# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1359 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1360 --- ## [Continuous Transform Timestamp isn't a timestamp](https://discuss.elastic.co/t/continuous-transform-timestamp-isnt-a-timestamp/238594)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 7:10pm UTC](https://discuss.elastic.co/t/continuous-transform-timestamp-isnt-a-timestamp/238594 "2020-06-29T19:10:00Z")
Set up a continuous transform, grouping by a time historgram driven from the @timestamp field. The transform contains an @timestamp value, but it's classified as a number rather than as a date (according to Kibana when … --- ## [Segments with 60-70% deleted docs (5G) never remove deleted docs](https://discuss.elastic.co/t/segments-with-60-70-deleted-docs-5g-never-remove-deleted-docs/238342)
**Author:** [@zenloop](https://discuss.elastic.co/u/zenloop)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 6:39pm UTC](https://discuss.elastic.co/t/segments-with-60-70-deleted-docs-5g-never-remove-deleted-docs/238342 "2020-06-29T18:39:36Z")
Will a 5g segment ever be selected for merging? We have 5g segments with up to 60-70% deleted docs. We have been monitoring and the segments never appear to be selected for merge. --- ## [Metrics from structured logfile](https://discuss.elastic.co/t/metrics-from-structured-logfile/239167)
**Author:** [@Marcel27](https://discuss.elastic.co/u/Marcel27)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 6:19pm UTC](https://discuss.elastic.co/t/metrics-from-structured-logfile/239167 "2020-06-29T18:19:46Z")
I have an application which logs periodicly to a file like: {"field1": 21, "field2": 45, "utctime": "2020-06-26 13:48:36,", "event": "test1"} {"field1": 62, "field2": 15, "utctime": "2020-06-26 13:53:36,", "event": "tes… --- ## [Different fields in different documents](https://discuss.elastic.co/t/different-fields-in-different-documents/238139)
**Author:** [@Anton91](https://discuss.elastic.co/u/Anton91)\ **Replies:** 3\ **Last updated:** [June 23, 2020, 7:05pm UTC](https://discuss.elastic.co/t/different-fields-in-different-documents/238139 "2020-06-23T19:05:37Z")
Hey, I have the following question and I want to visualize two fields with each other that are not connected to each other. Both are stored in different documents but in the same index. For example I have document A:… --- ## [Elasticsearch has deleted all my visualizations and indexes](https://discuss.elastic.co/t/elasticsearch-has-deleted-all-my-visualizations-and-indexes/239157)
**Author:** [@Anton91](https://discuss.elastic.co/u/Anton91)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 4:41pm UTC](https://discuss.elastic.co/t/elasticsearch-has-deleted-all-my-visualizations-and-indexes/239157 "2020-06-29T16:41:36Z")
Hello, today I wanted to continue working on my visualizations and already at the registration I was shown That I cannot select a Space. Then I restarted my machine and thought nothing else. Afterwards I could log in ag… --- ## [Value in Table and JSON are different](https://discuss.elastic.co/t/value-in-table-and-json-are-different/239135)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 4:30pm UTC](https://discuss.elastic.co/t/value-in-table-and-json-are-different/239135 "2020-06-29T16:30:19Z")
Facing This Issue in JSON the value "test": { "test\_id": "1111111111111180522" }, in Kibana table showing as: 1111111111111180526 --- ## [Can not add a new field using if filter and add\_field](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127)
**Author:** [@brapnda23](https://discuss.elastic.co/u/brapnda23)\ **Replies:** 5\ **Last updated:** [June 29, 2020, 4:24pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127 "2020-06-29T16:24:04Z")
Newbie here. Trying to add another field but not working. I have added below set of codes to a .conf file under /etc/conf.d. Logs for logstash not showing any error. Am I doing something wrong here? Using the new 7.8 v… --- ## [Time Based Index Query Performance](https://discuss.elastic.co/t/time-based-index-query-performance/239154)
**Author:** [@Derek\_Gallo](https://discuss.elastic.co/u/Derek_Gallo)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 4:23pm UTC](https://discuss.elastic.co/t/time-based-index-query-performance/239154 "2020-06-29T16:23:33Z")
I was reading through this old thread: https://discuss.elastic.co/t/kibana-search-performance-over-time-based-indices/168617. Based on the dialog in that thread, it seems that the latest versions of ES/Kibana should aut… --- ## [Requirements](https://discuss.elastic.co/t/requirements/235550)
