# Latest **URL:** https://discuss.elastic.co/latest.md?page=939 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 940 --- ## [How to create table by month grouped by year](https://discuss.elastic.co/t/how-to-create-table-by-month-grouped-by-year/316044)
**Author:** [@LucasTavernier](https://discuss.elastic.co/u/LucasTavernier)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 7:39pm UTC](https://discuss.elastic.co/t/how-to-create-table-by-month-grouped-by-year/316044 "2022-10-07T19:39:44Z")
Hello everyone, i'm new in the ELK stack. I have to to make a table but it's really hard can you please help me. To help you understand what i have to do, i will explain my datas. I got bugs tickets with the id/name o… --- ## [Hide value of legend in Timelion](https://discuss.elastic.co/t/hide-value-of-legend-in-timelion/315470)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 6:41pm UTC](https://discuss.elastic.co/t/hide-value-of-legend-in-timelion/315470 "2022-10-07T18:41:08Z")
Hello! could anyone tell me how can i hide the value of the legend without hide the whole legend? Thanks in advanced! --- ## [Alert Message Data Kibana 8.3](https://discuss.elastic.co/t/alert-message-data-kibana-8-3/315876)
**Author:** [@quixter](https://discuss.elastic.co/u/quixter)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 12:34pm UTC](https://discuss.elastic.co/t/alert-message-data-kibana-8-3/315876 "2022-10-05T12:34:47Z")
I'm creating alerts using the new Alert GUI. Wondering how I would add available fields from the log entries. For an example we have a field called rcm.serverdesc that provided the friendly name of the server the error w… --- ## [Problem with alerting](https://discuss.elastic.co/t/problem-with-alerting/314115)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 6:18pm UTC](https://discuss.elastic.co/t/problem-with-alerting/314115 "2022-10-07T18:18:02Z")
I have a delicate problem in the alert part of elastic security, first I am receiving logs from a security source, and I created a detection rule to alert every time such an event arrives, the rule works perfectly, it is… --- ## [FORCE index rollover](https://discuss.elastic.co/t/force-index-rollover/315958)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 5\ **Last updated:** [October 7, 2022, 5:33pm UTC](https://discuss.elastic.co/t/force-index-rollover/315958 "2022-10-07T17:33:40Z")
Hello, I sheep logs from multiples servers via the winlogbeat agent that are stored with index name ecs-agent-windows. This index is managed by a test0 policy (ILM) and configured with the agent-wingbeat template. The … --- ## [Filebeat ILM policy question](https://discuss.elastic.co/t/filebeat-ilm-policy-question/316077)
**Author:** [@Mark\_Visser](https://discuss.elastic.co/u/Mark_Visser)\ **Replies:** 8\ **Last updated:** [October 7, 2022, 5:11pm UTC](https://discuss.elastic.co/t/filebeat-ilm-policy-question/316077 "2022-10-07T17:11:57Z")
Hello, For my filebeat rollover to work it expects an alias to be set on the index. In the past you were able to pass along a rollover\_alias in the filebeat config but that is not possible anymore. I found you can manu… --- ## [After SAML Configuration, when we try to access we seeing below mentioned error We hit an authentication error. Please check your credentials and try again. If you still can't log in, contact your system administrator](https://discuss.elastic.co/t/after-saml-configuration-when-we-try-to-access-we-seeing-below-mentioned-error-we-hit-an-authentication-error-please-check-your-credentials-and-try-again-if-you-still-cant-log-in-contact-your-system-administrator/316090)
**Author:** [@Elastic\_User3](https://discuss.elastic.co/u/Elastic_User3)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 4:30pm UTC](https://discuss.elastic.co/t/after-saml-configuration-when-we-try-to-access-we-seeing-below-mentioned-error-we-hit-an-authentication-error-please-check-your-credentials-and-try-again-if-you-still-cant-log-in-contact-your-system-administrator/316090 "2022-10-07T16:30:14Z")
Observed error : We hit an authentication error. Please check your credentials and try again. If you still can't log in, contact your system administrator. --- ## [How can I define these variables at PHP.ini?](https://discuss.elastic.co/t/how-can-i-define-these-variables-at-php-ini/315908)
