# Latest **URL:** https://discuss.elastic.co/latest.md?page=902 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 903 --- ## [Mapping Conflict with Several Types](https://discuss.elastic.co/t/mapping-conflict-with-several-types/318366)
**Author:** [@JakBains](https://discuss.elastic.co/u/JakBains)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 8:44pm UTC](https://discuss.elastic.co/t/mapping-conflict-with-several-types/318366 "2022-11-09T20:44:37Z")
Hello - my organization recently had an issue where the latest index in our datastream from logstash has the wrong mappings. This has made our IP addresses and geopoints appear as text and keyword types, as a result many… --- ## [How to query documents than not include nested objects field](https://discuss.elastic.co/t/how-to-query-documents-than-not-include-nested-objects-field/318583)
**Author:** [@Volna13](https://discuss.elastic.co/u/Volna13)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 8:41pm UTC](https://discuss.elastic.co/t/how-to-query-documents-than-not-include-nested-objects-field/318583 "2022-11-09T20:41:43Z")
I have a psaInfo field which is nested. It is optional and not available on all events, how can I write a query to get all events where there is no psaInfo field? Here is what I have tried The impression is that the … --- ## [Kibana Monitors (Private Location) APIs](https://discuss.elastic.co/t/kibana-monitors-private-location-apis/316470)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 3\ **Last updated:** [October 12, 2022, 9:47pm UTC](https://discuss.elastic.co/t/kibana-monitors-private-location-apis/316470 "2022-10-12T21:47:25Z")
Hi All, I was wondering if anyone knows where I can find any Kibana API docs (if they exist) for setting up lightweight private location monitors? The docs mention how to use the push command to setup browser monitors, … --- ## [No data straming](https://discuss.elastic.co/t/no-data-straming/318581)
**Author:** [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 6:38pm UTC](https://discuss.elastic.co/t/no-data-straming/318581 "2022-11-09T18:38:24Z")
I am trying to install elastic agent to ship logs and metrics from linux machine to Elastic (fleet server) Elastic version : 8.5 kibana version : 8.5 Elastic-agent version : 8.5 After logging in to kibana and navigati… --- ## [Circuit Breaker Exception](https://discuss.elastic.co/t/circuit-breaker-exception/318572)
**Author:** [@Somya\_Sharma](https://discuss.elastic.co/u/Somya_Sharma)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 6:01pm UTC](https://discuss.elastic.co/t/circuit-breaker-exception/318572 "2022-11-09T18:01:24Z")
{ 'error': { 'type': 'circuit\_breaking\_exception', 'reason': '\[parent\] Data too large, data for \[\\] would be \[123848638/118.1mb\], which is larger than the limit of \[123273216/117.5mb\], real usage: … --- ## [8.5 Elastic Deployment on ECK results in error validation data](https://discuss.elastic.co/t/8-5-elastic-deployment-on-eck-results-in-error-validation-data/318483)
**Author:** [@dataRunner](https://discuss.elastic.co/u/dataRunner)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 12:07am UTC](https://discuss.elastic.co/t/8-5-elastic-deployment-on-eck-results-in-error-validation-data/318483 "2022-11-09T00:07:14Z")
Hi - following the ECK on k8s guide for 8.5 on Azure, I performed the following steps: Created AKS via Azr portal Using the azure command interface, ran the kubectl command to apply the crds.yaml Downloaded the operat… --- ## [Logstash input json splitted by newline "\\n"](https://discuss.elastic.co/t/logstash-input-json-splitted-by-newline-n/318146)
**Author:** [@dmrlixos](https://discuss.elastic.co/u/dmrlixos)\ **Replies:** 7\ **Last updated:** [November 9, 2022, 4:49pm UTC](https://discuss.elastic.co/t/logstash-input-json-splitted-by-newline-n/318146 "2022-11-09T16:49:45Z")
Hi I have a logstash pipeline running on tcp port 8080, that receive a log from another application. These application send logs with header "application/json;charset=UTF-8" and maybe send 1 json line or many json sppl… --- ## [\`Provided Grok expressions do not match field value:\` for logs ingested using nginx elastic agent integration](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-logs-ingested-using-nginx-elastic-agent-integration/318565)
