# Latest **URL:** https://discuss.elastic.co/latest.md?page=956 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 957 --- ## [Timepicker parameters as input to painless scripts](https://discuss.elastic.co/t/timepicker-parameters-as-input-to-painless-scripts/314900)
**Author:** [@antoniolopescorreia](https://discuss.elastic.co/u/antoniolopescorreia)\ **Replies:** 3\ **Last updated:** [September 23, 2022, 6:01pm UTC](https://discuss.elastic.co/t/timepicker-parameters-as-input-to-painless-scripts/314900 "2022-09-23T18:01:21Z")
Is it currently possible to pass the timepicker values as input parameters to runtime painless scripts? The question occurs because I would like to dynamically calculate some time interval value sums, which are calculate… --- ## [Block in coverage\_state Error in Logstash Pipeline](https://discuss.elastic.co/t/block-in-coverage-state-error-in-logstash-pipeline/315040)
**Author:** [@andreakatie](https://discuss.elastic.co/u/andreakatie)\ **Replies:** 2\ **Last updated:** [September 23, 2022, 5:25pm UTC](https://discuss.elastic.co/t/block-in-coverage-state-error-in-logstash-pipeline/315040 "2022-09-23T17:25:42Z")
Hello all, I am running an ELK stack (Elasticsearch v. 7.1.2, Filebeat v. 7.8.0, and Logstash v. 7.16.3) and recently added the following code to a Logstash .conf template (one of many in the stack which has been succes… --- ## [Filebeat log gets flooded if no Kafka topic is available](https://discuss.elastic.co/t/filebeat-log-gets-flooded-if-no-kafka-topic-is-available/314702)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 5:14pm UTC](https://discuss.elastic.co/t/filebeat-log-gets-flooded-if-no-kafka-topic-is-available/314702 "2022-09-23T17:14:42Z")
Hi, I have an issue where Filebeat tries to send data to a Kafka topic that doesn't exist anymore. The Filebeat logs are flooded with: 2022-09-19T13:47:29.111Z INFO \[publisher\] pipeline/retry.go:223 d… --- ## [How to achieve semantic search with ElasticSearch 8.4.2?](https://discuss.elastic.co/t/how-to-achieve-semantic-search-with-elasticsearch-8-4-2/315038)
**Author:** [@Dinesh\_Sonachalam](https://discuss.elastic.co/u/Dinesh_Sonachalam)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 4:48pm UTC](https://discuss.elastic.co/t/how-to-achieve-semantic-search-with-elasticsearch-8-4-2/315038 "2022-09-23T16:48:13Z")
How to achieve semantic search with Elasticsearch 8.4.2? Hi guys, I have a basic understanding of adding semantic search support for ES and added them below. It would be beneficial if you guys share some working examp… --- ## [Detect sessions via timestamp and threshold](https://discuss.elastic.co/t/detect-sessions-via-timestamp-and-threshold/315019)
**Author:** [@SKiD](https://discuss.elastic.co/u/SKiD)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 1:46pm UTC](https://discuss.elastic.co/t/detect-sessions-via-timestamp-and-threshold/315019 "2022-09-23T13:46:53Z")
Hey, I'm not sure if this is the right area to post it, maybe it might be Kibana, but I just give it a try. I'm currently having firewall logs in my indices with timestamp, IP adresses, sent and received bytes and sess… --- ## [Query\_string OR condition score explanation](https://discuss.elastic.co/t/query-string-or-condition-score-explanation/315017)
**Author:** [@Pazhaniyappan](https://discuss.elastic.co/u/Pazhaniyappan)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 1:33pm UTC](https://discuss.elastic.co/t/query-string-or-condition-score-explanation/315017 "2022-09-23T13:33:43Z")
GET index/\_search { "\_source": \[ "\_id", "field" \], "explain": true, "query": { "bool": { "must": \[ { "bool": { "should": \[ { "query\_st… --- ## [Throttled merge](https://discuss.elastic.co/t/throttled-merge/314963)
