# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1513 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1514 --- ## [Filebeat 7.6 Kubernetes \[ Openshift \] - Missing labels](https://discuss.elastic.co/t/filebeat-7-6-kubernetes-openshift-missing-labels/227912)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 6:35am UTC](https://discuss.elastic.co/t/filebeat-7-6-kubernetes-openshift-missing-labels/227912 "2020-04-15T06:35:32Z")
Hi! We're trying to run Filebeat on Openshift. We want to create indices based on project-labels. Let's say we have a project label called "system-name". Multiple projects could have the same "system-name" because they … --- ## [Lots of Garbage collection logs in elasticsearch 5.6](https://discuss.elastic.co/t/lots-of-garbage-collection-logs-in-elasticsearch-5-6/225391)
**Author:** [@kayshu](https://discuss.elastic.co/u/kayshu)\ **Replies:** 11\ **Last updated:** [April 15, 2020, 6:22am UTC](https://discuss.elastic.co/t/lots-of-garbage-collection-logs-in-elasticsearch-5-6/225391 "2020-04-15T06:22:34Z")
Hi, I am seeing a lot of gc overhead spent messages in the logs of a single node ES, there's also a log with total \[858ms\]/\[21.7m\]. How do I read these GCMonitor logs? What does this total \[858ms\]/\[21.7m\] means ?, What … --- ## [How to get single record from nested type array](https://discuss.elastic.co/t/how-to-get-single-record-from-nested-type-array/228036)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 6:20am UTC](https://discuss.elastic.co/t/how-to-get-single-record-from-nested-type-array/228036 "2020-04-15T06:20:24Z")
Hi All, I am new in Elastic search, { "OrgDetailsLst" : \[ { "EntityId" : 3, "EntityDetailCode" : 0, "EntityName" : "PlantCode", "EntityCode" : "DRES", "Level" : 0 }, { "EntityId" : 5, "EntityDetailCode" : 0, … --- ## [Logstash - Date function - Mapping timestamp ends with error \_dateparsefailure when a hour is 02](https://discuss.elastic.co/t/logstash-date-function-mapping-timestamp-ends-with-error-dateparsefailure-when-a-hour-is-02/227679)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 5\ **Last updated:** [April 15, 2020, 5:43am UTC](https://discuss.elastic.co/t/logstash-date-function-mapping-timestamp-ends-with-error-dateparsefailure-when-a-hour-is-02/227679 "2020-04-15T05:43:16Z")
Hello, I figured out one thing: Logstash 7.6.0 is not able map date to @timestamp field when timestamp has 02 in hour positio. In pipeline configuration file: if \[timestamp\] { date { match =\> \["timestamp", "yy… --- ## [Create Elastic Maps for index pattern apm-\*](https://discuss.elastic.co/t/create-elastic-maps-for-index-pattern-apm/225463)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 4\ **Last updated:** [April 15, 2020, 5:11am UTC](https://discuss.elastic.co/t/create-elastic-maps-for-index-pattern-apm/225463 "2020-04-15T05:11:12Z")
Kibana version : 7.6 Elasticsearch version : 7.6 APM Server version : 7.3.2 APM Agent language and version : java 1.9.0 Fresh install or upgraded from other version? fresh install Is there anything special in your s… --- ## [Index Mapping Issue - Getting Error: "reason" : "object mapping \[locations\] can't be changed from nested to non-nested"](https://discuss.elastic.co/t/index-mapping-issue-getting-error-reason-object-mapping-locations-cant-be-changed-from-nested-to-non-nested/227938)
**Author:** [@austin-harris](https://discuss.elastic.co/u/austin-harris)\ **Replies:** 7\ **Last updated:** [April 15, 2020, 4:56am UTC](https://discuss.elastic.co/t/index-mapping-issue-getting-error-reason-object-mapping-locations-cant-be-changed-from-nested-to-non-nested/227938 "2020-04-15T04:56:45Z")
I have found many instances of others resolving this error, but I have not been successful. I have ElasticSearch 7.6 deployed. I create the index and mapping. Then, as a test have a sample JSON I am pushing and I receive… --- ## [How to add aggrigate map field to the original message as a additional field](https://discuss.elastic.co/t/how-to-add-aggrigate-map-field-to-the-original-message-as-a-additional-field/227671)
**Author:** [@Lal\_k](https://discuss.elastic.co/u/Lal_k)\ **Replies:** 4\ **Last updated:** [April 15, 2020, 4:42am UTC](https://discuss.elastic.co/t/how-to-add-aggrigate-map-field-to-the-original-message-as-a-additional-field/227671 "2020-04-15T04:42:17Z")
I have huge amount of logs coming from Cisco ASA firewall specially firewall deny. for example i have more than 10 messages from same source IP accessing same destination with same destination port. So the idea is , ins… --- ## [RestHighlevelClient 7.6.1 is throwing mapper parsing exception](https://discuss.elastic.co/t/resthighlevelclient-7-6-1-is-throwing-mapper-parsing-exception/228026)