**Author:** [@jolt](https://discuss.elastic.co/u/jolt)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 4:24pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-logs-ingested-using-nginx-elastic-agent-integration/318565 "2022-11-09T16:24:53Z")
We are seeing GROK errors when ingesting nginx logs using the elastic agent nginx integration. The nginx access & error logs are by default written out to stdout and stderr respectively. K8s picks these up and funnels … --- ## [ILM Hot Tier Searchable Snapshots](https://discuss.elastic.co/t/ilm-hot-tier-searchable-snapshots/318043)
**Author:** [@Safty](https://discuss.elastic.co/u/Safty)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 4:18pm UTC](https://discuss.elastic.co/t/ilm-hot-tier-searchable-snapshots/318043 "2022-11-09T16:18:06Z")
What is the use case around Hot Tier Searchable Snapshots in ILM? I was thinking maybe... if you have an s3 repository available, do you need Cold/Frozen at all? Response time and replica requirements notwithstanding, … --- ## [Date\_range field does not refresh my dashboard](https://discuss.elastic.co/t/date-range-field-does-not-refresh-my-dashboard/318328)
**Author:** [@Ilyas\_Badr](https://discuss.elastic.co/u/Ilyas_Badr)\ **Replies:** 9\ **Last updated:** [November 9, 2022, 3:50pm UTC](https://discuss.elastic.co/t/date-range-field-does-not-refresh-my-dashboard/318328 "2022-11-09T15:50:47Z")
I am using kibana to search the document of elasticsearch, somehow my dashboard stopped to be refreshed I found that date\_range filed ,which represents the time that event occurred. any idea how to fix the issue? --- ## [Missing fields from Metricbeat AWS Module](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215)
**Author:** [@chicoco](https://discuss.elastic.co/u/chicoco)\ **Replies:** 6\ **Last updated:** [November 9, 2022, 3:49pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215 "2022-11-09T15:49:21Z")
Hello, I am new to Metricbeat, I want to monitor my AWS services, The overview dashboard is missing a lot of information, I started with EC2 CPU Utilization I found aws.ec2.cpu.total.pct field is missing although I trie… --- ## [Integrating Power Automate flows with Azure Elastic](https://discuss.elastic.co/t/integrating-power-automate-flows-with-azure-elastic/316465)
**Author:** [@mohan.guttula](https://discuss.elastic.co/u/mohan.guttula)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:56pm UTC](https://discuss.elastic.co/t/integrating-power-automate-flows-with-azure-elastic/316465 "2022-10-12T18:56:22Z")
how to ingest telemetry from Power Automate to Azure Elastic ? --- ## [Alerts: Calculate the 99 percentile of a histogram metric](https://discuss.elastic.co/t/alerts-calculate-the-99-percentile-of-a-histogram-metric/318556)
**Author:** [@EDzhelyov](https://discuss.elastic.co/u/EDzhelyov)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 3:37pm UTC](https://discuss.elastic.co/t/alerts-calculate-the-99-percentile-of-a-histogram-metric/318556 "2022-11-09T15:37:09Z")
I have the following Prometheus alert using the etcd\_disk\_wal\_fsync\_duration\_seconds\_bucket metric: histogram\_quantile(0.99, rate(etcd\_disk\_wal\_fsync\_duration\_seconds\_bucket\[1m\])) \> 0.5 What will be equivalen… --- ## [Exporting rules to ndjson generates incomplete file](https://discuss.elastic.co/t/exporting-rules-to-ndjson-generates-incomplete-file/318214)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 2:52pm UTC](https://discuss.elastic.co/t/exporting-rules-to-ndjson-generates-incomplete-file/318214 "2022-11-09T14:52:06Z")
I'm trying to export all the 722 rules into an ndjson file, but the file is incomplete. There are two sets of rule: Elastic rules and Custom rules. I go to Security \> Overview \> Rules \> Select all 722 rules \> Bulk Actio… --- ## [Failed on parsing mappings on index creation \[nyc\_taxis\]](https://discuss.elastic.co/t/failed-on-parsing-mappings-on-index-creation-nyc-taxis/318539)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 11\ **Last updated:** [November 9, 2022, 3:05pm UTC](https://discuss.elastic.co/t/failed-on-parsing-mappings-on-index-creation-nyc-taxis/318539 "2022-11-09T15:05:40Z")
Previously raised issue but the issue is still not fixed. ES Version 8.2.0 ESRally Version: 2.7.0 Running on kubernetes. Using official docker image. Getting below error, message":"failed on parsing mappings on i… --- ## [Remove domain from username](https://discuss.elastic.co/t/remove-domain-from-username/318464)
