# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=876 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 877 --- ## [Logstash upsert across multiple indexes](https://discuss.elastic.co/t/logstash-upsert-across-multiple-indexes/279307)
**Author:** [@jpchev](https://discuss.elastic.co/u/jpchev)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 1:39pm UTC](https://discuss.elastic.co/t/logstash-upsert-across-multiple-indexes/279307 "2021-07-22T13:39:51Z")
hi there, I need to import data in elasticsearch with an upsert logic, for this I use the following logstash plugin output { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "myindex-{+YYYY.MM.dd}" doc… --- ## [Possible to have {{context.hits}} return as an array?](https://discuss.elastic.co/t/possible-to-have-context-hits-return-as-an-array/277583)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 1:35pm UTC](https://discuss.elastic.co/t/possible-to-have-context-hits-return-as-an-array/277583 "2021-07-22T13:35:33Z")
Dear all =) I would like to have {{context.hits}} as a JSON array, so I have tried different things. If I put the following in a Kibana rule body {"documents":"{{context.hits}}"} then all the documents are stored as … --- ## [Autocomplete best match is not first in results](https://discuss.elastic.co/t/autocomplete-best-match-is-not-first-in-results/279186)
**Author:** [@net](https://discuss.elastic.co/u/net)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 1:35pm UTC](https://discuss.elastic.co/t/autocomplete-best-match-is-not-first-in-results/279186 "2021-07-22T13:35:02Z")
When I search for "charles sta" the first result in the list is "U.S. Dept. of State, Office of Logistics Management, Charleston" and the second result is "Charles Stark Draper Laboratory, Inc. (CSDL)" The second result… --- ## [\_grokparsefailure but grok debugger looks good](https://discuss.elastic.co/t/grokparsefailure-but-grok-debugger-looks-good/279269)
**Author:** [@baumi](https://discuss.elastic.co/u/baumi)\ **Replies:** 17\ **Last updated:** [July 22, 2021, 1:14pm UTC](https://discuss.elastic.co/t/grokparsefailure-but-grok-debugger-looks-good/279269 "2021-07-22T13:14:39Z")
Hello everyone, I need some help with my grok pattern, because Logstash is not able to parse it. Kibana and other grok debuggers are able to parse the logs. Sample Log: Mar 10 00:59:50\\t1.1.1.1\\ttest@static\\t0/0/0/000… --- ## [How to read the body (json data) of the request in a custom plugin](https://discuss.elastic.co/t/how-to-read-the-body-json-data-of-the-request-in-a-custom-plugin/279375)
**Author:** [@shadowfox38](https://discuss.elastic.co/u/shadowfox38)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 12:37pm UTC](https://discuss.elastic.co/t/how-to-read-the-body-json-data-of-the-request-in-a-custom-plugin/279375 "2021-07-22T12:37:17Z")
I am trying to create a custom plugin which needs to read the body of the request (by body i mean json data that is sent along with the request) so i should be able to read the json data of a request like POST myendpoi… --- ## [Fleet enrollment Ok but doesnt appear on security administration page](https://discuss.elastic.co/t/fleet-enrollment-ok-but-doesnt-appear-on-security-administration-page/279192)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 12:28pm UTC](https://discuss.elastic.co/t/fleet-enrollment-ok-but-doesnt-appear-on-security-administration-page/279192 "2021-07-22T12:28:02Z")
Hi there, I cannot find why some servers appears on the security admin page and others not. Can someone point me to the right direction to sort this out? Follow the fleet agent screen: Security Admin page: Also… --- ## [How to parse smile serialized files (files with .dat) (files with snap-\* and meta-\* prefixes)](https://discuss.elastic.co/t/how-to-parse-smile-serialized-files-files-with-dat-files-with-snap-and-meta-prefixes/278621)
**Author:** [@shadowfox38](https://discuss.elastic.co/u/shadowfox38)\ **Replies:** 17\ **Last updated:** [July 22, 2021, 11:54am UTC](https://discuss.elastic.co/t/how-to-parse-smile-serialized-files-files-with-dat-files-with-snap-and-meta-prefixes/278621 "2021-07-22T11:54:27Z")
When Elastic search snapshot deletes fail in between, some dangling indexes are left, which increase the size of the repository. I wanted to find such indexes by referring to the snapshot metadata files. I need help in … --- ## [Field expansion for \[\*\] matches too many fields, limit: 1024, got: 1998](https://discuss.elastic.co/t/field-expansion-for-matches-too-many-fields-limit-1024-got-1998/279168)
