# Latest **URL:** https://discuss.elastic.co/latest.md?page=966 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 967 --- ## [Snapshot contents](https://discuss.elastic.co/t/snapshot-contents/313576)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 5:30pm UTC](https://discuss.elastic.co/t/snapshot-contents/313576 "2022-09-14T17:30:37Z")
Whether snapshot will copy the apm and watcher indices as well? --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/314438)
**Author:** [@Neophyte](https://discuss.elastic.co/u/Neophyte)\ **Replies:** 4\ **Last updated:** [September 14, 2022, 5:05pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/314438 "2022-09-14T17:05:58Z")
I am getting this in the browser. Here are my configs messi@fifa:~$ sudo systemctl status kibana elasticsearch ● kibana.service - Kibana Loaded: loaded (/lib/systemd/system/kibana.service; enabled; vendor preset: e… --- ## [I cannot see local rules](https://discuss.elastic.co/t/i-cannot-see-local-rules/314227)
**Author:** [@Giovanni\_Memoli](https://discuss.elastic.co/u/Giovanni_Memoli)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 4:53pm UTC](https://discuss.elastic.co/t/i-cannot-see-local-rules/314227 "2022-09-14T16:53:15Z")
Hi, an old colleague created a local rule on an old Wazuh server and it worked. Now I created a new wazuh server and copy & paste the rule, under local rule, but I cannot see it under discovery session. Rule is: \ **Author:** [@samjpv](https://discuss.elastic.co/u/samjpv)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 6:10pm UTC](https://discuss.elastic.co/t/new-data-stream-backing-index-dropping-logs/313913 "2022-09-08T18:10:07Z") I currently have microservice logs going from kubernetes -\> confluent kafka -\> elastic via sink connector (I have confirmed that they are reaching kafka but not elastic). On elastic I have a corresponding data stream tha… --- ## [Possibilty to show intime value of fileds in kibana as timseries](https://discuss.elastic.co/t/possibilty-to-show-intime-value-of-fileds-in-kibana-as-timseries/314437)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:48pm UTC](https://discuss.elastic.co/t/possibilty-to-show-intime-value-of-fileds-in-kibana-as-timseries/314437 "2022-09-14T15:48:25Z")
Continuing the discussion from Kibana visualization to show intime value count of different fieldski: --- ## [Using mutate to parse broken JSON](https://discuss.elastic.co/t/using-mutate-to-parse-broken-json/314436)
**Author:** [@Dan\_Fielder](https://discuss.elastic.co/u/Dan_Fielder)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:43pm UTC](https://discuss.elastic.co/t/using-mutate-to-parse-broken-json/314436 "2022-09-14T15:43:09Z")
I have messages arriving with very large blocks of broken JSON. These logs fail to parse when they arrive, so I'm using Filebeat to read from logstash-plain.log and feed them back in for extra processing. Each log cont… --- ## [TSVB Kibana data representation](https://discuss.elastic.co/t/tsvb-kibana-data-representation/311712)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 4\ **Last updated:** [September 14, 2022, 3:38pm UTC](https://discuss.elastic.co/t/tsvb-kibana-data-representation/311712 "2022-09-14T15:38:34Z")
Hello All, Can someone help me with making timeseries visual for below use case: Display the amount value for different state coming from backend script and show in accordance to time. Qsearch index updated,nodes trav… --- ## [Trouble with Filebeat Nginx module](https://discuss.elastic.co/t/trouble-with-filebeat-nginx-module/314434)
**Author:** [@marklad78](https://discuss.elastic.co/u/marklad78)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:22pm UTC](https://discuss.elastic.co/t/trouble-with-filebeat-nginx-module/314434 "2022-09-14T15:22:33Z")
Filebeat/ELK version 7.10.2 We're attempting to consume nginx-esque kong logs from /usr/local/kong/logs/access.log through filebeat running on the same machine as the kong instance using the nginx module. The followi… --- ## [Fleet Server is not Healthy](https://discuss.elastic.co/t/fleet-server-is-not-healthy/314359)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:37am UTC](https://discuss.elastic.co/t/fleet-server-is-not-healthy/314359 "2022-09-14T03:37:19Z")