**Author:** [@Ariel\_Zach](https://discuss.elastic.co/u/Ariel_Zach)\ **Replies:** 3\ **Last updated:** [September 23, 2022, 12:47pm UTC](https://discuss.elastic.co/t/throttled-merge/314963 "2022-09-23T12:47:18Z")
Hello, Currently we have an index of 33TB (ES 7.8), 48 shards (16 primary, 32 replicas), two months ago we deleted a lot of documents and we noticed that one of the shards (the primary and the 2 replicas) has a very lar… --- ## [Elk does not see indexes](https://discuss.elastic.co/t/elk-does-not-see-indexes/315012)
**Author:** [@holpa](https://discuss.elastic.co/u/holpa)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 12:38pm UTC](https://discuss.elastic.co/t/elk-does-not-see-indexes/315012 "2022-09-23T12:38:56Z")
Hello. I'm just learning how to work at ELK. I want to set up the transfer of logs from AD Installed on 1 server: elasticsearch, kibana, logstash 8.4 v 2 server - windows forwarding event - winlogbeat winlogbeat.event… --- ## [EQL: Get only one match (no overlap)](https://discuss.elastic.co/t/eql-get-only-one-match-no-overlap/315014)
**Author:** [@miela](https://discuss.elastic.co/u/miela)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 12:34pm UTC](https://discuss.elastic.co/t/eql-get-only-one-match-no-overlap/315014 "2022-09-23T12:34:10Z")
Hi Let's consider that we have the following event sequence: A, A, A, C, A, B, B, B now I want a EQL query that matches exactly one A, B sequence, the A, B selection can be arbitrary, i.e., the following are, for inst… --- ## [How to clone multiple indices at once within Kibana DevTools](https://discuss.elastic.co/t/how-to-clone-multiple-indices-at-once-within-kibana-devtools/314939)
**Author:** [@fim01](https://discuss.elastic.co/u/fim01)\ **Replies:** 4\ **Last updated:** [September 23, 2022, 12:29pm UTC](https://discuss.elastic.co/t/how-to-clone-multiple-indices-at-once-within-kibana-devtools/314939 "2022-09-23T12:29:22Z")
Hello Is it possible to clone multiple indices in one shot? I tried: POST /test-13,test-14,test-15/\_clone/test-clone Unfortunately I'll get an error: { "error" : { "root\_cause" : \[ { "type" : "… --- ## [Score is same for single value match vs multiple match for an array field using terms query](https://discuss.elastic.co/t/score-is-same-for-single-value-match-vs-multiple-match-for-an-array-field-using-terms-query/314976)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 3\ **Last updated:** [September 23, 2022, 11:42am UTC](https://discuss.elastic.co/t/score-is-same-for-single-value-match-vs-multiple-match-for-an-array-field-using-terms-query/314976 "2022-09-23T11:42:48Z")
PUT dvt\_test\_long/\_doc/1 { "items" : \[1\] } PUT dvt\_test\_long/\_doc/2 { "items" : \[1, 2\] } PUT dvt\_test\_long/\_doc/3 { "items" : \[1, 2, 3\] } PUT dvt\_test\_long/\_doc/4 { "items" : \[1, 2, 3, 4\] } Query: GET d… --- ## [Kibana - Canvas - Conditional coloring in a Table (If Statut = KO -\> Cell Red)](https://discuss.elastic.co/t/kibana-canvas-conditional-coloring-in-a-table-if-statut-ko-cell-red/315008)
**Author:** [@riwalco](https://discuss.elastic.co/u/riwalco)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 11:00am UTC](https://discuss.elastic.co/t/kibana-canvas-conditional-coloring-in-a-table-if-statut-ko-cell-red/315008 "2022-09-23T11:00:42Z")
Hello, I would like to highlight in RED the cells that have the value KO for column Statut : Juste below the code that I have : filters | essql query="SELECT Check\_Date, ID, Statut, Minimum, Valeur, Commentair… --- ## [AuditD module - right usage and syntax of -q flag in auditd rules](https://discuss.elastic.co/t/auditd-module-right-usage-and-syntax-of-q-flag-in-auditd-rules/315009)
