# Latest **URL:** https://discuss.elastic.co/latest.md?page=969 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 970 --- ## [Saved Visualizations from Discover](https://discuss.elastic.co/t/saved-visualizations-from-discover/312795)
**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\ **Replies:** 5\ **Last updated:** [September 13, 2022, 7:28am UTC](https://discuss.elastic.co/t/saved-visualizations-from-discover/312795 "2022-09-13T07:28:48Z")
Dear Elastic Community, One customer is using Discover to search their logs. Sometimes they create a very specific query by which they obtain some interesting results. They would like to visualize them with one of the e… --- ## [How to take children filed while use sql query it's parent?](https://discuss.elastic.co/t/how-to-take-children-filed-while-use-sql-query-its-parent/314251)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 0\ **Last updated:** [September 13, 2022, 7:03am UTC](https://discuss.elastic.co/t/how-to-take-children-filed-while-use-sql-query-its-parent/314251 "2022-09-13T07:03:10Z")
i everyone, i have an parent child index with format like this parent\_child ES doc. "customer\_segment": { "type": "join", "eager\_global\_ordinals": true, "relations": { "customer": … --- ## [After provide time format I get; (elastic: Error 400 (Bad Request): all shards failed \[type=search\_phase\_execution\_exception\] ) error](https://discuss.elastic.co/t/after-provide-time-format-i-get-elastic-error-400-bad-request-all-shards-failed-type-search-phase-execution-exception-error/314243)
**Author:** [@golofetuk](https://discuss.elastic.co/u/golofetuk)\ **Replies:** 1\ **Last updated:** [September 13, 2022, 7:18am UTC](https://discuss.elastic.co/t/after-provide-time-format-i-get-elastic-error-400-bad-request-all-shards-failed-type-search-phase-execution-exception-error/314243 "2022-09-13T07:18:44Z")
Please use the following questions as a guideline to help me answer your issue/question without further inquiry. Thank you. Which version of Elastic are you using? \[ v\] elastic.v7 (for Elasticsearch 7.x) Please descri… --- ## [Kibana logs](https://discuss.elastic.co/t/kibana-logs/312915)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 8\ **Last updated:** [September 13, 2022, 7:03am UTC](https://discuss.elastic.co/t/kibana-logs/312915 "2022-09-13T07:03:51Z")
Hi, I have been trying for a while to configure a logrotate file to rotate my kibana logs(version 7.16.3),without success. I need my logs to rotate daily and delete logs older than 7 days. The configuration file I am us… --- ## [How to do Bulk API iteration from JSON lines using Python?](https://discuss.elastic.co/t/how-to-do-bulk-api-iteration-from-json-lines-using-python/314218)
**Author:** [@Ramu\_Kakaji](https://discuss.elastic.co/u/Ramu_Kakaji)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 6:11pm UTC](https://discuss.elastic.co/t/how-to-do-bulk-api-iteration-from-json-lines-using-python/314218 "2022-09-12T18:11:33Z")
Hi All, i have json data like this json\_data = { "title": "Rush", "year": 2013, "budget":500000, "earning":300000,"genere":"action"} { "title": "Jurrasic", "year": 2014,"budget":1500000, "earning":2300000,"genere":"ac… --- ## [Kibana Server is Not Yet Ready](https://discuss.elastic.co/t/kibana-server-is-not-yet-ready/314156)
**Author:** [@justinepaulpadayao](https://discuss.elastic.co/u/justinepaulpadayao)\ **Replies:** 15\ **Last updated:** [September 13, 2022, 6:54am UTC](https://discuss.elastic.co/t/kibana-server-is-not-yet-ready/314156 "2022-09-13T06:54:19Z")
Hello! I have trouble setting up my ELK stack as I have faced an issue regarding Kibana. Btw, I have 3 different servers where I will install Elasticsearch, Kibana, and Logstash, separately. Here are some details: In… --- ## [Elasticsearch 7 // Log4j configuration SocketAppender](https://discuss.elastic.co/t/elasticsearch-7-log4j-configuration-socketappender/314249)
**Author:** [@CrKontrol](https://discuss.elastic.co/u/CrKontrol)\ **Replies:** 0\ **Last updated:** [September 13, 2022, 6:44am UTC](https://discuss.elastic.co/t/elasticsearch-7-log4j-configuration-socketappender/314249 "2022-09-13T06:44:50Z")
Hello, I'm using Elasticsearch 7.17 under basic licence with the security features. Since Elasticsearch does not support syslog appender on log4j anymore (still the case ?), i'm trying to use SocketAppender but it seem… --- ## [Meticbeat can not collect all metric for MSSQL perfomance counter](https://discuss.elastic.co/t/meticbeat-can-not-collect-all-metric-for-mssql-perfomance-counter/313742)
