# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=640 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 641 --- ## [All shards failed across multiple indexes](https://discuss.elastic.co/t/all-shards-failed-across-multiple-indexes/301033)
**Author:** [@adowney-lm](https://discuss.elastic.co/u/adowney-lm)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 1:30am UTC](https://discuss.elastic.co/t/all-shards-failed-across-multiple-indexes/301033 "2022-05-05T01:30:29Z")
We are using 7.7.1 ELK and have a simple, single node, setup with a couple of dozen indexes. I'm finding a very large number of "all shards failed" messages in the logs, and have seen a connection failure for a minute o… --- ## [Threshold Rule : API has dynamic id in its signature](https://discuss.elastic.co/t/threshold-rule-api-has-dynamic-id-in-its-signature/303700)
**Author:** [@VijayM](https://discuss.elastic.co/u/VijayM)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 1:30am UTC](https://discuss.elastic.co/t/threshold-rule-api-has-dynamic-id-in-its-signature/303700 "2022-05-05T01:30:18Z")
API signature has an argument {txn-id} in its URI, which gets value dynamically : transaction.name : “GET /api/abx/granter/{txn-id}” Appreciate your help on how to build the alert for this situation. I'm using "Thresh… --- ## [Problem on starting elasticsearch](https://discuss.elastic.co/t/problem-on-starting-elasticsearch/303911)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 12:27am UTC](https://discuss.elastic.co/t/problem-on-starting-elasticsearch/303911 "2022-05-05T00:27:30Z")
root@elastic:~# systemctl status elasticsearch.service ● elasticsearch.service - Elasticsearch Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled) Active: failed (Result:… --- ## [Upgrading error from 6.8 to 7.13](https://discuss.elastic.co/t/upgrading-error-from-6-8-to-7-13/303943)
**Author:** [@Zurka](https://discuss.elastic.co/u/Zurka)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 10:47pm UTC](https://discuss.elastic.co/t/upgrading-error-from-6-8-to-7-13/303943 "2022-05-04T22:47:44Z")
Hi! I have a RedHat8 machine with Elasticsearch 5.6 installed and I want to upgrade to 7.x. I've been able to upgrade to 6.8 following the guide but somehow, I am getting an error when trying to start the Elasticsearch … --- ## [Latest Open source elasticsearch version](https://discuss.elastic.co/t/latest-open-source-elasticsearch-version/303938)
**Author:** [@anshulgoyal](https://discuss.elastic.co/u/anshulgoyal)\ **Replies:** 4\ **Last updated:** [May 4, 2022, 10:10pm UTC](https://discuss.elastic.co/t/latest-open-source-elasticsearch-version/303938 "2022-05-04T22:10:32Z")
Hi All, I have configured Elasticsearch 7.17 version on the system but not sure if it is open source, non-licensed, and log4j vulnerable or not. If it is not all of the three, please suggest me a version which has all t… --- ## [Kibana visualization TSVB not showing entire data and gives error](https://discuss.elastic.co/t/kibana-visualization-tsvb-not-showing-entire-data-and-gives-error/303963)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 7:03pm UTC](https://discuss.elastic.co/t/kibana-visualization-tsvb-not-showing-entire-data-and-gives-error/303963 "2022-05-04T19:03:21Z")
Hello All, I'm trying create a tsvb in which I need to get data for ex: from past 9 months and while selecting the time range I get below error,Mostly I'm facing this issue due to TSVB only.I've a dashboard considerin… --- ## [IO wait when using dense\_vector field](https://discuss.elastic.co/t/io-wait-when-using-dense-vector-field/303261)
**Author:** [@gioele](https://discuss.elastic.co/u/gioele)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 6:49pm UTC](https://discuss.elastic.co/t/io-wait-when-using-dense-vector-field/303261 "2022-05-04T18:49:37Z")
Elasticsearch 7.15.2 While testing the performances of various types of queries using the dense\_vector field type we noticed that a significant amount of time is spent loading the dense\_vector from the disk. We observe… --- ## [How to get a Term list for a field?](https://discuss.elastic.co/t/how-to-get-a-term-list-for-a-field/303968)