After I upgraded from 8.3.2 to 8.4.1, my fleet shows Fleet Server is not Healthy, but agent is healthy, how do I need to deal with this problem? --- ## [Check a field contains string using script](https://discuss.elastic.co/t/check-a-field-contains-string-using-script/314424)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 2:34pm UTC](https://discuss.elastic.co/t/check-a-field-contains-string-using-script/314424 "2022-09-14T14:34:11Z")
I would like to run a query to check if a field is substring of a query string parameter. if yes , I want to return 1. I am new to scripting and below code is not working. Blockquote GET testspan/\_search { "size": … --- ## [Reindex - Upgrade assistant index data prior to 7.0](https://discuss.elastic.co/t/reindex-upgrade-assistant-index-data-prior-to-7-0/314336)
**Author:** [@elkstack1](https://discuss.elastic.co/u/elkstack1)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 2:32pm UTC](https://discuss.elastic.co/t/reindex-upgrade-assistant-index-data-prior-to-7-0/314336 "2022-09-14T14:32:31Z")
I clicked on the reindexing option on the upgrade assistant for the indexes that are critical and needs to be reindexed prior to upgrade. I do see the reindexing failed but there is no error detailed on the response. Ca… --- ## [ES 6.4.2 - MapperParsingException when performing Bulk requests](https://discuss.elastic.co/t/es-6-4-2-mapperparsingexception-when-performing-bulk-requests/314057)
**Author:** [@JPS\_23](https://discuss.elastic.co/u/JPS_23)\ **Replies:** 3\ **Last updated:** [September 14, 2022, 1:54pm UTC](https://discuss.elastic.co/t/es-6-4-2-mapperparsingexception-when-performing-bulk-requests/314057 "2022-09-14T13:54:40Z")
Hi! I have been experiencing a MapperParsingException when performing Bulk requests on the Elastic Search 6.4.2 instance. This issue is happening on all the environments (development, qa, production). The weird thing is… --- ## [Kibana v7.16.1 login issue. Not able to login (ResponseError: version\_conflict\_engine\_exception)](https://discuss.elastic.co/t/kibana-v7-16-1-login-issue-not-able-to-login-responseerror-version-conflict-engine-exception/308670)
**Author:** [@Avinash\_09](https://discuss.elastic.co/u/Avinash_09)\ **Replies:** 35\ **Last updated:** [September 14, 2022, 1:22pm UTC](https://discuss.elastic.co/t/kibana-v7-16-1-login-issue-not-able-to-login-responseerror-version-conflict-engine-exception/308670 "2022-09-14T13:22:29Z")
Hello, We are on v7.16.1 of Kibana/Elastic and facing issues with Kibana login all of a sudden. It was working fine around couple of hours back When checked in the logs seeing below exceptions. {"type":"log","@times… --- ## [UDP Listener Died](https://discuss.elastic.co/t/udp-listener-died/314339)
**Author:** [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 12:37pm UTC](https://discuss.elastic.co/t/udp-listener-died/314339 "2022-09-14T12:37:51Z")
I'm seeing this error in my logstash-plain.log file and I ham not sure where to start looking: \[2022-09-13T17:25:47,905\]\[ERROR\]\[logstash.inputs.udp \]\[main\]\[8a46caaeb3cca4377e6163891fd9b8dd48405025c4a31918ce883ba824… --- ## [Restrict Concurrent Users getting same results for same search creiteria](https://discuss.elastic.co/t/restrict-concurrent-users-getting-same-results-for-same-search-creiteria/314373)
**Author:** [@anish\_a\_nair](https://discuss.elastic.co/u/anish_a_nair)\ **Replies:** 5\ **Last updated:** [September 14, 2022, 12:18pm UTC](https://discuss.elastic.co/t/restrict-concurrent-users-getting-same-results-for-same-search-creiteria/314373 "2022-09-14T12:18:56Z")
Hi, I have requirement to restrict the concurrent users viewing same results if they use same search criteria. The example of my use case is listed below let's assume i have below numbers in a field called "Numbers" 8… --- ## [Get a private key from http\_ca.crt](https://discuss.elastic.co/t/get-a-private-key-from-http-ca-crt/314408)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 12:18pm UTC](https://discuss.elastic.co/t/get-a-private-key-from-http-ca-crt/314408 "2022-09-14T12:18:31Z")