**Author:** [@Lukas\_Hubl](https://discuss.elastic.co/u/Lukas_Hubl)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 10:52am UTC](https://discuss.elastic.co/t/auditd-module-right-usage-and-syntax-of-q-flag-in-auditd-rules/315009 "2022-09-23T10:52:19Z")
Hi, I would like to use -q flag in auditd rule, but the rule with the -q flag is not working or even added into the rules list. I have rule like this: -a always,exit -F path=/home/lukashubl/ -q /home/lukashubl/dirtest… --- ## [How span.type is setting if using OTel exporter?](https://discuss.elastic.co/t/how-span-type-is-setting-if-using-otel-exporter/314302)
**Author:** [@gvencadze](https://discuss.elastic.co/u/gvencadze)\ **Replies:** 6\ **Last updated:** [September 23, 2022, 10:51am UTC](https://discuss.elastic.co/t/how-span-type-is-setting-if-using-otel-exporter/314302 "2022-09-23T10:51:49Z")
Hey, I'm trying to send traces over opentelemetry library and send them to Elastic APM (v7.17) via exporter. I saw that there is field in metadata that's called span.type, while using apm-go-agent, I can set value for t… --- ## [Scheduling the generation of a visualisation and saving/caching the result or automated CSV export](https://discuss.elastic.co/t/scheduling-the-generation-of-a-visualisation-and-saving-caching-the-result-or-automated-csv-export/315002)
**Author:** [@Josh\_G](https://discuss.elastic.co/u/Josh_G)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 10:46am UTC](https://discuss.elastic.co/t/scheduling-the-generation-of-a-visualisation-and-saving-caching-the-result-or-automated-csv-export/315002 "2022-09-23T10:46:06Z")
Hello, We are currently using Elastic table visualisations to obtain a record of network connections from a certain group of machines, an example: We are manually generating these on a machine-by-machine basis and e… --- ## [Pod annotation co.elastic.logs/pipeline does not work?](https://discuss.elastic.co/t/pod-annotation-co-elastic-logs-pipeline-does-not-work/313670)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 4\ **Last updated:** [September 23, 2022, 10:14am UTC](https://discuss.elastic.co/t/pod-annotation-co-elastic-logs-pipeline-does-not-work/313670 "2022-09-23T10:14:27Z")
Hi, I have a Logstash pipeline pipeline running in kubernetes. I am collecting all logs from the Kubernetes cluster using filebeat with activated hit based autodiscover. I would like to force filebeat to use a specific … --- ## [No monitoring data found](https://discuss.elastic.co/t/no-monitoring-data-found/314412)
**Author:** [@P-T-I](https://discuss.elastic.co/u/P-T-I)\ **Replies:** 17\ **Last updated:** [September 23, 2022, 10:13am UTC](https://discuss.elastic.co/t/no-monitoring-data-found/314412 "2022-09-23T10:13:51Z")
I'm running kibana/elasticsearch/metricbeats 8.4.1 in a docker configuration. Although I'm seeing the monitoring indexes being created ( .ds-metricbeat-8.4.1-2022.09.14-000001, .ds-.monitoring-kibana-8-mb-2022.09.14-0… --- ## [Query on timeseries data very slow](https://discuss.elastic.co/t/query-on-timeseries-data-very-slow/314815)
**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\ **Replies:** 6\ **Last updated:** [September 23, 2022, 9:37am UTC](https://discuss.elastic.co/t/query-on-timeseries-data-very-slow/314815 "2022-09-23T09:37:49Z")
Hi, this follows previous questions. I have merged all my indices into 1 ilm based index, with a added field that contains the previous "index" name... Generally this is fine, with some performance hit. Queries are gene… --- ## [Best approach to reuse an already existing ELK enviroment to monitor a new E-Commerce Env](https://discuss.elastic.co/t/best-approach-to-reuse-an-already-existing-elk-enviroment-to-monitor-a-new-e-commerce-env/315006)