**Author:** [@aivazisd](https://discuss.elastic.co/u/aivazisd)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 3:05pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464 "2022-11-09T15:05:29Z")
Working with a string: user-identity: Delete IP-User mapping 555.55.55.555 - LOCAL\\user Succeeded - VPN user logout I'm trying to extract the user field without the 'LOCAL'. I can capture the IP and string 'logout' for… --- ## [Help including host name in httpjson post request from UI](https://discuss.elastic.co/t/help-including-host-name-in-httpjson-post-request-from-ui/318456)
**Author:** [@Mark\_Round](https://discuss.elastic.co/u/Mark_Round)\ **Replies:** 0\ **Last updated:** [November 8, 2022, 4:12pm UTC](https://discuss.elastic.co/t/help-including-host-name-in-httpjson-post-request-from-ui/318456 "2022-11-08T16:12:14Z")
I am configuring an HTTPJSON Input from Fleet using the UI and doing a POST on a REST endpoint. I need to send a body in the request. If I hard code the body as json {'hostname': 'currenthostname'} with a host name it w… --- ## [Jenkins metrics using metricbeat](https://discuss.elastic.co/t/jenkins-metrics-using-metricbeat/318508)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 8\ **Last updated:** [November 9, 2022, 1:12pm UTC](https://discuss.elastic.co/t/jenkins-metrics-using-metricbeat/318508 "2022-11-09T13:12:52Z")
Hi, I've installed metricbeat on jenkins server and configured the elasticsearch output and kibana dashboards in metricbeat.yml. After starting metricbeat i am getting too many entries in the dashboard page of elk serve… --- ## [MultiMatchQuery for simple phrase search](https://discuss.elastic.co/t/multimatchquery-for-simple-phrase-search/318542)
**Author:** [@jjc](https://discuss.elastic.co/u/jjc)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 1:05pm UTC](https://discuss.elastic.co/t/multimatchquery-for-simple-phrase-search/318542 "2022-11-09T13:05:52Z")
Hi, i need some help. i'm simply trying to retrieve documents with the word "Cheese" in some of its fields. Below is a sample document. {"caption":"Cheese, An authentic Creole Jambalaya recipe!", "description":"Jamba… --- ## [Ingest Pipeline - ignore\_failure is ignored](https://discuss.elastic.co/t/ingest-pipeline-ignore-failure-is-ignored/318484)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 5\ **Last updated:** [November 9, 2022, 12:19pm UTC](https://discuss.elastic.co/t/ingest-pipeline-ignore-failure-is-ignored/318484 "2022-11-09T12:19:21Z")
Hi, We are attempting to ingest PANW events via filebeat-\>logstash-\>elasticsearch. The filebeat-8.4.0-panw-panos-pipeline fails due to the second processor being: rename "message" to "event.original" Our event alread… --- ## [Filebeat auditd module causes mapping explosion](https://discuss.elastic.co/t/filebeat-auditd-module-causes-mapping-explosion/318205)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 12:07pm UTC](https://discuss.elastic.co/t/filebeat-auditd-module-causes-mapping-explosion/318205 "2022-11-09T12:07:24Z")
Hi folks, I am using Filebeat and auditd module to collect audit logs from linux vm. I am often running into mapping limit because the ingest pipeline creates a new field for every argument given in the log message. f… --- ## [Custom Visualisation using Vega for creating Tag Clous](https://discuss.elastic.co/t/custom-visualisation-using-vega-for-creating-tag-clous/318506)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 11:25am UTC](https://discuss.elastic.co/t/custom-visualisation-using-vega-for-creating-tag-clous/318506 "2022-11-09T11:25:22Z")
I need some help regarding building a custom Vega Tag Cloud. So, my idea here is that we are giving scores to some of the words. So, if a word is negative it should show red color and if it is positive it should show gre… --- ## [Programmatic setup for Java agent not reading server URL setting](https://discuss.elastic.co/t/programmatic-setup-for-java-agent-not-reading-server-url-setting/318522)
**Author:** [@Ong](https://discuss.elastic.co/u/Ong)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 10:39am UTC](https://discuss.elastic.co/t/programmatic-setup-for-java-agent-not-reading-server-url-setting/318522 "2022-11-09T10:39:23Z")
I am setting up APM for a Springboot Java application on maven. The APM server is running on ECE. I followed the guide on the Elastic documentation: Programmatic API setup Configuration I put the APM settings inside … --- ## [App search filters style - performance](https://discuss.elastic.co/t/app-search-filters-style-performance/318530)