**Author:** [@vaishno.avi](https://discuss.elastic.co/u/vaishno.avi)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:27am UTC](https://discuss.elastic.co/t/field-expansion-for-matches-too-many-fields-limit-1024-got-1998/279168 "2021-07-22T10:27:12Z")
Hello, We have recently moved from AWS ES 5.x to 7.10. While performing search operation I go get the above error. In total my fields are between 2500 to 4000 for now. I know these values are not good, but this somehow … --- ## [Unable to Fetch data from rollups collector - OFFLINE INSTALL](https://discuss.elastic.co/t/unable-to-fetch-data-from-rollups-collector-offline-install/278953)
**Author:** [@Karevavery](https://discuss.elastic.co/u/Karevavery)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:20am UTC](https://discuss.elastic.co/t/unable-to-fetch-data-from-rollups-collector-offline-install/278953 "2021-07-22T10:20:16Z")
Hi, my kibana service is showing logged warnings and I cannot access the webpage either. error log stating: Cannot read property ‘id’ of undefined\\n at id (/usr/share/kibana/x-pack/legacy/plugins/rollup/server/usage/col… --- ## [File structure cannot be determined on data visualizer](https://discuss.elastic.co/t/file-structure-cannot-be-determined-on-data-visualizer/277070)
**Author:** [@Adrienb02](https://discuss.elastic.co/u/Adrienb02)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:05am UTC](https://discuss.elastic.co/t/file-structure-cannot-be-determined-on-data-visualizer/277070 "2021-07-22T10:05:58Z")
Hello everyone ! In advance, sorry for my english. I have an issue with the Data Visualizer. In my case, I have created a json file. My problem is that the data visualizer doesn't want my file as an input. The error … --- ## [ES is getting killed :(](https://discuss.elastic.co/t/es-is-getting-killed/279362)
**Author:** [@kamal\_khushi](https://discuss.elastic.co/u/kamal_khushi)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 9:40am UTC](https://discuss.elastic.co/t/es-is-getting-killed/279362 "2021-07-22T09:40:29Z")
OS:-ubuntu ram:-16gb Storage:-500GB CPU:-i5 10th gen i have Cloned ES in two different directory : Es1 Es2 Then first i launched Es1/bin/elastisearch And next i launched Es2/bin/elastisearch while Es2 is launchi… --- ## [Filtering on a property of the first element in a Nested property array](https://discuss.elastic.co/t/filtering-on-a-property-of-the-first-element-in-a-nested-property-array/279298)
**Author:** [@Sikelela\_Nkohla](https://discuss.elastic.co/u/Sikelela_Nkohla)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:54am UTC](https://discuss.elastic.co/t/filtering-on-a-property-of-the-first-element-in-a-nested-property-array/279298 "2021-07-22T07:54:52Z")
We have the following document structure : "Document" : { "arvTreatmentStarted" : "started", "followUps" : \[ { "followUpDate" : "2012-01-01", "arvDrugs" : { "dispenseDoseQuantity" : "30", "dispenseDoseDaysSupply… --- ## [RabbitMQ Input plugin: PKIX path building failed in Logstash 6.8.15](https://discuss.elastic.co/t/rabbitmq-input-plugin-pkix-path-building-failed-in-logstash-6-8-15/279349)
**Author:** [@Pragatheswar](https://discuss.elastic.co/u/Pragatheswar)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 7:23am UTC](https://discuss.elastic.co/t/rabbitmq-input-plugin-pkix-path-building-failed-in-logstash-6-8-15/279349 "2021-07-22T07:23:45Z")
Problem statement Hi guys, I ahve upgraded Logstash from 6.2.2 to 6.5.0. Post that I receive the following error when trying to configure logstash client certificates: \[2018-12-10T22:10:32,949\]\[ERROR\]\[logstash.inputs.… --- ## [Is it possible for kibana to start with blank page before selecting options in control](https://discuss.elastic.co/t/is-it-possible-for-kibana-to-start-with-blank-page-before-selecting-options-in-control/279289)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 7:12am UTC](https://discuss.elastic.co/t/is-it-possible-for-kibana-to-start-with-blank-page-before-selecting-options-in-control/279289 "2021-07-22T07:12:47Z")
I ingested a couple of log files, and it gets populated on the "maps" visualization perfectly . however i wanted to know if its possible for kibana to start with no plots on the map and have it plot only when we choo… --- ## [Upgrading the cluster using Elastic Operator](https://discuss.elastic.co/t/upgrading-the-cluster-using-elastic-operator/279067)