**Author:** [@GustavoPires](https://discuss.elastic.co/u/GustavoPires)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 4:45pm UTC](https://discuss.elastic.co/t/how-can-i-define-these-variables-at-php-ini/315908 "2022-10-07T16:45:51Z")
Hello, I am using Fleetserver and integration with elastic APM, and PHP agent at my application (php.ini). I don't know if I configured elastic\_apm.server\_url at php.ini properly. I want to understand how its works. Wha… --- ## [Problem with geoip plugin and IP whitelist filtering](https://discuss.elastic.co/t/problem-with-geoip-plugin-and-ip-whitelist-filtering/316051)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 4:46pm UTC](https://discuss.elastic.co/t/problem-with-geoip-plugin-and-ip-whitelist-filtering/316051 "2022-10-07T16:46:45Z")
Good morning ! I am using Logstash to fetch data by Wazuh (HIDS) and Suricata (NIDS). So I use the Geoip plugin to geolocate the IPs that connect to my server. My first problem is this: When I do a test by connecting … --- ## [Logstash pipeline.workers](https://discuss.elastic.co/t/logstash-pipeline-workers/316053)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 4:31pm UTC](https://discuss.elastic.co/t/logstash-pipeline-workers/316053 "2022-10-07T16:31:47Z")
Hello! Currently we have our pipeline.yml without defined workers. We understand that we take by default the number of cpu cores of the machine. Should we define all in pipeline.worker: 1 ? How do we decide which work… --- ## [How to reset the kibana fleet settings](https://discuss.elastic.co/t/how-to-reset-the-kibana-fleet-settings/316056)
**Author:** [@lordcosmos1978](https://discuss.elastic.co/u/lordcosmos1978)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 9:47am UTC](https://discuss.elastic.co/t/how-to-reset-the-kibana-fleet-settings/316056 "2022-10-07T09:47:17Z")
Somehow I messed up the fleet setup. I am now unable to start the rollout of a new fleet server. Is there a way ( perhaps deleting the fleet indexes but it wont allow me ) to get back at the first step where you get the… --- ## [Remote\_addr showing 127.0.01](https://discuss.elastic.co/t/remote-addr-showing-127-0-01/315738)
**Author:** [@AkankshaSS](https://discuss.elastic.co/u/AkankshaSS)\ **Replies:** 21\ **Last updated:** [October 7, 2022, 4:20pm UTC](https://discuss.elastic.co/t/remote-addr-showing-127-0-01/315738 "2022-10-07T16:20:46Z")
Hi,I am able to see only 127.0.01 in http-x\_forwarded\_for.Can someone please help me what's the changes required. --- ## [Switch from Watchers to Rules and Connectors](https://discuss.elastic.co/t/switch-from-watchers-to-rules-and-connectors/316088)
**Author:** [@federica.forti](https://discuss.elastic.co/u/federica.forti)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 2:05pm UTC](https://discuss.elastic.co/t/switch-from-watchers-to-rules-and-connectors/316088 "2022-10-07T14:05:40Z")
Hi, we would like to move from watchers to rules (Rule and connectors section). In particular, in the past, we have defined a watcher that performs the following queries / aggregations: { "query": { "bool": { … --- ## [Failed to create query: maxClauseCount is set to 1024](https://discuss.elastic.co/t/failed-to-create-query-maxclausecount-is-set-to-1024/316089)
**Author:** [@GuillermoDelaGala](https://discuss.elastic.co/u/GuillermoDelaGala)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 2:51pm UTC](https://discuss.elastic.co/t/failed-to-create-query-maxclausecount-is-set-to-1024/316089 "2022-10-07T14:51:32Z")
Hi everyone, first of all, saying that I'm quite new with Elasticsearch. I was diving into other similar issues related with my problem, but none of the solutions worked for me. My code has a query which says: failed… --- ## [Elasticsearch 8 Java Client ResponseException status line \[HTTP/1.1 404 Not Found\] {"statusCode":404,"error":"Not Found","message":"Not Found"}](https://discuss.elastic.co/t/elasticsearch-8-java-client-responseexception-status-line-http-1-1-404-not-found-statuscode-404-error-not-found-message-not-found/316019)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 3\ **Last updated:** [October 7, 2022, 2:44pm UTC](https://discuss.elastic.co/t/elasticsearch-8-java-client-responseexception-status-line-http-1-1-404-not-found-statuscode-404-error-not-found-message-not-found/316019 "2022-10-07T14:44:11Z")
Hello, this is Michael from germany and i am reaching out to you because i have to finish my master thesis before 31.10.2022. I had working code in july 2022 which i didn't touch since then. I used the online 2 weeks t… --- ## [“The file could not be processed due to error: “Gateway Timeout”"](https://discuss.elastic.co/t/the-file-could-not-be-processed-due-to-error-gateway-timeout/316079)