**Author:** [@Gerardo\_Zenobi](https://discuss.elastic.co/u/Gerardo_Zenobi)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 10:29am UTC](https://discuss.elastic.co/t/app-search-filters-style-performance/318530 "2022-11-09T10:29:05Z")
Hi there :wave: Following the syntax for search filters, I wanted to know if one of the following ways was recommended/had better performance, given the two produced the same results: option a (nesting the any clause w… --- ## ['Missing' on field aggreagation is not available in Java Client](https://discuss.elastic.co/t/missing-on-field-aggreagation-is-not-available-in-java-client/317679)
**Author:** [@molsza](https://discuss.elastic.co/u/molsza)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 9:59am UTC](https://discuss.elastic.co/t/missing-on-field-aggreagation-is-not-available-in-java-client/317679 "2022-11-09T09:59:20Z")
I am trying to do an aggregation on multi-terms fields and include the cases where there is no value for for fields. The missing property should handle that, but it looks like it cannot be set in Java Client co.elastic.c… --- ## [Cold and frozen node recommended memory specification](https://discuss.elastic.co/t/cold-and-frozen-node-recommended-memory-specification/318520)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 9:38am UTC](https://discuss.elastic.co/t/cold-and-frozen-node-recommended-memory-specification/318520 "2022-11-09T09:38:39Z")
As far as I know, hot node needs 4TB of ssd, how much is cold and frozen node? --- ## [Query\_string does not work with multiple tokens with the same position](https://discuss.elastic.co/t/query-string-does-not-work-with-multiple-tokens-with-the-same-position/318454)
**Author:** [@Alex\_Shkop](https://discuss.elastic.co/u/Alex_Shkop)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 8:30am UTC](https://discuss.elastic.co/t/query-string-does-not-work-with-multiple-tokens-with-the-same-position/318454 "2022-11-09T08:30:04Z")
I'm having troubles with query\_string query when my analyzer returns multiple tokens for the same position. Here's an output of \_analyze for my query: { "tokens" : \[ { "token" : "d", "start\_offset" : 6… --- ## [Not able to sign in using Keycloak in Kibana](https://discuss.elastic.co/t/not-able-to-sign-in-using-keycloak-in-kibana/318435)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 9\ **Last updated:** [November 9, 2022, 8:23am UTC](https://discuss.elastic.co/t/not-able-to-sign-in-using-keycloak-in-kibana/318435 "2022-11-09T08:23:52Z")
Hi, I have integrated ES, Kibana with Keycloak. Both Kibana and ES are https enabled. The below are the configurations I have made in the yml files. ## elasticsearch.yml #Open ID connect settings xpack.security.authc.… --- ## [Multiple pre & post tags in highlighter query](https://discuss.elastic.co/t/multiple-pre-post-tags-in-highlighter-query/318492)
**Author:** [@mayanknc](https://discuss.elastic.co/u/mayanknc)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 7:53am UTC](https://discuss.elastic.co/t/multiple-pre-post-tags-in-highlighter-query/318492 "2022-11-09T07:53:04Z")
Hi I want to highlight individual query string's match result with different pre & post tags. Create Index PUT multilang\_index { "mappings": { "dynamic\_templates": \[ { "stripped\_section\_template": { … --- ## [How to check old pipeline is terminated or not in logstash during config reload](https://discuss.elastic.co/t/how-to-check-old-pipeline-is-terminated-or-not-in-logstash-during-config-reload/318514)
**Author:** [@teja\_tata](https://discuss.elastic.co/u/teja_tata)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 7:25am UTC](https://discuss.elastic.co/t/how-to-check-old-pipeline-is-terminated-or-not-in-logstash-during-config-reload/318514 "2022-11-09T07:25:14Z")
From the above documentation we could see that Logstash swaps the existing pipeline with the new pipeline. If the checks fail, the old pipeline continues to function, and the errors are propagated to the console. How … [Previous page](https://discuss.elastic.co/latest.md?page=901) [Next page](https://discuss.elastic.co/latest.md?page=903)