**Author:** [@\_mslo](https://discuss.elastic.co/u/_mslo)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 4:20pm UTC](https://discuss.elastic.co/t/requirements/235550 "2020-06-29T16:20:20Z")
Hi All, I often see questions regarding hardware requirements and I can't find the official Elastic requirements. For instance I cant calculate budget after tests on production. I need to know how many resources I need… --- ## [Ece fundamentals "This site can't be reached" (LAB2)](https://discuss.elastic.co/t/ece-fundamentals-this-site-cant-be-reached-lab2/238158)
**Author:** [@surfsaint](https://discuss.elastic.co/u/surfsaint)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 4:03pm UTC](https://discuss.elastic.co/t/ece-fundamentals-this-site-cant-be-reached-lab2/238158 "2020-06-29T16:03:05Z")
Hi, I just finished installing ECE and upon trying to access the Cloud UI, http://\:12400, I get the page "This site can't be reached". The port is up and can be connected to locally from the command line, b… --- ## [ERROR instance/beat.go:932 Exiting: No outputs are defined. Please define one under the output section](https://discuss.elastic.co/t/error-instance-beat-go-932-exiting-no-outputs-are-defined-please-define-one-under-the-output-section/239153)
**Author:** [@Lin2020](https://discuss.elastic.co/u/Lin2020)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 3:57pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-932-exiting-no-outputs-are-defined-please-define-one-under-the-output-section/239153 "2020-06-29T15:57:20Z")
"Hi, I am very new to ELK stack, kindly support me. I am currently configuring elasticsearch, Logstash, beats and kibana v7.7.1 to collect logs from windows server, Linux server, network devices and application logs in… --- ## [Разделение логов по индексам в Filebeat](https://discuss.elastic.co/t/filebeat/239125)
**Author:** [@Ivan\_Bykov](https://discuss.elastic.co/u/Ivan_Bykov)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 3:49pm UTC](https://discuss.elastic.co/t/filebeat/239125 "2020-06-29T15:49:53Z")
Есть два типа логов /var/log/1.log и 2.log Подскажите пожалуйста, как настроить правильно filebeat чтобы каждому и этих логов соответствовал свой индекс для logstash + elastic? В конфиге у меня сейчас вот так: filebe… --- ## [Using a custom ingest pipeline with a module](https://discuss.elastic.co/t/using-a-custom-ingest-pipeline-with-a-module/239143)
**Author:** [@jamiejackson](https://discuss.elastic.co/u/jamiejackson)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 3:30pm UTC](https://discuss.elastic.co/t/using-a-custom-ingest-pipeline-with-a-module/239143 "2020-06-29T15:30:45Z")
Picking back up on a topic that I shelved a while back: https://discuss.elastic.co/t/apache-httpd-logs-with-comma-delimited-x-forwarded-for-ips/181917 @jsoriano had been helping me and suggested that I try the following… --- ## [\[HELP\]\[ERROR\]\[FILEBEAT\] “cannot retrieve the elasticsearch license from the /\_license endpoint”](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123)
**Author:** [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 3:30pm UTC](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123 "2020-06-29T15:30:05Z")
I had below filebeat-kubernetes.yaml for my ELK where I was using filebeat v 6.6.2 and AWS Elasticsearch version 6.4. Everything was working fine. --- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config n… --- ## [Help with Logstash s3 output plugin refactoring (Feature Request #215)](https://discuss.elastic.co/t/help-with-logstash-s3-output-plugin-refactoring-feature-request-215/239141)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 3:22pm UTC](https://discuss.elastic.co/t/help-with-logstash-s3-output-plugin-refactoring-feature-request-215/239141 "2020-06-29T15:22:43Z")
I am working on refactoring logstash-output-s3 plugin so that it handles custom filenames (Feature Request #215) and I am running into an issue that has become a blocker for me and that is the refactored plugin honors th… --- ## [How to get client compatibility right with different major elasticsearch versions?](https://discuss.elastic.co/t/how-to-get-client-compatibility-right-with-different-major-elasticsearch-versions/239113)
