# Latest **URL:** https://discuss.elastic.co/latest.md?page=954 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 955 --- ## [Terms Query by index in dashboards](https://discuss.elastic.co/t/terms-query-by-index-in-dashboards/313717)
**Author:** [@gadelkareem](https://discuss.elastic.co/u/gadelkareem)\ **Replies:** 4\ **Last updated:** [September 26, 2022, 1:52pm UTC](https://discuss.elastic.co/t/terms-query-by-index-in-dashboards/313717 "2022-09-26T13:52:00Z")
I am currently using Terms Query by index to filter a query: { "query": { "bool": { "must": \[ { "terms": { "test.type.name": { … --- ## [Не совпадает время в логе на сервере и в Kibana](https://discuss.elastic.co/t/kibana/314760)
**Author:** [@dbushkov](https://discuss.elastic.co/u/dbushkov)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 1:34pm UTC](https://discuss.elastic.co/t/kibana/314760 "2022-09-26T13:34:30Z")
Не совпадает время в логе на сервере и в Kibana На сервере в логе время такого вида: 2022-09-20T08:57:48+00:00,057840 В Kibana получаю такое время: Sep 20, 2022 @ 15:57:48.225000000 Если я правильно понимаю, Kibana … --- ## [Ordering results based on derivate aggregation](https://discuss.elastic.co/t/ordering-results-based-on-derivate-aggregation/313954)
**Author:** [@Toni\_Heinonen](https://discuss.elastic.co/u/Toni_Heinonen)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 1:32pm UTC](https://discuss.elastic.co/t/ordering-results-based-on-derivate-aggregation/313954 "2022-09-26T13:32:39Z")
I'm working with a audit trail data and trying to make a graph (or even a table) that would list users that have a greatest drop on usage since last month. So far I have tried the following. TSVB: I can get a percenta… --- ## [Creating a line chart in kibana without aggregation](https://discuss.elastic.co/t/creating-a-line-chart-in-kibana-without-aggregation/314383)
**Author:** [@Manasa\_reddy09](https://discuss.elastic.co/u/Manasa_reddy09)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 12:48pm UTC](https://discuss.elastic.co/t/creating-a-line-chart-in-kibana-without-aggregation/314383 "2022-09-26T12:48:09Z")
Hello Folks, I am new to Kibana, although i have worked with other visualization tools before. Kibana is new to me. I know that Kibana is based on Buckets and we need an aggregation to create charts in Kibana.. But when… --- ## [Missing JVM Metrics with Opentelemetry](https://discuss.elastic.co/t/missing-jvm-metrics-with-opentelemetry/315099)
**Author:** [@zirota](https://discuss.elastic.co/u/zirota)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 10:52am UTC](https://discuss.elastic.co/t/missing-jvm-metrics-with-opentelemetry/315099 "2022-09-26T10:52:48Z")
Kibana version: 8.3.3 Elasticsearch version: 8.3.3 APM Server version: 8.3.3 Opentelemetry java agent: 1.18.0 Steps to reproduce: Setup Elasticsearch, Kibana & APM server 8.3.3 Setup Opentelemetry collector to expo… --- ## [General guidance on data replication - Google Cloud](https://discuss.elastic.co/t/general-guidance-on-data-replication-google-cloud/315161)
**Author:** [@Lucien\_Perouze](https://discuss.elastic.co/u/Lucien_Perouze)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 10:09am UTC](https://discuss.elastic.co/t/general-guidance-on-data-replication-google-cloud/315161 "2022-09-26T10:09:34Z")
I'm building a search engine for my app. For that i'm trying Elasticsearch for the first time. My app uses a Postgre SQL. As I understood I need to replicate datas from my Postgre to Elastic Search in order to perform RE… --- ## [Elasticsearch does not start](https://discuss.elastic.co/t/elasticsearch-does-not-start/315156)
**Author:** [@KermitSZ](https://discuss.elastic.co/u/KermitSZ)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start/315156 "2022-09-26T10:07:22Z")
Hello community, We installed elasticsearch following this tutorial Install Elasticsearch with Debian Package | Elasticsearch Guide \[6.8\] | Elastic but the service crashes immediately after running the start command. T… --- ## [Basic license expires today?](https://discuss.elastic.co/t/basic-license-expires-today/315148)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 10:04am UTC](https://discuss.elastic.co/t/basic-license-expires-today/315148 "2022-09-26T10:04:20Z")