**Author:** [@sondog](https://discuss.elastic.co/u/sondog)\ **Replies:** 4\ **Last updated:** [September 13, 2022, 4:58am UTC](https://discuss.elastic.co/t/meticbeat-can-not-collect-all-metric-for-mssql-perfomance-counter/313742 "2022-09-13T04:58:07Z")
Elasticsearch Version : 8.0.0 Kbana Version : 8.0.0 Metricbeat Version : 8.0.0 MSSQL version : Micvrosoft SQL Server 2017 in documentaion, metricbeat can collect 16 metric for performance counter but, i can get … --- ## [Hardware requirements - good resilency - Elastic 8.4](https://discuss.elastic.co/t/hardware-requirements-good-resilency-elastic-8-4/314090)
**Author:** [@elkstack1](https://discuss.elastic.co/u/elkstack1)\ **Replies:** 4\ **Last updated:** [September 13, 2022, 4:23am UTC](https://discuss.elastic.co/t/hardware-requirements-good-resilency-elastic-8-4/314090 "2022-09-13T04:23:42Z")
I would like the hardware requirements for good resiliency - Elastic 8.4 I looked on the documentation and didnt find any info pertaining to hardware specs. We currently have 3 master nodes and 17 data nodes - 13 warm … --- ## [Query hostname field with zero hit count](https://discuss.elastic.co/t/query-hostname-field-with-zero-hit-count/314240)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 0\ **Last updated:** [September 13, 2022, 2:47am UTC](https://discuss.elastic.co/t/query-hostname-field-with-zero-hit-count/314240 "2022-09-13T02:47:22Z")
Hi all, I am trying to write a watcher alert if any host hostname.keyword has a 0 hit count in the last 1d. This has asked numerous times but most of them is circulating around entire indices, not for the host field. A… --- ## [WIFI NIC Blocked by Elastic Agent](https://discuss.elastic.co/t/wifi-nic-blocked-by-elastic-agent/314030)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 2\ **Last updated:** [September 13, 2022, 2:29am UTC](https://discuss.elastic.co/t/wifi-nic-blocked-by-elastic-agent/314030 "2022-09-13T02:29:01Z")
I have installed elastic agent on my windoes 10, but the wifi NIC is not working and I can't connect to wifi, but I uninstalled elastic agent and the wifi NIC is working and the wifi is working, what is the reason for th… --- ## [Logstash high CPU](https://discuss.elastic.co/t/logstash-high-cpu/314238)
**Author:** [@jpeppard](https://discuss.elastic.co/u/jpeppard)\ **Replies:** 6\ **Last updated:** [September 13, 2022, 1:30am UTC](https://discuss.elastic.co/t/logstash-high-cpu/314238 "2022-09-13T01:30:18Z")
Hi all. Just installed ELKstack v8.4.1 on ubuntu server 20 to play around with. All is well with the data itself, Metricbeat is sending data to Elasticsearch from two other Ubuntu server machines. Visualizations and dat… --- ## [Metricbeat modules list is empty](https://discuss.elastic.co/t/metricbeat-modules-list-is-empty/314020)
**Author:** [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Replies:** 7\ **Last updated:** [September 13, 2022, 1:06am UTC](https://discuss.elastic.co/t/metricbeat-modules-list-is-empty/314020 "2022-09-13T01:06:37Z")
\[root@rbdcelastic01 metricbeat\]# metricbeat modules list Enabled: Disabled: \[root@rbdcelastic01 metricbeat\]# vim metricbeat.yml # =========================== Modules configuration ============================ metric… --- ## [BCFKS: mac check in CCM failed](https://discuss.elastic.co/t/bcfks-mac-check-in-ccm-failed/314235)
**Author:** [@untangled-duplicate](https://discuss.elastic.co/u/untangled-duplicate)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 9:26pm UTC](https://discuss.elastic.co/t/bcfks-mac-check-in-ccm-failed/314235 "2022-09-12T21:26:47Z")
Hello: I am running into issues with using BouncyCastle keystores and truststores. The error being returned is: Error finalising cipher data: mac check in CCM failed. Any help with understanding this error and how to … --- ## [Certified Analyst practice exam issues](https://discuss.elastic.co/t/certified-analyst-practice-exam-issues/314217)
**Author:** [@Baron](https://discuss.elastic.co/u/Baron)\ **Replies:** 1\ **Last updated:** [September 12, 2022, 8:32pm UTC](https://discuss.elastic.co/t/certified-analyst-practice-exam-issues/314217 "2022-09-12T20:32:54Z")
Hi, I'm having the same issue as described in the topic linked below. I cannot access any of the data in the user\_messages or raw-logs (which I assume is supposed to be used in the place of the apachelogs\* index in the … --- ## [Cannot access Pet Clinic application in the Strigo Lab](https://discuss.elastic.co/t/cannot-access-pet-clinic-application-in-the-strigo-lab/313600)