**Author:** [@yubarseg](https://discuss.elastic.co/u/yubarseg)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:06am UTC](https://discuss.elastic.co/t/upgrading-the-cluster-using-elastic-operator/279067 "2021-07-22T07:06:18Z")
Hello, I am testing different upgrade options of Elasticsearch using Elastic Operator on Kubernetes following this documentation Upgrading the cluster. Example described there works fine: Replace dedicated master and … --- ## [Installing specific elasticsearch version in Homebrew - Mac OS](https://discuss.elastic.co/t/installing-specific-elasticsearch-version-in-homebrew-mac-os/278586)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 6:33am UTC](https://discuss.elastic.co/t/installing-specific-elasticsearch-version-in-homebrew-mac-os/278586 "2021-07-22T06:33:12Z")
Hi all, I'm having trouble in installing specific versions of elasticsearch in mac OS using Homebrew. In Homebrew, I can only install the latest version which is available. If I want to install a version eg: 7.13.2 , … --- ## [I want to show time diff](https://discuss.elastic.co/t/i-want-to-show-time-diff/279342)
**Author:** [@byun618](https://discuss.elastic.co/u/byun618)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 6:19am UTC](https://discuss.elastic.co/t/i-want-to-show-time-diff/279342 "2021-07-22T06:19:54Z")
hello every one. this is the data. and i want to show time diff between max and min. p.s this is my first post. so feel free to comment about my post 'form', 'rule' or something --- ## [Search through encrypted data](https://discuss.elastic.co/t/search-through-encrypted-data/278922)
**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 4:41am UTC](https://discuss.elastic.co/t/search-through-encrypted-data/278922 "2021-07-22T04:41:30Z")
Hello: Apparently, in healthcare, the new stipulation evolving - to encrypt the PHI data (no, not the disk - data) - so no one would be able to get the data in cleartext. I know, I know devs can decrypt the data if the… --- ## ["add panel" in dashboard edit view never loads](https://discuss.elastic.co/t/add-panel-in-dashboard-edit-view-never-loads/277976)
**Author:** [@bacony0atmeal](https://discuss.elastic.co/u/bacony0atmeal)\ **Replies:** 27\ **Last updated:** [July 22, 2021, 3:46am UTC](https://discuss.elastic.co/t/add-panel-in-dashboard-edit-view-never-loads/277976 "2021-07-22T03:46:45Z")
kibana version 7.9.1. recently migrated from 6.8.x. steps taken to recreate: kibana home -\> dashboards -\> open up existing dashboard -\> click "Add" -\> "Add panels" pane never populates with any saved visualizations. … --- ## [\[Logstash\] Aggregate filter - no timeout](https://discuss.elastic.co/t/logstash-aggregate-filter-no-timeout/279318)
**Author:** [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\ **Replies:** 6\ **Last updated:** [July 22, 2021, 2:24am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-no-timeout/279318 "2021-07-22T02:24:48Z")
Hi, In my logstash 7.9.3 I would like to create filter similar to that example https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3 I want to create index w… --- ## [SIEM Signals Index and Component Templates](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 10:35pm UTC](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313 "2021-07-21T22:35:55Z")
I have started translating and migrating all my legacy Index Templates over to the new Component Templates, but when I got to the .siem-signals-\ template, I am now getting an error: An error occurred during rule … --- ## [JDBC input is not working when added with Kafka input](https://discuss.elastic.co/t/jdbc-input-is-not-working-when-added-with-kafka-input/279221)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 3\ **Last updated:** [July 21, 2021, 9:08pm UTC](https://discuss.elastic.co/t/jdbc-input-is-not-working-when-added-with-kafka-input/279221 "2021-07-21T21:08:23Z")
Hello Team, I am trying to configure multiple inputs in a pipeline input { jdbc { } kafka { } kafka { } } but when i run the pipeline only kafka messages i am getting and jdbc input is not working. Could … --- ## [Displaying time series in Canvas](https://discuss.elastic.co/t/displaying-time-series-in-canvas/279208)
