# Latest **URL:** https://discuss.elastic.co/latest.md?page=960 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 961 --- ## [OpenTelemetry, Zipkin and Elastic APM](https://discuss.elastic.co/t/opentelemetry-zipkin-and-elastic-apm/314035)
**Author:** [@tmihaldinec](https://discuss.elastic.co/u/tmihaldinec)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 5:41pm UTC](https://discuss.elastic.co/t/opentelemetry-zipkin-and-elastic-apm/314035 "2022-09-20T17:41:15Z")
Hi We are mostly using Elastic APM with native elastic apm agents (java mostly) One of the best perks is that we can also do correlation with logs which are already mostly in ECS format. Now, problem which we are faci… --- ## [Kibana - Monitoring Management - Delete Project Monitors](https://discuss.elastic.co/t/kibana-monitoring-management-delete-project-monitors/314631)
**Author:** [@adsandie](https://discuss.elastic.co/u/adsandie)\ **Replies:** 6\ **Last updated:** [September 20, 2022, 5:03pm UTC](https://discuss.elastic.co/t/kibana-monitoring-management-delete-project-monitors/314631 "2022-09-20T17:03:15Z")
Hi, i tested docker elastic-agent-complete 8.4.1 and created a test uptime/synthetics project monitor, how do you delete it? It is saying that the monitor was added as an external project. to delete the monitor, remove i… --- ## [Not able to edit rules](https://discuss.elastic.co/t/not-able-to-edit-rules/314643)
**Author:** [@UweW](https://discuss.elastic.co/u/UweW)\ **Replies:** 11\ **Last updated:** [September 20, 2022, 5:01pm UTC](https://discuss.elastic.co/t/not-able-to-edit-rules/314643 "2022-09-20T17:01:39Z")
Hi, after updating from 8.2.3 to 8.4 it's no longer possible to edit the existing rules. Every time "Object type "siem.queryRule" is not registered." is shown. Hope somebody has an idea how to fix. another error occu… --- ## [How to convert this date type to a readable type '1661126482845'](https://discuss.elastic.co/t/how-to-convert-this-date-type-to-a-readable-type-1661126482845/314782)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 4:00pm UTC](https://discuss.elastic.co/t/how-to-convert-this-date-type-to-a-readable-type-1661126482845/314782 "2022-09-20T16:00:36Z")
I need to convert this date type to a readable date type in my file. conf, I'm using the json filter. I've tried several conversion models but it's not working. can anybody help me? --- ## [Rollover actions over custom field](https://discuss.elastic.co/t/rollover-actions-over-custom-field/314784)
**Author:** [@Nicolaegis](https://discuss.elastic.co/u/Nicolaegis)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 3:50pm UTC](https://discuss.elastic.co/t/rollover-actions-over-custom-field/314784 "2022-09-20T15:50:11Z")
Hello, I would like to know if it is possible to make a rollover action for a custom date field, if not, it is possible to write a custom plugin to achieve this? Thank you --- ## [Elastic Endpoint cannot send alerts to kibana](https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644)
**Author:** [@Fatima](https://discuss.elastic.co/u/Fatima)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 3:24pm UTC](https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644 "2022-09-20T15:24:39Z")
Hi people, I have configured the beats and EDR and I am getting all the events from the different hosts. I have enabled all the preset security rules but I am not getting any alerts. This is the message I get when doi… --- ## [Watcher Query with filter](https://discuss.elastic.co/t/watcher-query-with-filter/314600)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 1:45pm UTC](https://discuss.elastic.co/t/watcher-query-with-filter/314600 "2022-09-20T13:45:07Z")
Hi all, I am new and testing Watcher but for some reason I am not getting any hits count from this search. I am trying to search "Authentication failure" in the syslog index, get alerted if any hits are found in the la… --- ## [Query time increased after upgrade to ES version 8.3](https://discuss.elastic.co/t/query-time-increased-after-upgrade-to-es-version-8-3/314778)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 1:33pm UTC](https://discuss.elastic.co/t/query-time-increased-after-upgrade-to-es-version-8-3/314778 "2022-09-20T13:33:49Z")
