# Latest **URL:** https://discuss.elastic.co/latest.md?page=957 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 958 --- ## [Convert my doc.timestamp as date](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 3\ **Last updated:** [September 22, 2022, 9:08pm UTC](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973 "2022-09-22T21:08:07Z")
I am currently trying to get the date the logs were generated since I only have the date they were processed, I am receiving the logs in log4j xml format. I am unable to convert the UNIX date to this format Sep 22, 2022 … --- ## [O365 module: No such input type exist: 'o365audit'](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 7:52pm UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848 "2022-09-22T19:52:58Z")
The beat is throwing this error: Sep 21 14:57:51 xxxx.lan filebeat\[17245\]: {"log.level":"debug","@timestamp":"2022-09-21T14:57:51.483+0530","log.logger":"processors","log.origin":{"file.name":"processors/processor.go","… --- ## [Elasticsearch 7.10 durability permanent](https://discuss.elastic.co/t/elasticsearch-7-10-durability-permanent/314875)
**Author:** [@Michael\_Sanchez](https://discuss.elastic.co/u/Michael_Sanchez)\ **Replies:** 14\ **Last updated:** [September 22, 2022, 6:45pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-durability-permanent/314875 "2022-09-22T18:45:11Z")
Hello team, My Elasticsearch cluster v7.10 has the following error: reason" : "\[parent\] Data too large, data for \[\\] would be \[17110531128/15.9gb\], which is larger than the limit of \[16320875724/15.1gb\], r… --- ## [\[ERROR\]\[elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/error-elasticsearch-service-unable-to-retrieve-version-information-from-elasticsearch-nodes/306399)
**Author:** [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\ **Replies:** 5\ **Last updated:** [September 22, 2022, 6:10pm UTC](https://discuss.elastic.co/t/error-elasticsearch-service-unable-to-retrieve-version-information-from-elasticsearch-nodes/306399 "2022-09-22T18:10:35Z")
Hi Everyone, I try to install Elasticsearch8.2.2 and Kibana8.2.2 on the one ubuntu20.04 virtual machine. I installed and configured Elasticsearch8.2.2 and get accessed from my local browser successfully. As below picture… --- ## [API Key not enabled](https://discuss.elastic.co/t/api-key-not-enabled/314962)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 5:21pm UTC](https://discuss.elastic.co/t/api-key-not-enabled/314962 "2022-09-22T17:21:11Z")
Hello, I have a cluster with 3 nodes of elasticsearch. In the first node I've installed kibana. Configured TLS/SSL in all cluster nodes. And use credential to communicate with kibana and logstash. My problem is about … --- ## [Logs not showing in observability app but showing in discover](https://discuss.elastic.co/t/logs-not-showing-in-observability-app-but-showing-in-discover/314891)
**Author:** [@Eldorico](https://discuss.elastic.co/u/Eldorico)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 4:52pm UTC](https://discuss.elastic.co/t/logs-not-showing-in-observability-app-but-showing-in-discover/314891 "2022-09-22T16:52:12Z")
Hello, I can see logs in the discover app but no logs in the observability nor security app. I'm using the wazuh module with filebeat. How could I troubleshoot this? debian buster elasticsearch 7.17.5… --- ## [Search\_coordination thread queue filling up. Can we change the setting?](https://discuss.elastic.co/t/search-coordination-thread-queue-filling-up-can-we-change-the-setting/314813)
**Author:** [@elastic\_dude](https://discuss.elastic.co/u/elastic_dude)\ **Replies:** 6\ **Last updated:** [September 22, 2022, 4:38pm UTC](https://discuss.elastic.co/t/search-coordination-thread-queue-filling-up-can-we-change-the-setting/314813 "2022-09-22T16:38:35Z")
Hello, We are operating some Elasticsearch clusters and have noticed in the most queried cluster periodically the search\_coordination thread pool can't keep up, resulting in a queue that then translates to high latency … --- ## [New ECE Student](https://discuss.elastic.co/t/new-ece-student/314957)