Hi, I am running the latest 8.4.2 stack. stack monitoring (/app/monitoring#/home) reports that my basic license expires today. If I go to /app/monitoring#/license?\_g=(cluster\_uuid:xxxxxx) it says: Your Basic license … --- ## [Dashboards based on a subquery](https://discuss.elastic.co/t/dashboards-based-on-a-subquery/315153)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 9:40am UTC](https://discuss.elastic.co/t/dashboards-based-on-a-subquery/315153 "2022-09-26T09:40:06Z")
Hello, I would like to aggregate data into a pie chart based on the newest data for a specific type id. In other words something like category | type\_id | @timestamp category1 | abcd | 2022-08-26 category1 | abcd |… --- ## [Kibana is now available (was degraded), No ML saved objects in need of synchronization](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded-no-ml-saved-objects-in-need-of-synchronization/315121)
**Author:** [@Tushar\_Singh1](https://discuss.elastic.co/u/Tushar_Singh1)\ **Replies:** 5\ **Last updated:** [September 26, 2022, 9:26am UTC](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded-no-ml-saved-objects-in-need-of-synchronization/315121 "2022-09-26T09:26:53Z")
I am not able to open kibana GUI , It is continuously throwing error as \[2022-09-25T22:39:48.677+00:00\]\[INFO \]\[plugins.monitoring.monitoring\] config sourced from: production cluster \[2022-09-25T22:39:50.434+00:00\]\[INF… --- ## [APM stop working after upgrade from 7.17.6 --\> 8.4.2](https://discuss.elastic.co/t/apm-stop-working-after-upgrade-from-7-17-6-8-4-2/315119)
**Author:** [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 9:16am UTC](https://discuss.elastic.co/t/apm-stop-working-after-upgrade-from-7-17-6-8-4-2/315119 "2022-09-26T09:16:25Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [Oauth and token master](https://discuss.elastic.co/t/oauth-and-token-master/315146)
**Author:** [@yasin\_mohammed](https://discuss.elastic.co/u/yasin_mohammed)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 9:12am UTC](https://discuss.elastic.co/t/oauth-and-token-master/315146 "2022-09-26T09:12:50Z")
Hi... We are using elastic stack basic license to begin with till we are able to prove the value of this software. for now we have enabled basic licensing and using local users and password. With the basic version can w… --- ## [Multiple Kibana on multiple cluster with same data](https://discuss.elastic.co/t/multiple-kibana-on-multiple-cluster-with-same-data/313550)
**Author:** [@baneinc](https://discuss.elastic.co/u/baneinc)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 9:10am UTC](https://discuss.elastic.co/t/multiple-kibana-on-multiple-cluster-with-same-data/313550 "2022-09-26T09:10:19Z")
Hi forum, I have multiple (two) elasticsearch clusters, with kafka in front, so both clusters have identical data. How to setup HA kibana (two kibana, one on eachcluster) with loadbalancer in front, so all kibana setti… --- ## [Logstash Pipeline details result in HTTP response code 404](https://discuss.elastic.co/t/logstash-pipeline-details-result-in-http-response-code-404/315151)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 9:09am UTC](https://discuss.elastic.co/t/logstash-pipeline-details-result-in-http-response-code-404/315151 "2022-09-26T09:09:29Z")
Hi, I am running the latest 8.4.2 Elastic stack. If I go to stack monitoring (/app/monitoring#/logstash/pipelines?\_g=(cluster\_uuid:xxxxxx), I get an overview of my pipelines. If I click on the only pipeline that is li… --- ## [Field \[gcp.audit.response.status.conditions.lastHeartbeatTime\] of type \[flattened\] doesn't support formats](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028)
**Author:** [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 9:08am UTC](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028 "2022-09-26T09:08:46Z")
So, I have enabled GCP Audit logs collection using the GCP integration from Elastic Agent 8.3.3. I've had no problems so far running searches in this dataset, but as of today the next error keeps appearing, and now I ca… --- ## [Auditbeat monitor pod audit events](https://discuss.elastic.co/t/auditbeat-monitor-pod-audit-events/315147)