**Author:** [@iam](https://discuss.elastic.co/u/iam)\ **Replies:** 0\ **Last updated:** [May 4, 2022, 3:50pm UTC](https://discuss.elastic.co/t/how-to-get-a-term-list-for-a-field/303968 "2022-05-04T15:50:33Z")
Hi All, Is there a way to get a sorted list of terms from a field in Elasticsearch? We are going to migrate from Solr to ES and we need something similar to /terms handler, for example: http://localhost:8983/solr/myda… --- ## [Logstash Error](https://discuss.elastic.co/t/logstash-error/303872)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 6:07pm UTC](https://discuss.elastic.co/t/logstash-error/303872 "2022-05-04T18:07:59Z")
Hello there, I am using Elasticsearch three node implementation cluster. I am using version 7.16.2. I have set up this cluster with basic settings. No security has been set up. Here is the example of data I tried to I… --- ## [Filtering documents with another index](https://discuss.elastic.co/t/filtering-documents-with-another-index/303956)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 4:51pm UTC](https://discuss.elastic.co/t/filtering-documents-with-another-index/303956 "2022-05-04T16:51:32Z")
Hi everyone, and thank you for your time reading this. I'm having two indexes, let's think of those, for sake of semplicity, as: index1: log content file index2: list of hostnames Now, I developed a dashboard in Kiba… --- ## [Convert field to an array](https://discuss.elastic.co/t/convert-field-to-an-array/303884)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 4:47pm UTC](https://discuss.elastic.co/t/convert-field-to-an-array/303884 "2022-05-04T16:47:32Z")
Hello, I'm looking to convert the following field to a hash of values.... Source Field: "ip\_addresses": "{192.168.1.1, 192.168.1.2, 192.168.1.3}" Desired Result: "ip\_addresses": \[ "192.168.1.1", "192… --- ## [Terms Enum Api text support](https://discuss.elastic.co/t/terms-enum-api-text-support/295943)
**Author:** [@ffoeta](https://discuss.elastic.co/u/ffoeta)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 4:40pm UTC](https://discuss.elastic.co/t/terms-enum-api-text-support/295943 "2022-05-04T16:40:47Z")
Currently terms API does not support text fieldType. I've tried creating custom field extension combining code from Keyword and Text types, basically creating exact copy of text type with getTerms(...) method implement… --- ## [Help with GROK Pattern](https://discuss.elastic.co/t/help-with-grok-pattern/303547)
**Author:** [@trubeat\_elk](https://discuss.elastic.co/u/trubeat_elk)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 6:48pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern/303547 "2022-04-28T18:48:12Z")
Hello I am very new to ELK and I am stuck at extracting fields.Below is the sample data Dec 9 06:36:01 s-login-01 CRON\[2436102\]: pam\_unix(cron:session): session closed for user mXXt Dec 9 06:34:07 s-login-01 sshd\[24… --- ## [Exclude fields Kibana Discover](https://discuss.elastic.co/t/exclude-fields-kibana-discover/303930)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 4:34pm UTC](https://discuss.elastic.co/t/exclude-fields-kibana-discover/303930 "2022-05-04T16:34:16Z")
Hi there, I wonder if it's possible in Kibana discover to exclude certain fields from the result set (not just hide the columns). In other words I onder if is possible to user the \_source filtering in Kibana. Thank you… --- ## [Logstash Json Split Filter](https://discuss.elastic.co/t/logstash-json-split-filter/303955)
**Author:** [@elknick](https://discuss.elastic.co/u/elknick)\ **Replies:** 5\ **Last updated:** [May 4, 2022, 4:17pm UTC](https://discuss.elastic.co/t/logstash-json-split-filter/303955 "2022-05-04T16:17:12Z")
I am trying to use the Split filter in Logstash to separate my Json data into separate documents in elastic. I have used this same Split filter in another case and did not have this problem. I have tried targeting a few … --- ## [Remove Ingest Processor](https://discuss.elastic.co/t/remove-ingest-processor/303848)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 2:47pm UTC](https://discuss.elastic.co/t/remove-ingest-processor/303848 "2022-05-03T14:47:25Z")