**Author:** [@Veera\_V](https://discuss.elastic.co/u/Veera_V)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 1:46pm UTC](https://discuss.elastic.co/t/the-file-could-not-be-processed-due-to-error-gateway-timeout/316079 "2022-10-07T13:46:55Z")
Hi Team, Getting "Gateway Timeout" while importing ES 6.3 dashboard file to OS 1.3, Can any one help here is the time out is due to large json file size ? --- ## [Aggregate whole groups when search machtes only a few items of that group](https://discuss.elastic.co/t/aggregate-whole-groups-when-search-machtes-only-a-few-items-of-that-group/316082)
**Author:** [@lanwin](https://discuss.elastic.co/u/lanwin)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 1:30pm UTC](https://discuss.elastic.co/t/aggregate-whole-groups-when-search-machtes-only-a-few-items-of-that-group/316082 "2022-10-07T13:30:02Z")
Hi, i am looking for a solution of the following problem. I have 20 million "Item" objects. Each Item Object have a GroupId property where 1-5000 Items a grouped together. Each Item has some other properties we can use … --- ## [Remove unhealthy ECE node](https://discuss.elastic.co/t/remove-unhealthy-ece-node/315989)
**Author:** [@UPPERCASE](https://discuss.elastic.co/u/UPPERCASE)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 12:55pm UTC](https://discuss.elastic.co/t/remove-unhealthy-ece-node/315989 "2022-10-07T12:55:46Z")
Going through the ECE tutorial in the Elastic Cloud itself. Due to a node failure I had to reinstall a node, which was part of a cluster. Now when I want to reinstall the ECE setup, I run into this error. Which is likely… --- ## [ILM index rollover error](https://discuss.elastic.co/t/ilm-index-rollover-error/315938)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 6\ **Last updated:** [October 7, 2022, 1:10pm UTC](https://discuss.elastic.co/t/ilm-index-rollover-error/315938 "2022-10-07T13:10:06Z")
Hi everyone, Hope you will be able to help me another time. I have an elasticsearch cluster with an ILM Policy to manage the index rollover. The rollover is based on the index size. Everything was running well. The c… --- ## [Cluster state has not been recovered yet, cannot write to the \[null\] index](https://discuss.elastic.co/t/cluster-state-has-not-been-recovered-yet-cannot-write-to-the-null-index/315945)
**Author:** [@iLucas.Bechlte.exe](https://discuss.elastic.co/u/iLucas.Bechlte.exe)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 1:00pm UTC](https://discuss.elastic.co/t/cluster-state-has-not-been-recovered-yet-cannot-write-to-the-null-index/315945 "2022-10-07T13:00:24Z")
Hi, i try to run an elastic stack with the localhost as the only node. I followed the official installation guide, but when I get to the running check it shows me this error after entering the password: {"error":{"root… --- ## [Multi-node backup and restore to GCS bucket](https://discuss.elastic.co/t/multi-node-backup-and-restore-to-gcs-bucket/316064)
**Author:** [@mohan\_s\_b](https://discuss.elastic.co/u/mohan_s_b)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 11:06am UTC](https://discuss.elastic.co/t/multi-node-backup-and-restore-to-gcs-bucket/316064 "2022-10-07T11:06:19Z")
Hi All, I have deployed multi-node elasticsearch cluster in kubernetes and i wanted to take backup and restore. Since i have multi nodes i am not sure where to install google plugins and to upload service account. --- ## [Rollup job date histogram bucket starts at 00.00 for day interval instead of current time](https://discuss.elastic.co/t/rollup-job-date-histogram-bucket-starts-at-00-00-for-day-interval-instead-of-current-time/316063)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 11:05am UTC](https://discuss.elastic.co/t/rollup-job-date-histogram-bucket-starts-at-00-00-for-day-interval-instead-of-current-time/316063 "2022-10-07T11:05:45Z")
Hello, i tried using rollup job and set date histogram bucket to interval of 24h. After starting the job, creating data view, and viewing it in kibana, the interval starts at 24h from 7 october at 00.00 until yesterday a… --- ## [Вопрос по xml filter plugin](https://discuss.elastic.co/t/xml-filter-plugin/316058)
**Author:** [@Serhio](https://discuss.elastic.co/u/Serhio)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 9:47am UTC](https://discuss.elastic.co/t/xml-filter-plugin/316058 "2022-10-07T09:47:56Z")
Добрый день, Использую plugins-filters-xml для придания данным красивого и удобочитаемого вида, но столкнулся с проблемой что при парсинге содержимое xml разбирается в эластике на огромную кучу полей (один xml тэг - одн… --- ## [Metricbeat 7.17.6 - Cannot index event](https://discuss.elastic.co/t/metricbeat-7-17-6-cannot-index-event/316057)