**Author:** [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 8:58am UTC](https://discuss.elastic.co/t/auditbeat-monitor-pod-audit-events/315147 "2022-09-26T08:58:50Z")
hell team, we are using auditbeat run as pod on our k8s work node to monitor the releated audit events happen in node level which is running good, however, is that any possible to monitor audit events which happen in… --- ## [Where do I find Custom Filestream Log integration?](https://discuss.elastic.co/t/where-do-i-find-custom-filestream-log-integration/315142)
**Author:** [@Geoff\_Rob](https://discuss.elastic.co/u/Geoff_Rob)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 8:18am UTC](https://discuss.elastic.co/t/where-do-i-find-custom-filestream-log-integration/315142 "2022-09-26T08:18:23Z")
Hi, I'm trying to find out where to get " Custom Filestream Log integration" ? I see it in the Github repo, in the main branch, merged in several month ago: integrations/packages/filestream at main · elastic/integratio… --- ## [Alert when an event is not followed by another](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527)
**Author:** [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Replies:** 6\ **Last updated:** [September 26, 2022, 8:00am UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527 "2022-09-26T08:00:05Z")
Hello, I am looking for a solution to create an alert when the following happens: An event with the field winlog.event\_id: "4202" occurs. 5 minutes later, no event with the field winlog.event\_id: "4204" was detected. … --- ## [Incremental snapshot after document update and segment](https://discuss.elastic.co/t/incremental-snapshot-after-document-update-and-segment/315139)
**Author:** [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 7:56am UTC](https://discuss.elastic.co/t/incremental-snapshot-after-document-update-and-segment/315139 "2022-09-26T07:56:29Z")
Hello, On a rather large architecture (about 32Tb of data x2 for the replica), we regularly update documents (need in terms of search engine so no regular ingestion, but rather updates of documents once a week). We mak… --- ## [Alphabetic to Basic Latin Unicode](https://discuss.elastic.co/t/alphabetic-to-basic-latin-unicode/315112)
**Author:** [@smkarnan](https://discuss.elastic.co/u/smkarnan)\ **Replies:** 5\ **Last updated:** [September 26, 2022, 7:36am UTC](https://discuss.elastic.co/t/alphabetic-to-basic-latin-unicode/315112 "2022-09-26T07:36:21Z")
How to Elasticsearch Basic Latin character using English Alphabetic Ex:- Francois to François - c also so to include ç Ex:- a also to included ā it's other way around of asciifolding --- ## [Confusing with bucket score and record score in advanced multi metric](https://discuss.elastic.co/t/confusing-with-bucket-score-and-record-score-in-advanced-multi-metric/315134)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 7:01am UTC](https://discuss.elastic.co/t/confusing-with-bucket-score-and-record-score-in-advanced-multi-metric/315134 "2022-09-26T07:01:10Z")
I am confusing about anomaly score now. I make advanced multi metric ml job using below two single metric. Would you explain why bucket score is 84 as record score is only 2 ?? \< advanced multi metric \> And also I… --- ## [How to acheive multiple filter in elastic search using API](https://discuss.elastic.co/t/how-to-acheive-multiple-filter-in-elastic-search-using-api/315131)
**Author:** [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 6:45am UTC](https://discuss.elastic.co/t/how-to-acheive-multiple-filter-in-elastic-search-using-api/315131 "2022-09-26T06:45:29Z")
How could I be able to add multiple filters on my index like in an image I have filtered that result by first\_name and then by category using elasticsearch client @app.route('/get-data') @login\_required def get\_permiss… --- ## [How to set Offset value using java api client for datHistogramAggregation](https://discuss.elastic.co/t/how-to-set-offset-value-using-java-api-client-for-dathistogramaggregation/315124)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 6:07am UTC](https://discuss.elastic.co/t/how-to-set-offset-value-using-java-api-client-for-dathistogramaggregation/315124 "2022-09-26T06:07:18Z")