**Author:** [@CoaxVex](https://discuss.elastic.co/u/CoaxVex)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 3:03pm UTC](https://discuss.elastic.co/t/how-to-get-client-compatibility-right-with-different-major-elasticsearch-versions/239113 "2020-06-29T15:03:25Z")
Client libraries are meant to be used against the same major version of the server they are using, but how do you deal with upgrades to a new major version? You can usually load both the old and the new version of the s… --- ## [Will the elasticsearch client work in a ARM64 platform like coral devboard?](https://discuss.elastic.co/t/will-the-elasticsearch-client-work-in-a-arm64-platform-like-coral-devboard/239134)
**Author:** [@Rosho](https://discuss.elastic.co/u/Rosho)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 3:00pm UTC](https://discuss.elastic.co/t/will-the-elasticsearch-client-work-in-a-arm64-platform-like-coral-devboard/239134 "2020-06-29T15:00:26Z")
Hi I am using the Coral devboard (a ARM64 platform). My project consists of taking a photo and doing inference (AI, image classification) with the devboard. Then I want to send the results directly to Elasticsearch. C… --- ## [How to create intentionally slow query?](https://discuss.elastic.co/t/how-to-create-intentionally-slow-query/239132)
**Author:** [@trex](https://discuss.elastic.co/u/trex)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 2:56pm UTC](https://discuss.elastic.co/t/how-to-create-intentionally-slow-query/239132 "2020-06-29T14:56:25Z")
I want to test things with a slow query. How can I create a slow query? I thought it can be done via script GET \_search { "script\_fields": { "AvgTicketPrice": { "script": "sleep(3000);" } } } But it … --- ## [Does aggregations runs in parallel?](https://discuss.elastic.co/t/does-aggregations-runs-in-parallel/237189)
**Author:** [@jessepeixoto](https://discuss.elastic.co/u/jessepeixoto)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 2:48pm UTC](https://discuss.elastic.co/t/does-aggregations-runs-in-parallel/237189 "2020-06-29T14:48:21Z")
Hi everyone, I have one query \_search with four separated nested terms aggregation and filters in the aggregations, this query is retrieving data in about 2 seconds when a specific term is searched. I splitted the four… --- ## [ERROR instance/beat.go:906](https://discuss.elastic.co/t/error-instance-beat-go-906/238611)
**Author:** [@Ivan\_Bykov](https://discuss.elastic.co/u/Ivan_Bykov)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 2:29pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-906/238611 "2020-06-29T14:29:38Z")
Filebeat 6.8.10 при старте ругается ERROR instance/beat.go:906 Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified filebeat .yml такой - type: log paths: - /varl… --- ## [Logstash heap out of memory](https://discuss.elastic.co/t/logstash-heap-out-of-memory/239124)
**Author:** [@chandu5565](https://discuss.elastic.co/u/chandu5565)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 2:17pm UTC](https://discuss.elastic.co/t/logstash-heap-out-of-memory/239124 "2020-06-29T14:17:58Z")
Hi , I am using logstash-7.7.0 to ingest my data from mongodb to elasticsearch using JDBC input plugin. I have around 17 configuration files which polling data from mongodb and the input section of all configuration fil… --- ## [Wrong timestamp, when trying to convert local time to UTC](https://discuss.elastic.co/t/wrong-timestamp-when-trying-to-convert-local-time-to-utc/239111)
**Author:** [@asmerb](https://discuss.elastic.co/u/asmerb)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 2:21pm UTC](https://discuss.elastic.co/t/wrong-timestamp-when-trying-to-convert-local-time-to-utc/239111 "2020-06-29T14:21:09Z")
Hi everyone, I am using LogStash and ElasticSearch 6.3.1 Currently having an issue where my @timestamp is being shifted by two hours. I am picking up records in logstash that comes from filebeat, the timestamp here is… --- ## [Correctness of "should not" query in "Elasticsearch queries" (lesson3) of Elastic Engineer1](https://discuss.elastic.co/t/correctness-of-should-not-query-in-elasticsearch-queries-lesson3-of-elastic-engineer1/238991)
