 19, 2022, 4:39am UTC](https://discuss.elastic.co/t/index-pattern-error-in-kibana-7-10-2/316888 "2022-10-19T04:39:59Z")
while creating Index pattern for sample data, I am getting below error : {"type":"error","@timestamp":"2022-10-18T04:31:00Z","tags":\["connection","client","error"\],"pid":63727,"level":"error","error":{"message":"Parse E… --- ## [Generating metrics from documents present in index](https://discuss.elastic.co/t/generating-metrics-from-documents-present-in-index/318130)
**Author:** [@Vikash\_Kumar\_Sharma](https://discuss.elastic.co/u/Vikash_Kumar_Sharma)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 6:14am UTC](https://discuss.elastic.co/t/generating-metrics-from-documents-present-in-index/318130 "2022-11-15T06:14:32Z")
Hi I have an index that has the following documents timestamp:t1, job:j1, status:started timestamp:t2, job:j1, status:completed timestamp:t1, job:j2, status:started timestamp:t2, job:j2, status:completed So from these… --- ## [Kibana error: Unable to retrieve version information from Elasticsearch nodes. socket hang up](https://discuss.elastic.co/t/kibana-error-unable-to-retrieve-version-information-from-elasticsearch-nodes-socket-hang-up/318421)
**Author:** [@grigoryevandrey](https://discuss.elastic.co/u/grigoryevandrey)\ **Replies:** 3\ **Last updated:** [November 15, 2022, 6:07am UTC](https://discuss.elastic.co/t/kibana-error-unable-to-retrieve-version-information-from-elasticsearch-nodes-socket-hang-up/318421 "2022-11-15T06:07:31Z")
I am getting this error inside the kibana container, therefore ingress returns 503 error and container is never ready. When i am doing curl to elasticsearch from inside the kibana container, it successfully returns a re… --- ## [Reindex api errors out while reindexing when documents in the index exceed 2147483519](https://discuss.elastic.co/t/reindex-api-errors-out-while-reindexing-when-documents-in-the-index-exceed-2147483519/318771)
**Author:** [@Srikant\_Magdum](https://discuss.elastic.co/u/Srikant_Magdum)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 6:06am UTC](https://discuss.elastic.co/t/reindex-api-errors-out-while-reindexing-when-documents-in-the-index-exceed-2147483519/318771 "2022-11-15T06:06:57Z")
One of my shard in the index is in red state as the documents in that shard exceeded 2147483519 as below : failed shard on node \[GK1he55KSJmqQXx-qDrPFQ\]: shard failure, reason \[no-op origin\[PRIMARY\] seq#\[350554097\] fail… --- ## [Unable to retrieve version information from Elasticsearch nodes. security\_exception](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/318919)
**Author:** [@Vivek\_Arumugam](https://discuss.elastic.co/u/Vivek_Arumugam)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 6:01am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/318919 "2022-11-15T06:01:43Z")
Hi Team, I am getting the following error while installing kibana.please help on this issue. Unable to retrieve version information from Elasticsearch nodes. security\_exception: \[security\_exception\] Reason: missing aut… --- ## [Unable to start elastic search in AKS cluster, throwing bootstrap errors](https://discuss.elastic.co/t/unable-to-start-elastic-search-in-aks-cluster-throwing-bootstrap-errors/318921)
**Author:** [@sunil\_s](https://discuss.elastic.co/u/sunil_s)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 5:14am UTC](https://discuss.elastic.co/t/unable-to-start-elastic-search-in-aks-cluster-throwing-bootstrap-errors/318921 "2022-11-15T05:14:51Z")
PFB errors {"@timestamp":"2022-11-15T05:06:07.108Z", "log.level": "INFO", "message":"Native controller process has stopped - no new native processes can be started", "ecs.version": "1.2.0","service.name":"ES\_ECS","event… [Previous page](https://discuss.elastic.co/latest.md?page=894) [Next page](https://discuss.elastic.co/latest.md?page=896)