Hi How i can get a private key from /etc/elasticsearch/certs/http\_ca.crt file ? I need that key to create cert for logstash ./bin/elasticsearch-certutil cert --name logstash --ca-cert /etc/elasticsearch/certs/http\_ca… --- ## [Elastic search response capped to 10k records](https://discuss.elastic.co/t/elastic-search-response-capped-to-10k-records/314192)
**Author:** [@Deepanshu\_Rai](https://discuss.elastic.co/u/Deepanshu_Rai)\ **Replies:** 4\ **Last updated:** [September 14, 2022, 12:07pm UTC](https://discuss.elastic.co/t/elastic-search-response-capped-to-10k-records/314192 "2022-09-14T12:07:16Z")
I am trying to query my index which has more then 500k records but i am only able to extract 10k records at a time. now i understand this has to do with performance of the application but how can i do bulk extract? with… --- ## [Help for my first open source contribution](https://discuss.elastic.co/t/help-for-my-first-open-source-contribution/314322)
**Author:** [@Akshay\_Bhadange](https://discuss.elastic.co/u/Akshay_Bhadange)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 12:03pm UTC](https://discuss.elastic.co/t/help-for-my-first-open-source-contribution/314322 "2022-09-14T12:03:02Z")
I want to contribute to this project so i just want to know is my laptop specs sufficient enough for running this project and its a windows machine Specs: Os : windows 10 Ram : 8 gb Ssd : 120 Thanks in advance , lo… --- ## [Error in logstash output by using elasticsearch update by query](https://discuss.elastic.co/t/error-in-logstash-output-by-using-elasticsearch-update-by-query/314405)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 11:47am UTC](https://discuss.elastic.co/t/error-in-logstash-output-by-using-elasticsearch-update-by-query/314405 "2022-09-14T11:47:35Z")
Hi All, I am trying to update new field to the existing documents using update by query through logstash and below is the configuration I have tried, input { http\_poller { urls =\> { version =\> "https://d… --- ## [No geoip points in kibana map](https://discuss.elastic.co/t/no-geoip-points-in-kibana-map/314145)
**Author:** [@SirStephanikus](https://discuss.elastic.co/u/SirStephanikus)\ **Replies:** 8\ **Last updated:** [September 14, 2022, 11:38am UTC](https://discuss.elastic.co/t/no-geoip-points-in-kibana-map/314145 "2022-09-14T11:38:16Z")
Hello everyone and welcome to another rooky question :smiley: In a very simple logstash pipeline, I want to enter via stdin an ipv4 address and ship it to elasticsearch...than get the geoip location drawn on a map. How… --- ## [Azure AD (modlue:o365) logs are not fetched consistently by filebeat](https://discuss.elastic.co/t/azure-ad-modlue-o365-logs-are-not-fetched-consistently-by-filebeat/314369)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 11:21am UTC](https://discuss.elastic.co/t/azure-ad-modlue-o365-logs-are-not-fetched-consistently-by-filebeat/314369 "2022-09-14T11:21:15Z")
Hi Team I am New to the filebeat usage. I am trying to fetch logs from azure tenant using o365 module. I am able to get the logs sometimes but sometimes the expected logs are missing. I expect the logs when there is som… --- ## [Difference b/w Normal DBs vs Elasticsearch](https://discuss.elastic.co/t/difference-b-w-normal-dbs-vs-elasticsearch/314207)
**Author:** [@Karan\_Koya](https://discuss.elastic.co/u/Karan_Koya)\ **Replies:** 8\ **Last updated:** [September 14, 2022, 10:27am UTC](https://discuss.elastic.co/t/difference-b-w-normal-dbs-vs-elasticsearch/314207 "2022-09-14T10:27:45Z")
I have recently started exploring Elastic Stack and came across your Beginner's series which has solved many doubts about Elasticsearch but I am still not sure why we not use Database and prefer Elasticsearch, and why/ho… --- ## [Preprocessing of alerts to be send using httppost](https://discuss.elastic.co/t/preprocessing-of-alerts-to-be-send-using-httppost/313627)