**Author:** [@bertwaffles1](https://discuss.elastic.co/u/bertwaffles1)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 4:22pm UTC](https://discuss.elastic.co/t/new-ece-student/314957 "2022-09-22T16:22:08Z")
I am going through the Elastic Certified Engineer course. The videos seem short and the pdf's while long really do not seem to go into details on several items. I do like the labs and I am on module 4 but I feel like I a… --- ## [Maximum age in hot phase vs. Move data into phase in warm phase](https://discuss.elastic.co/t/maximum-age-in-hot-phase-vs-move-data-into-phase-in-warm-phase/314934)
**Author:** [@rosaLux161](https://discuss.elastic.co/u/rosaLux161)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 4:21pm UTC](https://discuss.elastic.co/t/maximum-age-in-hot-phase-vs-move-data-into-phase-in-warm-phase/314934 "2022-09-22T16:21:17Z")
Hey there, I don't understand the difference between the two options. First, in the hot phase I can enter a maximum age after a rollover happens, but then in the warm phase I can also enter a maximum duration when the r… --- ## [Trying to upload a csv to an index fails](https://discuss.elastic.co/t/trying-to-upload-a-csv-to-an-index-fails/314954)
**Author:** [@alter1](https://discuss.elastic.co/u/alter1)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 3:53pm UTC](https://discuss.elastic.co/t/trying-to-upload-a-csv-to-an-index-fails/314954 "2022-09-22T15:53:54Z")
I am trying to load a csv file to an index associated with ILM policies, the first time it was executed it was successful, then I have deleted and recreated the index and the load has not worked again. This is the pipel… --- ## [Dividing buckets values](https://discuss.elastic.co/t/dividing-buckets-values/314938)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 3:13pm UTC](https://discuss.elastic.co/t/dividing-buckets-values/314938 "2022-09-22T15:13:33Z")
Hi Community, Below is my query. It is performing count no. of response\_code and total no. of response\_code using filters aggregation. I want to divide response\_code by total no of response\_code For dividing i used bu… --- ## [How to curl elastic or kibana api for alerts?](https://discuss.elastic.co/t/how-to-curl-elastic-or-kibana-api-for-alerts/314455)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 3:11pm UTC](https://discuss.elastic.co/t/how-to-curl-elastic-or-kibana-api-for-alerts/314455 "2022-09-22T15:11:35Z")
I am learning to use the ELK stack. Both kibana and elasticsearch are installed on my localhost. I just learnt how to install metricbeat and how to set up alerts. When setting up the alerts, I used the index connector… --- ## [What is the default time-frame for a query ? where to configure the same?](https://discuss.elastic.co/t/what-is-the-default-time-frame-for-a-query-where-to-configure-the-same/314946)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 3:00pm UTC](https://discuss.elastic.co/t/what-is-the-default-time-frame-for-a-query-where-to-configure-the-same/314946 "2022-09-22T15:00:01Z")
When the filebeat makes a query, it should be able to specify the time period (say last 1 day, 1hr etc) to get the logs. I am not able to find the config. parameter in the filebeat.yml (or in o365.yml) For instance when… --- ## [Logstash filter for records of nested json messages from eventhub](https://discuss.elastic.co/t/logstash-filter-for-records-of-nested-json-messages-from-eventhub/314930)
**Author:** [@Sivaramakrishhna\_Amb](https://discuss.elastic.co/u/Sivaramakrishhna_Amb)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 2:50pm UTC](https://discuss.elastic.co/t/logstash-filter-for-records-of-nested-json-messages-from-eventhub/314930 "2022-09-22T14:50:03Z")
Input message looks like below { "records": \[ { "level": "Informational", "properties": { "Keywords": 0, "ProviderName": "Core.LogRecord", "Message": "2022-09-08 08:17:02,935 \[23\] INFO {"Message":"9/8/2022 8:17:0… --- ## [Data Storage](https://discuss.elastic.co/t/data-storage/314846)