**Author:** [@manojb1-in.ibm.com](https://discuss.elastic.co/u/manojb1-in.ibm.com)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 2:01pm UTC](https://discuss.elastic.co/t/correctness-of-should-not-query-in-elasticsearch-queries-lesson3-of-elastic-engineer1/238991 "2020-06-29T14:01:44Z")
Below is the session provided in lesson. When I tried , I could see many titles with stack word, though I get 260 hits Could you please check, whether the query given in lecture is correct? --- ## [Logstash integration Kafka: Support, or document support for, setting consumer isolation.level to read\_committed](https://discuss.elastic.co/t/logstash-integration-kafka-support-or-document-support-for-setting-consumer-isolation-level-to-read-committed/239116)
**Author:** [@Tim\_te\_Beek](https://discuss.elastic.co/u/Tim_te_Beek)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 1:39pm UTC](https://discuss.elastic.co/t/logstash-integration-kafka-support-or-document-support-for-setting-consumer-isolation-level-to-read-committed/239116 "2020-06-29T13:39:41Z")
Hi; we're using https://github.com/logstash-plugins/logstash-integration-kafka to transcribe Kafka Avro message fields from Kafka to an Elastic search index for our reports. Recently we noticed that the consumer by defa… --- ## [Logstash filter plugins not operating on field](https://discuss.elastic.co/t/logstash-filter-plugins-not-operating-on-field/238870)
**Author:** [@Asinus1223](https://discuss.elastic.co/u/Asinus1223)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 12:54pm UTC](https://discuss.elastic.co/t/logstash-filter-plugins-not-operating-on-field/238870 "2020-06-29T12:54:42Z")
I have been working with the notoriously difficult modsecurity\_audit.log in order to gather some useful statistics from it in order to tweak our Web Application firewall. So far, I've been able to separate the different… --- ## [Question about building a MAP Visualization Object](https://discuss.elastic.co/t/question-about-building-a-map-visualization-object/239018)
**Author:** [@rafaell2](https://discuss.elastic.co/u/rafaell2)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 12:44pm UTC](https://discuss.elastic.co/t/question-about-building-a-map-visualization-object/239018 "2020-06-29T12:44:42Z")
Hi, new on this so apologize if i am not asking the right question here. I am trying to add a MAP LAYER (EMS Boundaries type) for World Countries (using Kibana 7.8) by using my index built through logstash Jdbc Oracle Da… --- ## [How to configure detection SIEM](https://discuss.elastic.co/t/how-to-configure-detection-siem/238385)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 12:43pm UTC](https://discuss.elastic.co/t/how-to-configure-detection-siem/238385 "2020-06-29T12:43:31Z")
Hi, Problem: data from filebeat appear in SIEM, but at detection the it just empty and show this notification "Let’s set up your detection engine To use the detection engine, a user with the required cluster and index… --- ## [Can't setup active-directory auth](https://discuss.elastic.co/t/cant-setup-active-directory-auth/239082)
**Author:** [@parrabol](https://discuss.elastic.co/u/parrabol)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 9:08am UTC](https://discuss.elastic.co/t/cant-setup-active-directory-auth/239082 "2020-06-29T09:08:16Z")
Hi all. I'm stuck with this active-directory auth to kibana via AD creds. When I'm trying to enable auth in kibana, after login i got a message - {"statusCode":403,"error":"Forbidden","message":"Forbidden"}. I added my… --- ## [Elasticsearch does not start because of a graylog-server error](https://discuss.elastic.co/t/elasticsearch-does-not-start-because-of-a-graylog-server-error/237495)
**Author:** [@uek](https://discuss.elastic.co/u/uek)\ **Replies:** 13\ **Last updated:** [June 29, 2020, 12:05pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-because-of-a-graylog-server-error/237495 "2020-06-29T12:05:13Z")
Hello there, my elasticsearch-oss I would like to use in combination with prometheus and grafana does not start on my centos8 machine because of theese errors : Automatic restarting of the unit graylog-server.service… --- ## [Heartbeat POD crashes - Why?](https://discuss.elastic.co/t/heartbeat-pod-crashes-why/238457)
**Author:** [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 11:58am UTC](https://discuss.elastic.co/t/heartbeat-pod-crashes-why/238457 "2020-06-29T11:58:43Z")
Hi. Im trying to run heartbeat on kubernetes. When i create the pod, it crashes and show this message: /usr/local/bin/docker-entrypoint: line 8: exec: heartbeat: not found This is my yml file: apiVersion: v1 kind: Po… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1358) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1360)