Hello We are facing an issue with elasticsearch query performance where we are trying to query elasticsearch index it is recording more than 5 second for most of the queries, we are testing through jmeter Before versio… --- ## [Documents are no longer saved after high disk watermark exceeded on an elasticsearch cluster](https://discuss.elastic.co/t/documents-are-no-longer-saved-after-high-disk-watermark-exceeded-on-an-elasticsearch-cluster/313975)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 9\ **Last updated:** [September 19, 2022, 2:53pm UTC](https://discuss.elastic.co/t/documents-are-no-longer-saved-after-high-disk-watermark-exceeded-on-an-elasticsearch-cluster/313975 "2022-09-19T14:53:28Z")
Hi everyone, I have a question about how load balance work on an elasticsearch servers cluster. The cluster is composed by : 4 "master, data" nodes, 2 "data" nodes 1 "coordinator" node The warning "high disk waterma… --- ## [Forcing specific transactions to be sampled](https://discuss.elastic.co/t/forcing-specific-transactions-to-be-sampled/314573)
**Author:** [@kbalys](https://discuss.elastic.co/u/kbalys)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 12:16pm UTC](https://discuss.elastic.co/t/forcing-specific-transactions-to-be-sampled/314573 "2022-09-20T12:16:30Z")
Hi, I use Transaction Sampling configured to 0.1 as described here: Core configuration options | APM .NET Agent Reference \[1.12\] | Elastic 10% of transactions are recorded which is fine. I would like, however, to skip … --- ## [I m unable to restart the logstash after updating the conf.d file](https://discuss.elastic.co/t/i-m-unable-to-restart-the-logstash-after-updating-the-conf-d-file/314768)
**Author:** [@prashanthk](https://discuss.elastic.co/u/prashanthk)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 12:06pm UTC](https://discuss.elastic.co/t/i-m-unable-to-restart-the-logstash-after-updating-the-conf-d-file/314768 "2022-09-20T12:06:02Z")
Im unable to start logstash after updating the conf.d file in logstash. i checked the logs it is showing as Attempted to resurrect connection to dead ES instance, but got an error. I need to start the logstash now. --- ## [Fleetserver installation](https://discuss.elastic.co/t/fleetserver-installation/314719)
**Author:** [@ttyser](https://discuss.elastic.co/u/ttyser)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 6:17pm UTC](https://discuss.elastic.co/t/fleetserver-installation/314719 "2022-09-19T18:17:05Z")
Hello, After spending hours trying different types of configurations and running in circles through all the documentation I will try to find help here. The following setup is done completely on Proxmox. It should help … --- ## [Slow querying of elasticsearch logs](https://discuss.elastic.co/t/slow-querying-of-elasticsearch-logs/314751)
**Author:** [@Faisal\_Umer](https://discuss.elastic.co/u/Faisal_Umer)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 10:44am UTC](https://discuss.elastic.co/t/slow-querying-of-elasticsearch-logs/314751 "2022-09-20T10:44:35Z")
We have an index with 90 primaries & 0 replicas and a new index is created each day. The volume grows up to 7-8TB per day. We have lifecycle policies where the index is moved from hot to warm nodes after 3 days and then … --- ## [Creating alert for low disk space (any server had less than 200mb free space for the /mount/logs mount point))](https://discuss.elastic.co/t/creating-alert-for-low-disk-space-any-server-had-less-than-200mb-free-space-for-the-mount-logs-mount-point/314769)
**Author:** [@Madhu24](https://discuss.elastic.co/u/Madhu24)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 10:23am UTC](https://discuss.elastic.co/t/creating-alert-for-low-disk-space-any-server-had-less-than-200mb-free-space-for-the-mount-logs-mount-point/314769 "2022-09-20T10:23:45Z")
Can anyome help to write how can write a scrit to trigger notification to a slack channel using below sample and how to add aggregations for this and conditon as well. Thanks { "trigger": { "schedule": "60m" } }, "… --- ## [How to saved a query using API](https://discuss.elastic.co/t/how-to-saved-a-query-using-api/314683)