**Author:** [@timmo](https://discuss.elastic.co/u/timmo)\ **Replies:** 5\ **Last updated:** [September 12, 2022, 8:27pm UTC](https://discuss.elastic.co/t/cannot-access-pet-clinic-application-in-the-strigo-lab/313600 "2022-09-12T20:27:44Z")
Hi, I have started taking the Elasticsearch Observability Engineer (On-Demand) course. I managed to reach lab 3.3 (Collecting APM data) and suddenly cannot access Pet Clinic application. How can I restart the Pet Clini… --- ## [Unable to perform Fuzzy search for search query template](https://discuss.elastic.co/t/unable-to-perform-fuzzy-search-for-search-query-template/314226)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 8:07pm UTC](https://discuss.elastic.co/t/unable-to-perform-fuzzy-search-for-search-query-template/314226 "2022-09-12T20:07:50Z")
Hello Team I am trying to create search query template to allow fuzzy search to search even incomplete values from field, After following the elastic document tried to create search query but it is not working. Using b… --- ## [There is insufficient memory for the Java Runtime Environment to continue](https://discuss.elastic.co/t/there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/313926)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 7\ **Last updated:** [September 12, 2022, 8:01pm UTC](https://discuss.elastic.co/t/there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/313926 "2022-09-12T20:01:10Z")
Hello all, I am using ELK 8.4.1. I have a cluster setup with 3 nodes. But when I tried to Ingest data through Logstash it gave me following errors. OpenJDK 64-Bit Server VM warning: INFO: os::commit\_memory(0x00000000c… --- ## [Elasticsearch docker container shows "unhealthy"](https://discuss.elastic.co/t/elasticsearch-docker-container-shows-unhealthy/314220)
**Author:** [@paris1](https://discuss.elastic.co/u/paris1)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 6:27pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-container-shows-unhealthy/314220 "2022-09-12T18:27:49Z")
my elasticsearchdocker container shows "unhealthy status" on ec2 ubuntu 1e6908aa941e docker.elastic.co/elasticsearch/elasticsearch:8.3.2 "/bin/tini -- /usr/l…" 7 weeks ago Up 7 weeks (unhealthy) 9200/tcp, 93… --- ## [Proximity and close match in the same search?](https://discuss.elastic.co/t/proximity-and-close-match-in-the-same-search/314214)
**Author:** [@cas4](https://discuss.elastic.co/u/cas4)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 5:50pm UTC](https://discuss.elastic.co/t/proximity-and-close-match-in-the-same-search/314214 "2022-09-12T17:50:29Z")
I'm using c# and Nest to interact with our Elasticearch instance. I'm passing a query string to a query container using the following code: return queryContainer .Bool(bq =\> bq … --- ## [Internal rally queue in throughput-throttled mode](https://discuss.elastic.co/t/internal-rally-queue-in-throughput-throttled-mode/314083)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 5:42pm UTC](https://discuss.elastic.co/t/internal-rally-queue-in-throughput-throttled-mode/314083 "2022-09-12T17:42:41Z")
Hi I have a question regarding latency and ES thread pool queues...I am running rally in throughput-throttled mode, targeting a throughput higher than ES will achieve in benchmarking mode. Some numbers I get are: | … --- ## [Apache Error Logs Not Parsing Correctly](https://discuss.elastic.co/t/apache-error-logs-not-parsing-correctly/314211)
**Author:** [@Loc\_Tran](https://discuss.elastic.co/u/Loc_Tran)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 5:39pm UTC](https://discuss.elastic.co/t/apache-error-logs-not-parsing-correctly/314211 "2022-09-12T17:39:30Z")
I'm not able to parse the apache error logs. I keep getting these errors: \[0\] "\_grokparsefailure" which means that there's an error in parsing the logs. Apache Error Logs \[Wed Aug 17 20:00:00.661037 2022\] \[proxy:err… --- ## [How to display @timestamp as Horizontal axis on kibana](https://discuss.elastic.co/t/how-to-display-timestamp-as-horizontal-axis-on-kibana/314165)