**Author:** [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 9:36am UTC](https://discuss.elastic.co/t/best-approach-to-reuse-an-already-existing-elk-enviroment-to-monitor-a-new-e-commerce-env/315006 "2022-09-23T09:36:20Z")
Good morning. I've been requested to use an already existing ELK environment that until now has been used to monitor a single E-Commerce App environment. The client is asking me now to reuse this ELK environment to mon… --- ## [Elastic Security - "merge" logs after hostname rename](https://discuss.elastic.co/t/elastic-security-merge-logs-after-hostname-rename/315005)
**Author:** [@Marc\_Spect](https://discuss.elastic.co/u/Marc_Spect)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 9:32am UTC](https://discuss.elastic.co/t/elastic-security-merge-logs-after-hostname-rename/315005 "2022-09-23T09:32:29Z")
Hello, I use Fleet and Security on a Elasticsearch and Kibana dashboard. I received logs for a period of time from a hostname "X", for which I would like to change its name now to "Y". Doing this would generate two host… --- ## [SNMP Pipeline didn't work](https://discuss.elastic.co/t/snmp-pipeline-didnt-work/315003)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 9:29am UTC](https://discuss.elastic.co/t/snmp-pipeline-didnt-work/315003 "2022-09-23T09:29:58Z")
Hello everyone, i'm struggling with snmp pipeline here. i have configured the pipeline like below picture. i used walk and define the tables too. when i run the logstash, there is no error log about this pipeline. it's … --- ## [APM - new transaction created when lambda requests via aws application load balancer](https://discuss.elastic.co/t/apm-new-transaction-created-when-lambda-requests-via-aws-application-load-balancer/314397)
**Author:** [@mcmikeyy](https://discuss.elastic.co/u/mcmikeyy)\ **Replies:** 4\ **Last updated:** [September 23, 2022, 9:07am UTC](https://discuss.elastic.co/t/apm-new-transaction-created-when-lambda-requests-via-aws-application-load-balancer/314397 "2022-09-23T09:07:46Z")
A lambda nodejs app has apm package "elastic-apm-node": "3.38.0" layer extension: layer:elastic-apm-extension-ver-1-1-0-x86\_64:1 using elastic/kibana: 8.2.3 When a nodejs lambda is a target for a load balancer the tra… --- ## ["type"=\>"illegal\_argument\_exception", "reason"=\>"cannot parse empty date"} in logstash logs](https://discuss.elastic.co/t/type-illegal-argument-exception-reason-cannot-parse-empty-date-in-logstash-logs/314991)
**Author:** [@madurad](https://discuss.elastic.co/u/madurad)\ **Replies:** 2\ **Last updated:** [September 23, 2022, 7:36am UTC](https://discuss.elastic.co/t/type-illegal-argument-exception-reason-cannot-parse-empty-date-in-logstash-logs/314991 "2022-09-23T07:36:37Z")
Hello, Getting an error on pushing logs to logstash to elasticseacrch, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field \[message\] of type \[date\] in document with id 'NVWQaIMBa0kW\_rfG7Lb1'… --- ## [Object mapping for \[data.value\] tried to parse field \[value\] as object, but found a concrete value](https://discuss.elastic.co/t/object-mapping-for-data-value-tried-to-parse-field-value-as-object-but-found-a-concrete-value/314867)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [September 23, 2022, 5:44am UTC](https://discuss.elastic.co/t/object-mapping-for-data-value-tried-to-parse-field-value-as-object-but-found-a-concrete-value/314867 "2022-09-23T05:44:03Z")
Hi, I'm trying to read log files from s3 bucket, but for some log lines I'm getting the below error \[WARN \] 2022-09-21 10:43:42.756 \[\[main\]\>worker0\] elasticsearch - Could not index event to Elasticsearch. {:status=\>4… --- ## [Elasticsearch::Transport::Transport::Errors::BadRequest](https://discuss.elastic.co/t/elasticsearch-badrequest/314860)