I'm looking to re-index the .siem-signals-default index into an index called alerts and have created a pipeline to remove fields from the .siem-signals-default index. It looks similar to below - However, it doesn't … --- ## [Alert not being triggered for Uptime duration anomaly rule](https://discuss.elastic.co/t/alert-not-being-triggered-for-uptime-duration-anomaly-rule/303639)
**Author:** [@Mehakdeep\_singh](https://discuss.elastic.co/u/Mehakdeep_singh)\ **Replies:** 6\ **Last updated:** [May 4, 2022, 3:53pm UTC](https://discuss.elastic.co/t/alert-not-being-triggered-for-uptime-duration-anomaly-rule/303639 "2022-05-04T15:53:54Z")
Hey guys, I'm trying to trigger alerts for uptime duration anomaly using the webhook connector. Although I see the anomaly for the monitor as shown in the screenshot below, but no alert rule is triggered. I have config… --- ## [How can I send alerts to telegram?](https://discuss.elastic.co/t/how-can-i-send-alerts-to-telegram/303652)
**Author:** [@perea870724](https://discuss.elastic.co/u/perea870724)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 3:51pm UTC](https://discuss.elastic.co/t/how-can-i-send-alerts-to-telegram/303652 "2022-05-04T15:51:38Z")
Hello community, how can I send alerts to telegram? --- ## [Sum table and sum scorecard does not match](https://discuss.elastic.co/t/sum-table-and-sum-scorecard-does-not-match/303940)
**Author:** [@PaulaCM](https://discuss.elastic.co/u/PaulaCM)\ **Replies:** 4\ **Last updated:** [May 4, 2022, 3:23pm UTC](https://discuss.elastic.co/t/sum-table-and-sum-scorecard-does-not-match/303940 "2022-05-04T15:23:24Z")
Hello! Using the kibana dashboard, I have this table with visit duration values, and at the bottom we can see the sum of all values Then I try to show this sum value in an scorecard using the same function sum(visitD… --- ## [Can't build Kibana: yarn build](https://discuss.elastic.co/t/cant-build-kibana-yarn-build/303750)
**Author:** [@MichelPitz](https://discuss.elastic.co/u/MichelPitz)\ **Replies:** 5\ **Last updated:** [May 4, 2022, 2:58pm UTC](https://discuss.elastic.co/t/cant-build-kibana-yarn-build/303750 "2022-05-04T14:58:22Z")
Hello, I created a custom connector like Pargerduty, the connector is working localhost perfectly. However I cannot build the projectm I got the following error. Actually, even if git clone the project and do not chan… --- ## [How to parse flatten json logs in logstash?](https://discuss.elastic.co/t/how-to-parse-flatten-json-logs-in-logstash/303802)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 4\ **Last updated:** [May 4, 2022, 2:57pm UTC](https://discuss.elastic.co/t/how-to-parse-flatten-json-logs-in-logstash/303802 "2022-05-04T14:57:19Z")
Getting error :- \[2022-05-03T22:21:09,874\]\[INFO \]\[logstash.filters.flattenjson\]\[main\] Running flatten\_json filter {:event=\>#LogStash::Event:0x246b5df6} \[2022-05-03T22:21:09,880\]\[ERROR\]\[org.logstash.execution.WorkerLoop… --- ## [Stale master elected in elastic version \< 7](https://discuss.elastic.co/t/stale-master-elected-in-elastic-version-7/303882)
**Author:** [@johny1](https://discuss.elastic.co/u/johny1)\ **Replies:** 7\ **Last updated:** [May 4, 2022, 2:52pm UTC](https://discuss.elastic.co/t/stale-master-elected-in-elastic-version-7/303882 "2022-05-04T14:52:16Z")
running version 6.x which relies on minimum master node config for quorum. the cluster has three master eligible nodes (1,2,3) and active master was (1). One master node (3) left the cluster due to an unknown error and … --- ## [Logstash parse windows event nxlog](https://discuss.elastic.co/t/logstash-parse-windows-event-nxlog/303138)