**Author:** [@ibtissem\_Ben\_lafi](https://discuss.elastic.co/u/ibtissem_Ben_lafi)\ **Replies:** 12\ **Last updated:** [September 22, 2022, 2:01pm UTC](https://discuss.elastic.co/t/data-storage/314846 "2022-09-22T14:01:19Z")
Hello eveyone, I have an issue: The size of the data is not the same in MySQL and Elasticsearch . What can I do for this problem? Someone help me, please --- ## [Elastic Agent configuration for creating new index based on kubernetes namespace](https://discuss.elastic.co/t/elastic-agent-configuration-for-creating-new-index-based-on-kubernetes-namespace/314886)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 1:57pm UTC](https://discuss.elastic.co/t/elastic-agent-configuration-for-creating-new-index-based-on-kubernetes-namespace/314886 "2022-09-22T13:57:22Z")
Hi In filebeat configuration, I could use the following config to create a separate index per kubernetes namespace. output.elasticsearch: indices: - index: '%{\[kubernetes.namespace\]}-%{\[agent.version\]… --- ## [Elasticsearch cluster doesn't work when docker on machine is installed](https://discuss.elastic.co/t/elasticsearch-cluster-doesnt-work-when-docker-on-machine-is-installed/314952)
**Author:** [@simo385](https://discuss.elastic.co/u/simo385)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-doesnt-work-when-docker-on-machine-is-installed/314952 "2022-09-22T13:57:10Z")
Hi Everybody, I have setup an Elasticsearch\[8.4\] cluster (2 nodes) in my aws ec2 machines as follows: EC2\_1 (private IP: 172.31.1.1/32, docker-bridge range: 172.17.0.1/16) --\> in this ec2 I've installed Kubernetes mas… --- ## [ECK Elasticsearch - Performing Full Restart of ES Nodes](https://discuss.elastic.co/t/eck-elasticsearch-performing-full-restart-of-es-nodes/312798)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 8\ **Last updated:** [September 22, 2022, 1:25pm UTC](https://discuss.elastic.co/t/eck-elasticsearch-performing-full-restart-of-es-nodes/312798 "2022-09-22T13:25:08Z")
Hello hello, I would like to ask you whether is possible to perform full restart of ES nodes using ECK operator. Is it possible to do using this? updateStrategy: changeBudget: maxSurge: \ … --- ## [Error fetching fields for data in Security Dashboard](https://discuss.elastic.co/t/error-fetching-fields-for-data-in-security-dashboard/313573)
**Author:** [@GustavoPires](https://discuss.elastic.co/u/GustavoPires)\ **Replies:** 13\ **Last updated:** [September 22, 2022, 1:12pm UTC](https://discuss.elastic.co/t/error-fetching-fields-for-data-in-security-dashboard/313573 "2022-09-22T13:12:16Z")
Hello guys, I am getting the error below when I go to the security dashboard overview: Error fetching fields for data view .alerts-security.alerts-default,apm--transaction,auditbeat-,endgame-,filebeat-,logs-,packetbeat… --- ## [Elasticsearch filter plugin for data enrichment](https://discuss.elastic.co/t/elasticsearch-filter-plugin-for-data-enrichment/314944)
**Author:** [@Hamza\_Khalid](https://discuss.elastic.co/u/Hamza_Khalid)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-for-data-enrichment/314944 "2022-09-22T12:35:27Z")
i have indexed 2 tables from mysql to elasticsearch: user\_index: { id : 1, name : user\_name, hobbies : 1,2 } hobbies\_index: { id : 1, name : hobby1 } id : 2, name : hobby2 } i want to enrich my document a… --- ## [Deep Hierarchy with Count](https://discuss.elastic.co/t/deep-hierarchy-with-count/314943)
**Author:** [@m-dot-jung](https://discuss.elastic.co/u/m-dot-jung)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 12:28pm UTC](https://discuss.elastic.co/t/deep-hierarchy-with-count/314943 "2022-09-22T12:28:06Z")
Hi, I tried modelling a document hierarchy where each record might have a parent record. The maximum depth of this hierarchy is variable. Now, I want to query for certain documents by ID the number of children - best w… --- ## [Linux Auditd monitoring of file operations in mounted folder](https://discuss.elastic.co/t/linux-auditd-monitoring-of-file-operations-in-mounted-folder/314940)