**Author:** [@Hunaid\_Nawaz](https://discuss.elastic.co/u/Hunaid_Nawaz)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 3:27am UTC](https://discuss.elastic.co/t/elasticsearch-badrequest/314860 "2022-09-23T03:27:41Z")
Hi, I'm facing the error related to the Elasticsearch::Transport. I'm using searchkick gem in rails. elasticsearch version 7.17.4 When i'm doing reindex using searchkick gem it returned this error Elasticsearch::Tran… --- ## [The PHP application is not coming up, After Configuring APM PHP Agent](https://discuss.elastic.co/t/the-php-application-is-not-coming-up-after-configuring-apm-php-agent/314871)
**Author:** [@swathisuryaneni](https://discuss.elastic.co/u/swathisuryaneni)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 1:22pm UTC](https://discuss.elastic.co/t/the-php-application-is-not-coming-up-after-configuring-apm-php-agent/314871 "2022-09-21T13:22:07Z")
Kibana version: 7.16.2 Elasticsearch version: 7.16.2 APM Server version: 7.15.2 APM Agent language and version: apm-agent-php\_1.5.2\_all.apk For Elasticsearch, kibana and APM using docker images Steps Used: I have… --- ## [Heroku review apps not able to access Elasticsearch add-on foundelasticsearch](https://discuss.elastic.co/t/heroku-review-apps-not-able-to-access-elasticsearch-add-on-foundelasticsearch/314984)
**Author:** [@Eric\_Lee1](https://discuss.elastic.co/u/Eric_Lee1)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 1:10am UTC](https://discuss.elastic.co/t/heroku-review-apps-not-able-to-access-elasticsearch-add-on-foundelasticsearch/314984 "2022-09-23T01:10:15Z")
I am trying to deploy my node application with Elasicsearch and I want to use the official Elasticsearch add-on foundelasticsearch into my Heroku application. Here is my workflow: In my node application, I created a… --- ## [Problems getting filebeats to work with API keys](https://discuss.elastic.co/t/problems-getting-filebeats-to-work-with-api-keys/314982)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 12:43am UTC](https://discuss.elastic.co/t/problems-getting-filebeats-to-work-with-api-keys/314982 "2022-09-23T00:43:02Z")
I have just got filebeats (7.17.1) working on a bunch of ubuntu systems. I initially tried to use API keys for authentication but got errors from filebeat "API key: invalid ApiKey value" when it connects to the ES serv… --- ## [Issue with output plugin type elasticsearch in logstash](https://discuss.elastic.co/t/issue-with-output-plugin-type-elasticsearch-in-logstash/314967)
**Author:** [@sbk-elk](https://discuss.elastic.co/u/sbk-elk)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 8:39pm UTC](https://discuss.elastic.co/t/issue-with-output-plugin-type-elasticsearch-in-logstash/314967 "2022-09-22T20:39:39Z")
Hello All, Below is my logstash configuration. I have a few questions with respect to how i added the fields and how they carry over in the stages of my pipeline. Do the fields set in hash in my input plugin are added… --- ## [Is there anyway to use Logstash on Cloud?](https://discuss.elastic.co/t/is-there-anyway-to-use-logstash-on-cloud/314975)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 9:37pm UTC](https://discuss.elastic.co/t/is-there-anyway-to-use-logstash-on-cloud/314975 "2022-09-22T21:37:02Z")
So far I'm aware of the Ingest Pipelines and they are really useful, but I've been using a lot of Logstash plugins (mostly JDBC and HTTP) plusm mutates in a daily basis and so I started wondering if there is also a solut… [Previous page](https://discuss.elastic.co/latest.md?page=955) [Next page](https://discuss.elastic.co/latest.md?page=957)