**Author:** [@Chloe\_Boissavy](https://discuss.elastic.co/u/Chloe_Boissavy)\ **Replies:** 7\ **Last updated:** [May 4, 2022, 2:52pm UTC](https://discuss.elastic.co/t/logstash-parse-windows-event-nxlog/303138 "2022-05-04T14:52:15Z")
Hello, I am using nxlog to send windows data at my ELK. I would like to parse the "message" part. An example below : "message": \[ "2022-04-25 10:54:13 - DESKTOP-QMCS5UA - Security - INFO - 4672 - Privilèges… --- ## [Observability -\> metrics -\> inventory. dashboards, where the data is stored?](https://discuss.elastic.co/t/observability-metrics-inventory-dashboards-where-the-data-is-stored/301888)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 2:19pm UTC](https://discuss.elastic.co/t/observability-metrics-inventory-dashboards-where-the-data-is-stored/301888 "2022-05-04T14:19:17Z")
Hi, I need to create dashboards identically to the ones in the kibana section, Observability -\> metrics -\> inventory. Where this data is stored for this dashboards? --- ## [Geopoint Help](https://discuss.elastic.co/t/geopoint-help/303946)
**Author:** [@AmyMCollins](https://discuss.elastic.co/u/AmyMCollins)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 1:48pm UTC](https://discuss.elastic.co/t/geopoint-help/303946 "2022-05-04T13:48:16Z")
Hi, I am trying to create some dummy data. I want to add a geopoint using the dev tools but I am struggling. I am using the below api: PUT my\_index/\_doc/1 { "text": "Geo-point as an object", "location": { "la… --- ## [Logstash filter plugin install No \`java.exe' executable found on PATH](https://discuss.elastic.co/t/logstash-filter-plugin-install-no-java-exe-executable-found-on-path/303534)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 8\ **Last updated:** [May 4, 2022, 1:12pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-install-no-java-exe-executable-found-on-path/303534 "2022-05-04T13:12:25Z")
I want to get the fingerprint plugin for logstash on an airgapped windows system. For this I need to download and install it on a system, which has internet access and continue from there? Like in this shown. https://www… --- ## [Querying for a empty array](https://discuss.elastic.co/t/querying-for-a-empty-array/303813)
**Author:** [@erikNL](https://discuss.elastic.co/u/erikNL)\ **Replies:** 5\ **Last updated:** [May 4, 2022, 12:54pm UTC](https://discuss.elastic.co/t/querying-for-a-empty-array/303813 "2022-05-04T12:54:24Z")
I have a ES index with a nested field called “relations”. In the mapping, it is defined as: "relations": { "type": "nested", "properties": { "primaryWordIndex": { "type": "… --- ## [Exclude with pattern matching on a field](https://discuss.elastic.co/t/exclude-with-pattern-matching-on-a-field/303942)
**Author:** [@scrouet](https://discuss.elastic.co/u/scrouet)\ **Replies:** 0\ **Last updated:** [May 4, 2022, 12:38pm UTC](https://discuss.elastic.co/t/exclude-with-pattern-matching-on-a-field/303942 "2022-05-04T12:38:29Z")
Hello, I've enabled AppLocker on Windows and I want to exclude some false positive based on a field named data.win.ruleAndFileData.filePath when it contains strings like "%OSDRIVE%\\USERS\\SAM\_ACCOUNT\_NAME\\APPDATA\\LOCAL\\T… --- ## [More Like This Searches - an analogy?](https://discuss.elastic.co/t/more-like-this-searches-an-analogy/303929)
**Author:** [@sandydesu](https://discuss.elastic.co/u/sandydesu)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 12:33pm UTC](https://discuss.elastic.co/t/more-like-this-searches-an-analogy/303929 "2022-05-04T12:33:14Z")
I'm using 'More Like This' (MLT) searches for a problem I have and I have found them to be really well suited for the types of searches I need. I need to explain how MLT searches work in a meeting and I'm after an analog… --- ## [White space in numeric field kibana 8.1.1](https://discuss.elastic.co/t/white-space-in-numeric-field-kibana-8-1-1/301932)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 10:58am UTC](https://discuss.elastic.co/t/white-space-in-numeric-field-kibana-8-1-1/301932 "2022-05-04T10:58:08Z")
Hi I saw some differences between kibana 7 and 8 in visible fields. How can I change the display format without spaces for multiple number halves for ex. id\_mts 3 467 857 678 and the second topic How can I define … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=639) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=641)