**Author:** [@Lukas\_Hubl](https://discuss.elastic.co/u/Lukas_Hubl)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 12:21pm UTC](https://discuss.elastic.co/t/linux-auditd-monitoring-of-file-operations-in-mounted-folder/314940 "2022-09-22T12:21:51Z")
I have multi node kubernetes cluster and I would like to monitor file operations that are made by containers in mounted persistent volume. I found the all PV data are located at nodes in /var/lib/kubelet/pods/\ **Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 3\ **Last updated:** [September 22, 2022, 10:46am UTC](https://discuss.elastic.co/t/backup-and-restore-of-the-overall-ece-configuration/314901 "2022-09-22T10:46:08Z") Hello, Not found in the documentation, how to backup/restore the ECE environment. (think moving or migrating the full or part of an ECE) KR Henk --- ## [Subtracting two lines in vega chart](https://discuss.elastic.co/t/subtracting-two-lines-in-vega-chart/314847)
**Author:** [@michalruszczyk](https://discuss.elastic.co/u/michalruszczyk)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 10:08am UTC](https://discuss.elastic.co/t/subtracting-two-lines-in-vega-chart/314847 "2022-09-22T10:08:02Z")
Hi, I am trying to create a chart which shows some kind of risk. The logic behind is that I have an index which has Dalue, startDate and endDate. I would like to show the line which is cumulative sum of value with startd… --- ## [Authentication failed for Elasticsearch and Kibana](https://discuss.elastic.co/t/authentication-failed-for-elasticsearch-and-kibana/314931)
**Author:** [@Ahsan\_Yazdani](https://discuss.elastic.co/u/Ahsan_Yazdani)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 9:45am UTC](https://discuss.elastic.co/t/authentication-failed-for-elasticsearch-and-kibana/314931 "2022-09-22T09:45:45Z")
I have download Kibana from git clone directory according to the instructions mentioned in a question on elastic.co like this: git clone https://github.com/\[YOUR\_USERNAME\]/kibana.git kibana cd kibana git fetch origin … --- ## [Elastic Search Not Reflecting Database Changes](https://discuss.elastic.co/t/elastic-search-not-reflecting-database-changes/314916)
**Author:** [@Binish\_Shams](https://discuss.elastic.co/u/Binish_Shams)\ **Replies:** 3\ **Last updated:** [September 22, 2022, 8:54am UTC](https://discuss.elastic.co/t/elastic-search-not-reflecting-database-changes/314916 "2022-09-22T08:54:12Z")
Hello we are using Elasticsearch version 7.16.2. We having synced our Elasticsearch with database using listeners. Usually the Elasticsearch reflects the database changes within no time but once it happened that it took … --- ## [Getting count using aggregation](https://discuss.elastic.co/t/getting-count-using-aggregation/314837)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 8:19am UTC](https://discuss.elastic.co/t/getting-count-using-aggregation/314837 "2022-09-22T08:19:59Z")
Hi Team, { "query": { "bool": { "filter": \[ { "bool": { "should":{ "range": { "@timestamp": { "gte": "now-15m" } } … --- ## [\`block in converge\_state' when setting up output to gelf host](https://discuss.elastic.co/t/block-in-converge-state-when-setting-up-output-to-gelf-host/314862)
**Author:** [@Heffie](https://discuss.elastic.co/u/Heffie)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 8:14am UTC](https://discuss.elastic.co/t/block-in-converge-state-when-setting-up-output-to-gelf-host/314862 "2022-09-22T08:14:33Z")
Hi, Im getting this error: \[2022-09-21T11:32:55,738\]\[FATAL\]\[logstash.runner \] An unexpected error occurred! {:error=\>#\ **Author:** [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 7:26am UTC](https://discuss.elastic.co/t/rdbms-query-transforms-to-elasticsearch-query-dsl/314907 "2022-09-22T07:26:48Z") Hi, I wanted to transform the RDBMS query into elasticsearch query DSL. So the RDBMS query is like below: sum(1) where \ = TODAY() and \ = ’K’ and \ \<\> 0 and \ = 0 And I have transformed that abov… --- ## [How to use offset in DateHistogram.Builder from new java api client](https://discuss.elastic.co/t/how-to-use-offset-in-datehistogram-builder-from-new-java-api-client/314921)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 7:25am UTC](https://discuss.elastic.co/t/how-to-use-offset-in-datehistogram-builder-from-new-java-api-client/314921 "2022-09-22T07:25:35Z")
in old implementation of DateHistogramAggregationBuilder we could pass offset as string, dateHistogramAggregationBuilder.offset(configurationManagementProxy.getStartDayOfWeek() - 1) + "d"); now it requires the offset v… [Previous page](https://discuss.elastic.co/latest.md?page=956) [Next page](https://discuss.elastic.co/latest.md?page=958)