**Author:** [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)\ **Replies:** 3\ **Last updated:** [September 20, 2022, 10:05am UTC](https://discuss.elastic.co/t/how-to-saved-a-query-using-api/314683 "2022-09-20T10:05:51Z")
I am filtering out the elastic sample data using the elasticsearch client but how could I achieve to create a saved object using API (using Elasticsearch client) and apply it There is documentation for saved objects AP… --- ## [ElasticSearch: DSL Query](https://discuss.elastic.co/t/elasticsearch-dsl-query/314767)
**Author:** [@SalvoDM91](https://discuss.elastic.co/u/SalvoDM91)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 9:58am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-query/314767 "2022-09-20T09:58:49Z")
Hi guys, I am opening this topic because I have a problem with a large amount of data (14M). My dataset is composed as follows: {"h":{"id":"AA001","process":"AK01","update-timestamp":1663665372171}} {"h":{"id":"AA002",… --- ## [Cluster ElasticSearch Red](https://discuss.elastic.co/t/cluster-elasticsearch-red/314757)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 9:10am UTC](https://discuss.elastic.co/t/cluster-elasticsearch-red/314757 "2022-09-20T09:10:10Z")
Hello everyone, here is my problem, I have my elastic cluster with a red status. I used this api : http://localhost:9200/\_cluster/health Answer: { cluster\_name : "elasticsearch", status : "red", timed\_out : false, num… --- ## [Logstash JDBC - All rows run only once](https://discuss.elastic.co/t/logstash-jdbc-all-rows-run-only-once/314756)
**Author:** [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 8:54am UTC](https://discuss.elastic.co/t/logstash-jdbc-all-rows-run-only-once/314756 "2022-09-20T08:54:53Z")
I want to migrate DB table data with millions of rows to S3. I found jdbc plugin. But not clear how to make it run only once for all rows paginated way - The main question is on Scheduling: I don't want to run repeatedly… --- ## [How to detect and send bucket score merging 2 ML Job](https://discuss.elastic.co/t/how-to-detect-and-send-bucket-score-merging-2-ml-job/314729)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 8:44am UTC](https://discuss.elastic.co/t/how-to-detect-and-send-bucket-score-merging-2-ml-job/314729 "2022-09-20T08:44:17Z")
I can get and check bucket score merging 2 ml job in anomaly exploreer using "edit job selection". additional, I wand to set alert rule merging two ml job. result type : bucket select job: only one job seleted....... … --- ## [Datastream rollover without dated](https://discuss.elastic.co/t/datastream-rollover-without-dated/314710)
**Author:** [@talShtark](https://discuss.elastic.co/u/talShtark)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 8:41am UTC](https://discuss.elastic.co/t/datastream-rollover-without-dated/314710 "2022-09-20T08:41:30Z")
Hello, Im completely new to ES :slight\_smile: I create some indices and index template - "logs", with a datastream. The index template is attached to an Index Lifecycle Policy with automatic rollover (default settings… --- ## [Elasticsearch snapshot how it works](https://discuss.elastic.co/t/elasticsearch-snapshot-how-it-works/314711)
**Author:** [@xalastoi](https://discuss.elastic.co/u/xalastoi)\ **Replies:** 4\ **Last updated:** [September 20, 2022, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-how-it-works/314711 "2022-09-20T08:39:29Z")
i want to understand how snapshot works in elasticsearch case1 snapshots are taken every day and snapshots older than 1 month are deleted I have an index cities and for example there are 3 documents { barcelona, ​​madrid… --- ## [Logstash filter string anywhere](https://discuss.elastic.co/t/logstash-filter-string-anywhere/314552)
**Author:** [@moberreiter](https://discuss.elastic.co/u/moberreiter)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 8:37am UTC](https://discuss.elastic.co/t/logstash-filter-string-anywhere/314552 "2022-09-20T08:37:32Z")
Hi there, I want to filter firewall logs if some specific string matches anywhere in the message and do not know exactly how to do it. Sample Log message: {"zone\_src":"SOURCE","zone\_dst":"EXTERNAL","reason":"rule","ru… --- ## [Logstash S3 output prefix - Event field timestamp](https://discuss.elastic.co/t/logstash-s3-output-prefix-event-field-timestamp/314708)