**Author:** [@Tim25659](https://discuss.elastic.co/u/Tim25659)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 4:03am UTC](https://discuss.elastic.co/t/resthighlevelclient-7-6-1-is-throwing-mapper-parsing-exception/228026 "2020-04-15T04:03:16Z")
i have asked question in the stack overflow and i have all details over there below is the link. --- ## [How to set the ES\_TMPDIR environment variable with ansible-elasticsearch](https://discuss.elastic.co/t/how-to-set-the-es-tmpdir-environment-variable-with-ansible-elasticsearch/228020)
**Author:** [@dokuhebi](https://discuss.elastic.co/u/dokuhebi)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 3:22am UTC](https://discuss.elastic.co/t/how-to-set-the-es-tmpdir-environment-variable-with-ansible-elasticsearch/228020 "2020-04-15T03:22:37Z")
We're using the ansible-elasticsearch ansible role to configure our instances, and so far, it's working well. There's one problem we're running into, and that is that, due to government security requirements, /tmp needs… --- ## [Ingest pipeline not working for filebeat](https://discuss.elastic.co/t/ingest-pipeline-not-working-for-filebeat/228015)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 2:40am UTC](https://discuss.elastic.co/t/ingest-pipeline-not-working-for-filebeat/228015 "2020-04-15T02:40:36Z")
I've created an ingest pipeline that works perfectly when I use the simulate endpoint, POST filebeat-7.6.2-2020.04.14/\_doc?pipeline=pipeline\_lookup\_test, and when I reindex the data into the index. But when I try and sen… --- ## [Sql\_last\_value resets to 0 upon restart](https://discuss.elastic.co/t/sql-last-value-resets-to-0-upon-restart/228017)
**Author:** [@priyankpatel22](https://discuss.elastic.co/u/priyankpatel22)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 2:37am UTC](https://discuss.elastic.co/t/sql-last-value-resets-to-0-upon-restart/228017 "2020-04-15T02:37:34Z")
It seems the variable sql\_last\_value gets reset every time I restart logstash. As per the documentation and all other threads it should look at last\_run\_metadata\_path for the last saved value. I see the last\_run\_metada… --- ## [How to put Kibana Dashboard PNG inline in the body of automated email using Watcher?](https://discuss.elastic.co/t/how-to-put-kibana-dashboard-png-inline-in-the-body-of-automated-email-using-watcher/227978)
**Author:** [@qualispec](https://discuss.elastic.co/u/qualispec)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 2:05am UTC](https://discuss.elastic.co/t/how-to-put-kibana-dashboard-png-inline-in-the-body-of-automated-email-using-watcher/227978 "2020-04-15T02:05:56Z")
I am using Kibana 7.5.0. I am trying to use Watcher to send automated emails of Kibana Dashboards on a schedule. I've read this documentation: https://www.elastic.co/guide/en/elasticsearch/reference/current/actions-ema… --- ## [ES: Indexing Rate dropping significantly while Indexing Latency staying about the same](https://discuss.elastic.co/t/es-indexing-rate-dropping-significantly-while-indexing-latency-staying-about-the-same/227960)
**Author:** [@gurtgurt](https://discuss.elastic.co/u/gurtgurt)\ **Replies:** 9\ **Last updated:** [April 15, 2020, 1:40am UTC](https://discuss.elastic.co/t/es-indexing-rate-dropping-significantly-while-indexing-latency-staying-about-the-same/227960 "2020-04-15T01:40:37Z")
Hi, I'm indexing ~140 GB of data via the bulk API on a managed AWS instance. I'm noticing the Indexing rate is almost at 30% of what it started at, while the indexing latency is staying the same. I'm using EBS SSD as… --- ## [How to split index by the value of field](https://discuss.elastic.co/t/how-to-split-index-by-the-value-of-field/227904)
**Author:** [@Echo\_yu](https://discuss.elastic.co/u/Echo_yu)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 1:25am UTC](https://discuss.elastic.co/t/how-to-split-index-by-the-value-of-field/227904 "2020-04-15T01:25:03Z")
Hi，I have an index which contains one of the field named ‘function’， and I want to split the existing index into small indices by the value of the field ‘function’. For example: new index named 'functionA' contains all t… --- ## [Issue with Strigo lab that cannot start with ECE Fundamentals On-Demand](https://discuss.elastic.co/t/issue-with-strigo-lab-that-cannot-start-with-ece-fundamentals-on-demand/227067)