**Author:** [@amir\_Bialek](https://discuss.elastic.co/u/amir_Bialek)\ **Replies:** 1\ **Last updated:** [September 12, 2022, 4:22pm UTC](https://discuss.elastic.co/t/how-to-display-timestamp-as-horizontal-axis-on-kibana/314165 "2022-09-12T16:22:36Z")
Hey, trying to set @timestamp as Horizontal axis on kibana does not display anything, see here: Under 'discover' The logs include timestamp: @timestamp:Sep 8, 2022 @ 18:46:27.235 @timestamp:Sep 8, 2022 @ 18:37:53.9… --- ## [How to search for a bracket using simple\_query\_string?](https://discuss.elastic.co/t/how-to-search-for-a-bracket-using-simple-query-string/314096)
**Author:** [@reisner](https://discuss.elastic.co/u/reisner)\ **Replies:** 4\ **Last updated:** [September 12, 2022, 4:14pm UTC](https://discuss.elastic.co/t/how-to-search-for-a-bracket-using-simple-query-string/314096 "2022-09-12T16:14:33Z")
I'm trying to search for documents that contain a bracket in the text using simple\_query\_string. The documentation here says that "To use one of these characters literally, escape it with a preceding backslash ()." Howe… --- ## [LOGSTASH Using different input index than the one specified](https://discuss.elastic.co/t/logstash-using-different-input-index-than-the-one-specified/314139)
**Author:** [@Moshe\_Sharon1](https://discuss.elastic.co/u/Moshe_Sharon1)\ **Replies:** 3\ **Last updated:** [September 12, 2022, 4:03pm UTC](https://discuss.elastic.co/t/logstash-using-different-input-index-than-the-one-specified/314139 "2022-09-12T16:03:54Z")
In logstash configuration file I set input to use "my \_indsex" as input and "result" as output after restarting logstash I found that the output have documents from another configuration input index ׳׳׳ input { elast… --- ## [Does Logstash 7.17.x support jdk17?](https://discuss.elastic.co/t/does-logstash-7-17-x-support-jdk17/314203)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 3:38pm UTC](https://discuss.elastic.co/t/does-logstash-7-17-x-support-jdk17/314203 "2022-09-12T15:38:13Z")
Hi, I am using logstash 7.17.3 with Java 11 in containerized env. Does this version of logstash also support java 17? There is conflicting information from the two doc links from elastic - and hence the query for clar… --- ## [Kibana on dockers and behind Nginx](https://discuss.elastic.co/t/kibana-on-dockers-and-behind-nginx/314027)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 4\ **Last updated:** [September 12, 2022, 3:15pm UTC](https://discuss.elastic.co/t/kibana-on-dockers-and-behind-nginx/314027 "2022-09-12T15:15:37Z")
Hi Im trying to send webhooks to logstash using Kibana Rules an Actions, but Im getting this error: The following error was found: error calling webhook, request failed Details: \[ECONNREFUSED\] connect ECONNREFUSED 127.0… --- ## [Machine Learning not updating Docs Processed](https://discuss.elastic.co/t/machine-learning-not-updating-docs-processed/313903)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [September 12, 2022, 3:12pm UTC](https://discuss.elastic.co/t/machine-learning-not-updating-docs-processed/313903 "2022-09-12T15:12:03Z")
ELK version 7.17.5 I am learning Machine Learning in Kibana. I passed some random data for testing purpose. I got one anomaly. But now it is not processing data I have 3 indices health status index … --- ## [Upgrade Elasticsearch from 6.8.23 to 8.4.1](https://discuss.elastic.co/t/upgrade-elasticsearch-from-6-8-23-to-8-4-1/314126)
**Author:** [@Taby](https://discuss.elastic.co/u/Taby)\ **Replies:** 4\ **Last updated:** [September 12, 2022, 3:07pm UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-from-6-8-23-to-8-4-1/314126 "2022-09-12T15:07:41Z")
Hi. I've few questions regarding a possible upgrade of Elasticsearch from 6.8.23 to 8.4.1. Our application is based on Java 8 build using SBT play framework, currently running and using Elasticsearch 6.8.23 on Mac, Red… --- ## [Error parsing xml with XmlSimple / UndefinedNamespaceException: undefined prefix log4j found](https://discuss.elastic.co/t/error-parsing-xml-with-xmlsimple-undefinednamespaceexception-undefined-prefix-log4j-found/314097)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 3:07pm UTC](https://discuss.elastic.co/t/error-parsing-xml-with-xmlsimple-undefinednamespaceexception-undefined-prefix-log4j-found/314097 "2022-09-12T15:07:09Z")
I am working with local filebeat and logstash and elasticsearch and kibana on a server. I need to convert the information that comes to me from the logs from xml to json. My configuration works when it reads a file with … [Previous page](https://discuss.elastic.co/latest.md?page=968) [Next page](https://discuss.elastic.co/latest.md?page=970)