**Author:** [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 8:21am UTC](https://discuss.elastic.co/t/logstash-s3-output-prefix-event-field-timestamp/314708 "2022-09-20T08:21:48Z")
How to set Logstash S3 output prefix dynamically with an event field value in format: "%{+YYYY}/%{+MM}/%{+dd}/%{+HH}" ? input: {"record\_time":"2017-03-09T04:07:51.520Z"} required s3 prefix: 2017/03/09/04 --- ## [Filebeat sending events to Logstash output more than once](https://discuss.elastic.co/t/filebeat-sending-events-to-logstash-output-more-than-once/314560)
**Author:** [@stevesimpson](https://discuss.elastic.co/u/stevesimpson)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 8:21am UTC](https://discuss.elastic.co/t/filebeat-sending-events-to-logstash-output-more-than-once/314560 "2022-09-20T08:21:17Z")
I have Filebeat configured with Loadbalance: True with multiple Logstash servers in the Logstash Output. Everything works fine, I see a nice distribution across all of the Logstash instances. To prevent duplicates I hav… --- ## [Filebeat will hang forever until you force a shutdown with "kill -9"](https://discuss.elastic.co/t/filebeat-will-hang-forever-until-you-force-a-shutdown-with-kill-9/314407)
**Author:** [@silence-linhl](https://discuss.elastic.co/u/silence-linhl)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 8:16am UTC](https://discuss.elastic.co/t/filebeat-will-hang-forever-until-you-force-a-shutdown-with-kill-9/314407 "2022-09-20T08:16:48Z")
When I start filebeat with the config file below, I can't stop it using Ctrl + C config file : debug.yaml # genaral max\_procs: 1 logging.metrics.enabled: false # log logging.to\_files: true logging.files: path: /data… --- ## [Need to Parse a nested JSON message in #Logstash](https://discuss.elastic.co/t/need-to-parse-a-nested-json-message-in-logstash/312979)
**Author:** [@pavanKumar2K](https://discuss.elastic.co/u/pavanKumar2K)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 7:29am UTC](https://discuss.elastic.co/t/need-to-parse-a-nested-json-message-in-logstash/312979 "2022-09-20T07:29:00Z")
Hello , I am trying to send my logs files ( .txt / json files ) to Logstash via Filebeat my sample log structure is as below : {"LogDetails":{"transaction-id":"1234","channel-id":"abc","APIName":"testapi","OperationNa… --- ## [Add fields to traefik module output](https://discuss.elastic.co/t/add-fields-to-traefik-module-output/314740)
**Author:** [@titiyoyo](https://discuss.elastic.co/u/titiyoyo)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 6:30am UTC](https://discuss.elastic.co/t/add-fields-to-traefik-module-output/314740 "2022-09-20T06:30:54Z")
Hello, I'm trying to add fields to logs parsed by the traefik module but I can't get it to work. I tried various syntaxes without luck. By my understanding of the documenation, the following should be working... but is… --- ## [Fetch Last 15 minute of data](https://discuss.elastic.co/t/fetch-last-15-minute-of-data/314695)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [September 20, 2022, 6:56am UTC](https://discuss.elastic.co/t/fetch-last-15-minute-of-data/314695 "2022-09-20T06:56:58Z")
Here is my query for fetching the result of today last 15 minutes { "query": { "bool": { "filter": \[ { "bool": { "should": \[ { "match\_phrase": { … --- ## [8.2 S3 SETUP](https://discuss.elastic.co/t/8-2-s3-setup/314345)
**Author:** [@Harper\_S1](https://discuss.elastic.co/u/Harper_S1)\ **Replies:** 6\ **Last updated:** [September 20, 2022, 6:56am UTC](https://discuss.elastic.co/t/8-2-s3-setup/314345 "2022-09-20T06:56:25Z")
Hi Everyone, I have installed the ELK 8.2 stack but getting issue while setting up the s3 repo. Its our internal repo which works as a S3 and it worked fine till 7.16 version. but for this 8.2 version getting the follo… --- ## [Kibana Dashboard ElastiFlow 4.0.1 issue](https://discuss.elastic.co/t/kibana-dashboard-elastiflow-4-0-1-issue/311797)
**Author:** [@boot4root](https://discuss.elastic.co/u/boot4root)\ **Replies:** 7\ **Last updated:** [September 20, 2022, 6:45am UTC](https://discuss.elastic.co/t/kibana-dashboard-elastiflow-4-0-1-issue/311797 "2022-09-20T06:45:56Z")
Good afternoon, I ran into a problem, for some reason, after using ElastiFlow 4.0.1 on Dash Board for a while, the circles on dashboard began to distort, unfortunately ElastiFlow switched to the commercial version and cl… [Previous page](https://discuss.elastic.co/latest.md?page=959) [Next page](https://discuss.elastic.co/latest.md?page=961)