**Author:** [@benoitdupont](https://discuss.elastic.co/u/benoitdupont)\ **Replies:** 6\ **Last updated:** [April 15, 2020, 12:47am UTC](https://discuss.elastic.co/t/issue-with-strigo-lab-that-cannot-start-with-ece-fundamentals-on-demand/227067 "2020-04-15T00:47:00Z")
Hello, at the end of the first lab, I need to restart the machine with a sudo reboot. The VM tries to start but keep failing: Preparing workstation... message with blinking screen and behind some kind of retry error me… --- ## [Kibana multiple query is not allowed](https://discuss.elastic.co/t/kibana-multiple-query-is-not-allowed/227814)
**Author:** [@111316](https://discuss.elastic.co/u/111316)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 12:17am UTC](https://discuss.elastic.co/t/kibana-multiple-query-is-not-allowed/227814 "2020-04-15T00:17:28Z")
Hello! To use multiple queries as below, an error occurs. Please tell me how to use 2 IP bands. { "query": { "bool": { "should": \[ { "match\_phrase": { "flow.dst\_addr": {"gte": "1.1.1.1", "lt": "1.1.1.254"}} }, … --- ## [ES 1.6.2 Java client and ES 1.5.2 cluster](https://discuss.elastic.co/t/es-1-6-2-java-client-and-es-1-5-2-cluster/227999)
**Author:** [@Cleosson\_Souza](https://discuss.elastic.co/u/Cleosson_Souza)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 12:12am UTC](https://discuss.elastic.co/t/es-1-6-2-java-client-and-es-1-5-2-cluster/227999 "2020-04-15T00:12:22Z")
Hello, I took a look at end of life and I understood that ES 1.6.2 Java client is compatible with ES 1.5.2 cluster Is ES 1.6.2 Java client really compatible with ES 1.5.2 cluster ? Is that compatibility official ? T… --- ## [How to return distinct values from query based on a field](https://discuss.elastic.co/t/how-to-return-distinct-values-from-query-based-on-a-field/228000)
**Author:** [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Replies:** 2\ **Last updated:** [April 14, 2020, 11:29pm UTC](https://discuss.elastic.co/t/how-to-return-distinct-values-from-query-based-on-a-field/228000 "2020-04-14T23:29:01Z")
I'm trying to return documents from a query and i want to return distinct values in my results. I don't want to count how many documents contain the same value i just want to return some documents based on distinct or … --- ## [Index: false on field vs not mapping field at all](https://discuss.elastic.co/t/index-false-on-field-vs-not-mapping-field-at-all/228006)
**Author:** [@bern\_ash](https://discuss.elastic.co/u/bern_ash)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 11:14pm UTC](https://discuss.elastic.co/t/index-false-on-field-vs-not-mapping-field-at-all/228006 "2020-04-14T23:14:47Z")
Hi everyone, Is there a difference between having a field in my mapping with index: false and simply omitting that field from my mapping (if the mapping has dynamic: false) ? I'm asking this because I have many fields … --- ## [Extract A, MX, and NS records based on a field](https://discuss.elastic.co/t/extract-a-mx-and-ns-records-based-on-a-field/228005)
**Author:** [@mnrdammu](https://discuss.elastic.co/u/mnrdammu)\ **Replies:** 0\ **Last updated:** [April 14, 2020, 10:20pm UTC](https://discuss.elastic.co/t/extract-a-mx-and-ns-records-based-on-a-field/228005 "2020-04-14T22:20:27Z")
Hi All, Is there a way to get A,MX and NS records based on a field ( which is essentially a domain name for eg: example.com) . I know we have logstash-dns-filter, but it can provide only "A" records. I would like to ge… --- ## [Running Total of Living Population](https://discuss.elastic.co/t/running-total-of-living-population/227998)
**Author:** [@sivel](https://discuss.elastic.co/u/sivel)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 10:19pm UTC](https://discuss.elastic.co/t/running-total-of-living-population/227998 "2020-04-14T22:19:56Z")
Let's assume that I have a data set that includes a single document per person. The data will include a bornOn and diedOn field. diedOn may not have a value. I was looking at creating a Timelion that shows me a running… --- ## [Login Issue between Strigo and Endpoint Security Fundamentals Course (training.elastic.co)](https://discuss.elastic.co/t/login-issue-between-strigo-and-endpoint-security-fundamentals-course-training-elastic-co/227966)
**Author:** [@turnermd86](https://discuss.elastic.co/u/turnermd86)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 9:04pm UTC](https://discuss.elastic.co/t/login-issue-between-strigo-and-endpoint-security-fundamentals-course-training-elastic-co/227966 "2020-04-14T21:04:41Z")
After enrolling into the Endpoint Security Fundamentals Course, I reviewed the course from my training.elastic.co dashboard under "My Learning." This launched a new tab for the course with this url: scorm.servicerocket.i… --- ## [Multi-search with rescore](https://discuss.elastic.co/t/multi-search-with-rescore/227839)