**Author:** [@gabor](https://discuss.elastic.co/u/gabor)\ **Replies:** 3\ **Last updated:** [July 21, 2021, 8:04pm UTC](https://discuss.elastic.co/t/displaying-time-series-in-canvas/279208 "2021-07-21T20:04:28Z")
Hi, I have a data set based on some server logs containing sent- and received amount of data and client IPs. The dataset is a collection of these documents: { .. server\_ip: IP1, client\_ip: IP2, read: 2232323234, write:… --- ## [Combining two data sources into one or making a parent and child relation with two different sources](https://discuss.elastic.co/t/combining-two-data-sources-into-one-or-making-a-parent-and-child-relation-with-two-different-sources/279089)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 7:05pm UTC](https://discuss.elastic.co/t/combining-two-data-sources-into-one-or-making-a-parent-and-child-relation-with-two-different-sources/279089 "2021-07-21T19:05:54Z")
Hello, So just to set some context around this. We are trying to work around the limitation of returning only at most 10k results during a search and with filters due to having an immense amount of data and it also comi… --- ## [Having hard time matching queries with forward slash & ampersand](https://discuss.elastic.co/t/having-hard-time-matching-queries-with-forward-slash-ampersand/279303)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 7:05pm UTC](https://discuss.elastic.co/t/having-hard-time-matching-queries-with-forward-slash-ampersand/279303 "2021-07-21T19:05:10Z")
I want to identify urls like this from our elastic index http://example.com/?a=1&c=1&s1=1 where the domain name can change. So, I have to rely on matching using the query pattern. In a nutshell, something like this \*/?… --- ## [Logstash parsers for +100 technologies](https://discuss.elastic.co/t/logstash-parsers-for-100-technologies/279308)
**Author:** [@nnovaes](https://discuss.elastic.co/u/nnovaes)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 6:55pm UTC](https://discuss.elastic.co/t/logstash-parsers-for-100-technologies/279308 "2021-07-21T18:55:39Z")
The Cargill SIEM team has published this new project with a collection of logstash parser configs developed in house for multiple technologies. Logstash parsers are usually scattered around in gists and repos but this is… --- ## [Where can I add new apps for exploit protection in the on-premise product?](https://discuss.elastic.co/t/where-can-i-add-new-apps-for-exploit-protection-in-the-on-premise-product/279306)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 6:38pm UTC](https://discuss.elastic.co/t/where-can-i-add-new-apps-for-exploit-protection-in-the-on-premise-product/279306 "2021-07-21T18:38:51Z")
I'm looking for guidance on how to add additional applications to my endgame policy threat | exploit configuration. The major browsers and office apps are there along with Java and Adobe, and I have the option to add app… --- ## [Elastic Transform Error](https://discuss.elastic.co/t/elastic-transform-error/279199)
**Author:** [@IWannaDance](https://discuss.elastic.co/u/IWannaDance)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 6:35pm UTC](https://discuss.elastic.co/t/elastic-transform-error/279199 "2021-07-21T18:35:38Z")
\[ERROR\]\[o.e.x.t.t.TransformPersistentTasksExecutor\] \[node-1\] Failed to start task \[endpoint.metadata\_current-default-0.19.1\] in node operation org.elasticsearch.ElasticsearchStatusException: Unable to start transform \[en… --- ## [Query two separate indices, perform calculations on the results, graph result of calculation](https://discuss.elastic.co/t/query-two-separate-indices-perform-calculations-on-the-results-graph-result-of-calculation/279292)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 3\ **Last updated:** [July 21, 2021, 5:47pm UTC](https://discuss.elastic.co/t/query-two-separate-indices-perform-calculations-on-the-results-graph-result-of-calculation/279292 "2021-07-21T17:47:59Z")
I would like to query two separate indices. I would like to do the following: Query 1: Query metricbeat which returns a figure say for arguments sake 2,500,000. I would like to divide this by 1,000,000 which gives me a… --- ## [Elastic SIEM detection rule query permissions](https://discuss.elastic.co/t/elastic-siem-detection-rule-query-permissions/279242)
**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:27pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rule-query-permissions/279242 "2021-07-21T17:27:30Z")
Hi, Just a simple question: I was wondering how does the detection engine in Kibana execute queries? I couldn't find any documentation about who (which user) runs the queries with which permissions. So is there an in… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=875) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=877)