**Author:** [@jColfej](https://discuss.elastic.co/u/jColfej)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 9:47am UTC](https://discuss.elastic.co/t/metricbeat-7-17-6-cannot-index-event/316057 "2022-10-07T09:47:39Z")
Following our cluster upgrade to Elasticsearch 7.17.6, we had to migrate the monitoring stack using Metricbeat. In Kibana, monitoring is not working, hosts are marked as unmonitored even though Metricbeat is on all host… --- ## [Enrich data using ingest pipeline and enrich policy override data](https://discuss.elastic.co/t/enrich-data-using-ingest-pipeline-and-enrich-policy-override-data/316049)
**Author:** [@Fariddev](https://discuss.elastic.co/u/Fariddev)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 9:07am UTC](https://discuss.elastic.co/t/enrich-data-using-ingest-pipeline-and-enrich-policy-override-data/316049 "2022-10-07T09:07:34Z")
Hi, I want to enrich data in an index (add nationality of authors in books index) using data in another index (authors). I use an ingest pipeline with an enrich policy. Here is a simple example : Indices PUT books { … --- ## [Unable to create token getting below error as Failed to determine the health of the cluster](https://discuss.elastic.co/t/unable-to-create-token-getting-below-error-as-failed-to-determine-the-health-of-the-cluster/316039)
**Author:** [@RChan](https://discuss.elastic.co/u/RChan)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 7:10am UTC](https://discuss.elastic.co/t/unable-to-create-token-getting-below-error-as-failed-to-determine-the-health-of-the-cluster/316039 "2022-10-07T07:10:53Z")
WARN org.elasticsearch.common.ssl.DiagnosticTrustManager - failed to establish trust with server at \[x.x.x.x\]; the server provided a certificate with subject name, fingerprint \[629616647bf0e539b0ca8f616b516df4a356f5af… --- ## [Painless script for the average aggregation based on date difference and one of the date is from params maps](https://discuss.elastic.co/t/painless-script-for-the-average-aggregation-based-on-date-difference-and-one-of-the-date-is-from-params-maps/316036)
**Author:** [@rushikeshsabde](https://discuss.elastic.co/u/rushikeshsabde)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 6:45am UTC](https://discuss.elastic.co/t/painless-script-for-the-average-aggregation-based-on-date-difference-and-one-of-the-date-is-from-params-maps/316036 "2022-10-07T06:45:37Z")
I am trying to calculate the average aggregation based on date difference. Earlier both the date were in the same index, so tired this for the average index: "avg": { "script": { … --- ## [How to get value of API call for Elasticsearch keystore](https://discuss.elastic.co/t/how-to-get-value-of-api-call-for-elasticsearch-keystore/316032)
**Author:** [@Ronak\_Darji](https://discuss.elastic.co/u/Ronak_Darji)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 5:48am UTC](https://discuss.elastic.co/t/how-to-get-value-of-api-call-for-elasticsearch-keystore/316032 "2022-10-07T05:48:33Z")
Curl -XPATCH {{hostname}}/api/v1/clusters/elasticsearch/{cluster\_id}/keystore -H "Authorization: ApiKey $ECE\_API\_KEY" In above Api call what is the hostname, cluster\_id and ECE\_API\_KEY value and from where can i get tho… --- ## [Geography failed](https://discuss.elastic.co/t/geography-failed/315944)
**Author:** [@Jimmy\_Escrich](https://discuss.elastic.co/u/Jimmy_Escrich)\ **Replies:** 7\ **Last updated:** [October 7, 2022, 5:46am UTC](https://discuss.elastic.co/t/geography-failed/315944 "2022-10-07T05:46:01Z")
Hi there, I have an issue with GeometricCollection. I have a field location\_geography configured at geo\_shape. I want to update my document and I have this error : failed to parse field \[location\_geography\] of type \[geo… --- ## [Get POST URL for PDF reports with API](https://discuss.elastic.co/t/get-post-url-for-pdf-reports-with-api/315814)
**Author:** [@Saliinger](https://discuss.elastic.co/u/Saliinger)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 4:48am UTC](https://discuss.elastic.co/t/get-post-url-for-pdf-reports-with-api/315814 "2022-10-07T04:48:22Z")
Hello! Hope you are doing good :smiley: I have a question: It is possible get the URL POST for PDF reports using API? Getting the Copy POST URL with cURL or Postman and not doing it manually as always. Is there an… [Previous page](https://discuss.elastic.co/latest.md?page=938) [Next page](https://discuss.elastic.co/latest.md?page=940)