How to set Offset value using java api client for datHistogramAggregation along with calendarintervals --- ## [Ingest pipeline unable to create new field from message data](https://discuss.elastic.co/t/ingest-pipeline-unable-to-create-new-field-from-message-data/315123)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 5:57am UTC](https://discuss.elastic.co/t/ingest-pipeline-unable-to-create-new-field-from-message-data/315123 "2022-09-26T05:57:40Z")
Hello Team, We are trying to create an ingest pipeline using filebeat for below log pattern to create new field "elasticsearch.slowlog.took\_millis="16"" from below slowlog message, but unable to find proper documentatio… --- ## [ELK Log Push from Device - Proactive Monitoring](https://discuss.elastic.co/t/elk-log-push-from-device-proactive-monitoring/314880)
**Author:** [@Arunachalam\_Jayarama](https://discuss.elastic.co/u/Arunachalam_Jayarama)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 3:51am UTC](https://discuss.elastic.co/t/elk-log-push-from-device-proactive-monitoring/314880 "2022-09-26T03:51:46Z")
Dear All, I am looking for a way, by which we can proactively monitor the log push from 100s of devices to ELK. Recently I came across a problem, devices were connected/configured to push the data to ELK stack, but du… --- ## [\[ERROR\]\[logstash.javapipeline](https://discuss.elastic.co/t/error-logstash-javapipeline/314746)
**Author:** [@wxhgwh](https://discuss.elastic.co/u/wxhgwh)\ **Replies:** 18\ **Last updated:** [September 26, 2022, 3:44am UTC](https://discuss.elastic.co/t/error-logstash-javapipeline/314746 "2022-09-26T03:44:05Z")
\`\`\` \[ERROR\]\[logstash.licensechecker.licensereader\] Unable to retrieve license information fromlicense server {:message=\>"Unsupported or unrecognized SSL message"}Preformatted text \[ERROR\]\[logstash.javapipeline \]\[mai… --- ## [Unhealthy Deployment](https://discuss.elastic.co/t/unhealthy-deployment/315114)
**Author:** [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 2:41am UTC](https://discuss.elastic.co/t/unhealthy-deployment/315114 "2022-09-26T02:41:53Z")
Hi everyone, I have cloud deployment which today went unhealthy. But when I checked the cluster all is healthy. I have 1 Master, 2 Hot and 1 Warm. I checked the status of the index and it going through rollover … --- ## [Action \[indices:data/write/bulk\[s\]\] is unauthorized for API key id of user \[ \]](https://discuss.elastic.co/t/action-indices-data-write-bulk-s-is-unauthorized-for-api-key-id-of-user/313605)
**Author:** [@kgeographer](https://discuss.elastic.co/u/kgeographer)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 1:59am UTC](https://discuss.elastic.co/t/action-indices-data-write-bulk-s-is-unauthorized-for-api-key-id-of-user/313605 "2022-09-26T01:59:32Z")
I have a 7.17 index I access routinely for reads and writes from a Django app with elasticsearch-py, performing snapshots to GCS, etc. This works fine with both the ES 7.17 on a Mac dev laptop against a copy of the prod … --- ## [How does Elasticsearch Splitting an Index Work?](https://discuss.elastic.co/t/how-does-elasticsearch-splitting-an-index-work/313319)
**Author:** [@Hao\_Yellow](https://discuss.elastic.co/u/Hao_Yellow)\ **Replies:** 17\ **Last updated:** [September 26, 2022, 1:37am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-splitting-an-index-work/313319 "2022-09-26T01:37:54Z")
Hello, recently I've been working on splitting some indices with too large shards (not too many), so that the cluster's free disk space is more balanced among the multiple nodes. I read a discussion (see the discussion … --- ## [Want to set ssl.verification\_mode as none for default fleet output in kibana.yml](https://discuss.elastic.co/t/want-to-set-ssl-verification-mode-as-none-for-default-fleet-output-in-kibana-yml/315098)
**Author:** [@Naveen\_Kumar\_Reddy\_S](https://discuss.elastic.co/u/Naveen_Kumar_Reddy_S)\ **Replies:** 0\ **Last updated:** [September 25, 2022, 11:30am UTC](https://discuss.elastic.co/t/want-to-set-ssl-verification-mode-as-none-for-default-fleet-output-in-kibana-yml/315098 "2022-09-25T11:30:51Z")
HI I am trying to send data from fleet managed Elastic agent to elastic master node with self-signed certificate. The auto generated self signed certificate doesnot have the publicip of the node. So to send data i want … [Previous page](https://discuss.elastic.co/latest.md?page=953) [Next page](https://discuss.elastic.co/latest.md?page=955)