**Author:** [@eugenetries](https://discuss.elastic.co/u/eugenetries)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 9:01pm UTC](https://discuss.elastic.co/t/multi-search-with-rescore/227839 "2020-04-14T21:01:56Z")
Hi Everyone, Is it possible to include rescores in a multi-search API call? I have not found any examples of this in the docs or elsewhere, and my attempts to piece it together on my own have been fruitless. Thanks in … --- ## [Kibana server is not ready yet - kibana 7.6.2 - New Install](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-kibana-7-6-2-new-install/227840)
**Author:** [@surfd4wg](https://discuss.elastic.co/u/surfd4wg)\ **Replies:** 8\ **Last updated:** [April 14, 2020, 8:43pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-kibana-7-6-2-new-install/227840 "2020-04-14T20:43:13Z")
This is from localhost:9200. { "name" : "rex-VirtualBox", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "na", "version" : { "number" : "7.6.2", "build\_flavor" : "default", "build\_type" : "deb", "build\_hash"… --- ## [ECE 2.5 released](https://discuss.elastic.co/t/ece-2-5-released/227988)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [April 14, 2020, 7:26pm UTC](https://discuss.elastic.co/t/ece-2-5-released/227988 "2020-04-14T19:26:03Z")
ECE 2.5 released We’re excited to announce the release of Elastic Cloud Enterprise (ECE) 2.5! This release improves the experience of managing your deployments with a dedicated coordinating layer, support for snapshot l… --- ## [\_score:"-Infinity" with version 7.6.2, \_score:null from version 6.8.2](https://discuss.elastic.co/t/score-infinity-with-version-7-6-2-score-null-from-version-6-8-2/227834)
**Author:** [@erik-sigsci](https://discuss.elastic.co/u/erik-sigsci)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 7:21pm UTC](https://discuss.elastic.co/t/score-infinity-with-version-7-6-2-score-null-from-version-6-8-2/227834 "2020-04-14T19:21:42Z")
Hello! I'm in process of trying to upgrade a production cluster from 6.8.2 to 7.6.2 Everything looked good, but as soon as one node was v7.6.2, I started to get json parsing errors from the go olivere library. It seems… --- ## [Update mapping and search on fields by wildcards](https://discuss.elastic.co/t/update-mapping-and-search-on-fields-by-wildcards/227982)
**Author:** [@Behzad\_Rezaie](https://discuss.elastic.co/u/Behzad_Rezaie)\ **Replies:** 0\ **Last updated:** [April 14, 2020, 7:05pm UTC](https://discuss.elastic.co/t/update-mapping-and-search-on-fields-by-wildcards/227982 "2020-04-14T19:05:05Z")
Hi pals, I am using the APM. I have added the fields context.request.body and context.response.body to the indices in the .Net Core version (since the version I was using was not set for these fields, I added them mysel… --- ## [Weak cipher usage - diffie-hellman-group1-sha1](https://discuss.elastic.co/t/weak-cipher-usage-diffie-hellman-group1-sha1/227972)
**Author:** [@dimalini](https://discuss.elastic.co/u/dimalini)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 6:01pm UTC](https://discuss.elastic.co/t/weak-cipher-usage-diffie-hellman-group1-sha1/227972 "2020-04-14T18:01:59Z")
Hi, One of our customers has reported that in their machine where ES is configured, a scanner identified port 22 to be used by some ES dependent service and that it flagged for using a weak cipher - 'diffie-hellman-group… --- ## [Use SSL with logstash syslog input plugin](https://discuss.elastic.co/t/use-ssl-with-logstash-syslog-input-plugin/227831)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 2\ **Last updated:** [April 14, 2020, 5:05pm UTC](https://discuss.elastic.co/t/use-ssl-with-logstash-syslog-input-plugin/227831 "2020-04-14T17:05:46Z")
Hi, I have an installation of ELK 7.6, and i have several devices that send information to logstash via syslog. I want to secure the communication, but in the logstash syslog input plugin i dont see any parameter for ss… --- ## [Can't find Metricbeat log file](https://discuss.elastic.co/t/cant-find-metricbeat-log-file/226525)
**Author:** [@cylon86](https://discuss.elastic.co/u/cylon86)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 4:52pm UTC](https://discuss.elastic.co/t/cant-find-metricbeat-log-file/226525 "2020-04-14T16:52:15Z")
Hello, I'm trying to setup metricbeat to monitor my cluster but I have some trouble. The first one is that I can't find the metricbeat execution logs to debug the issue... When I run systemctl status metricbeat.servic… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1512) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1514)