**Author:** [@Pratik1](https://discuss.elastic.co/u/Pratik1)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 10:25am UTC](https://discuss.elastic.co/t/preprocessing-of-alerts-to-be-send-using-httppost/313627 "2022-09-14T10:25:30Z")
I am using a tool called Kapacitor to send alerts using httppost method to elasticsearch. However, in one list I am getting both time and value column with datatypes date and float respectively. This is causing exceptio… --- ## [Split single object in array to multiple?](https://discuss.elastic.co/t/split-single-object-in-array-to-multiple/314392)
**Author:** [@Hamza\_Khalid](https://discuss.elastic.co/u/Hamza_Khalid)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 9:37am UTC](https://discuss.elastic.co/t/split-single-object-in-array-to-multiple/314392 "2022-09-14T09:37:36Z")
I'm using logstash to index data from mysql to elasticsearch. Is there a way to convert this output: "interests" : \[ { "interest\_id" : "1,2", "interest\_name" : "Business,Farming" } \] To this: "interests" : \[ { … --- ## [Minimal ES server version to work with elasticsearch-py](https://discuss.elastic.co/t/minimal-es-server-version-to-work-with-elasticsearch-py/314385)
**Author:** [@Naams](https://discuss.elastic.co/u/Naams)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 8:30am UTC](https://discuss.elastic.co/t/minimal-es-server-version-to-work-with-elasticsearch-py/314385 "2022-09-14T08:30:53Z")
Hi, I know that UnsupportedProductError is raised by elasticsearch-py package since version 7.14 when ES server is "too old". The two solutions I have to keep using this package are : Downgrade my python package to \<7… --- ## [Hot/warm architecture](https://discuss.elastic.co/t/hot-warm-architecture/314382)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 8:52am UTC](https://discuss.elastic.co/t/hot-warm-architecture/314382 "2022-09-14T08:52:47Z")
Hi there, I'd like to ask. if an index enters a warm state, can it still perform write operations? i read this blog but didn't found the information i need Thanks --- ## [No exception lists found](https://discuss.elastic.co/t/no-exception-lists-found/312089)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 16\ **Last updated:** [September 14, 2022, 8:48am UTC](https://discuss.elastic.co/t/no-exception-lists-found/312089 "2022-09-14T08:48:25Z")
Hi, in our default space I get a message saying "No exception lists found" and "We weren't able to find any exception lists." when I get into Exceptions in Security app even tho there are some exceptions (you can even s… --- ## [Runtime field Create Nested Object](https://discuss.elastic.co/t/runtime-field-create-nested-object/312316)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 4\ **Last updated:** [September 14, 2022, 8:47am UTC](https://discuss.elastic.co/t/runtime-field-create-nested-object/312316 "2022-09-14T08:47:19Z")
Hello, I'm trying to create a run-time field which creates an array. I've been doing simple things like creating strings based on a conditional field but I can't seem to get the right syntax for a multi-value string obj… --- ## [Vega: Fitting time range to Kibana filter](https://discuss.elastic.co/t/vega-fitting-time-range-to-kibana-filter/314259)
**Author:** [@Ernyz](https://discuss.elastic.co/u/Ernyz)\ **Replies:** 0\ **Last updated:** [September 13, 2022, 7:44am UTC](https://discuss.elastic.co/t/vega-fitting-time-range-to-kibana-filter/314259 "2022-09-13T07:44:10Z")
Hello, I've been struggling with this problem. I'm creating a visualization of events in a timeline wich resemble a Gantt graph. I've succesfully pulled data from elasticsearch and displayed it on the graph area using X… --- ## [Unable to Join New node to existing cluster](https://discuss.elastic.co/t/unable-to-join-new-node-to-existing-cluster/314353)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 5\ **Last updated:** [September 14, 2022, 7:15am UTC](https://discuss.elastic.co/t/unable-to-join-new-node-to-existing-cluster/314353 "2022-09-14T07:15:39Z")
Hi, I'm using Elasticsearch 8.4 version. I was able to install Elasticsearch and Kibana. Then I tried to install on 2nd node. I followed the steps in https://www.elastic.co/guide/en/elasticsearch/reference/current/rp… [Previous page](https://discuss.elastic.co/latest.md?page=965) [Next page](https://discuss.elastic.co/latest.md?page=967)