# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1008 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1009 --- ## [Mutate or grok product/price that keep changing everyday](https://discuss.elastic.co/t/mutate-or-grok-product-price-that-keep-changing-everyday/300134)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 3:02pm UTC](https://discuss.elastic.co/t/mutate-or-grok-product-price-that-keep-changing-everyday/300134 "2022-03-20T15:02:01Z")
Hi, I have a question about logstash for CSV. My situation is, I have multiple CSV files being uploaded into logstash. the log will continue to update for product or price but the domain will remain the same. my questio… --- ## [Remove \_value in watcher output from REST call](https://discuss.elastic.co/t/remove-value-in-watcher-output-from-rest-call/300119)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 2:13pm UTC](https://discuss.elastic.co/t/remove-value-in-watcher-output-from-rest-call/300119 "2022-03-20T14:13:32Z")
I my watcher I collect a record from the rest interface, retrieve a nice Json. But in the index part of the watcher it adds \_value to the index: This means all fields in the index get "\_value." before there name. D… --- ## [Cross-cluster search](https://discuss.elastic.co/t/cross-cluster-search/300132)
**Author:** [@ufuk\_varol](https://discuss.elastic.co/u/ufuk_varol)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 1:55pm UTC](https://discuss.elastic.co/t/cross-cluster-search/300132 "2022-03-20T13:55:06Z")
Does standard version of Elasticsearch support "cross-cluster search" feature explained below link detailly? --- ## [Split json fields of similar type in logstash](https://discuss.elastic.co/t/split-json-fields-of-similar-type-in-logstash/300133)
**Author:** [@zubair\_aftab](https://discuss.elastic.co/u/zubair_aftab)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 1:48pm UTC](https://discuss.elastic.co/t/split-json-fields-of-similar-type-in-logstash/300133 "2022-03-20T13:48:40Z")
I have a json file converted from pcap using tshark. There are different layers inside the json and each layer has different fields. Some fields are repeating inside the same message for example "bicc\_bicc\_cic" as shown … --- ## [Restoration of indices from aws](https://discuss.elastic.co/t/restoration-of-indices-from-aws/300129)
**Author:** [@Mahendra\_Choudhary](https://discuss.elastic.co/u/Mahendra_Choudhary)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 1:11pm UTC](https://discuss.elastic.co/t/restoration-of-indices-from-aws/300129 "2022-03-20T13:11:03Z")
Hello all, I am new in ELK stack. Often I need to restore indices from aws. But most of time it interrupt and fails, I need to start again from beginning. Also, restoration seems to be very slow. Is there any faster … --- ## [What is the meaning of query\_string with 1~ or ~AUTO?](https://discuss.elastic.co/t/what-is-the-meaning-of-query-string-with-1-or-auto/300128)
**Author:** [@asil](https://discuss.elastic.co/u/asil)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 12:58pm UTC](https://discuss.elastic.co/t/what-is-the-meaning-of-query-string-with-1-or-auto/300128 "2022-03-20T12:58:18Z")
I read the documentation of (Query string query | Elasticsearch Guide \[8.1\] | Elastic) and still don't understand the following example: GET /\_search { "query": { "bool": { "must": \[{ "… --- ## [Master\_not\_discovered\_exception](https://discuss.elastic.co/t/master-not-discovered-exception/300125)
**Author:** [@kzltp](https://discuss.elastic.co/u/kzltp)\ **Replies:** 2\ **Last updated:** [March 20, 2022, 12:25pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception/300125 "2022-03-20T12:25:24Z")
Hello Everyone; I created elastic environment with 4 nodes. 2 nodes set master role other 2 role set data node. When all node was starting everything is okey. but when any master node down, my cluster not working. Other… --- ## [ElasticSearch Linux startup failed. Procedure](https://discuss.elastic.co/t/elasticsearch-linux-startup-failed-procedure/298799)
**Author:** [@zx\_emo](https://discuss.elastic.co/u/zx_emo)\ **Replies:** 10\ **Last updated:** [March 20, 2022, 9:47am UTC](https://discuss.elastic.co/t/elasticsearch-linux-startup-failed-procedure/298799 "2022-03-20T09:47:30Z")
Elasticsearch has been deployed to Linux and I have encountered a problem with the certificate signing. After following the steps to resolve these problems, I get an exception when I start Elasticsearch. How do I resolve… --- ## [How can make sub aggregation code in elasticsearch-java:7.17.1](https://discuss.elastic.co/t/how-can-make-sub-aggregation-code-in-elasticsearch-java-7-17-1/300001)
**Author:** [@mzinboy](https://discuss.elastic.co/u/mzinboy)\ **Replies:** 2\ **Last updated:** [March 20, 2022, 8:57am UTC](https://discuss.elastic.co/t/how-can-make-sub-aggregation-code-in-elasticsearch-java-7-17-1/300001 "2022-03-20T08:57:54Z")
Hi, I can't make code to aggregation with sub aggregation using "Elasticsearch-java:7.17.1" Java library. There is no subAggregation method in TermsAggregation.Builder class. How to complete the code that has with su… --- ## [Elasticsear 8.X TLS question](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521)
**Author:** [@qq350162199](https://discuss.elastic.co/u/qq350162199)\ **Replies:** 8\ **Last updated:** [March 20, 2022, 12:51am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521 "2022-03-20T00:51:46Z")
I'm a beginner, and the latest release of elastic 8.x is a great product that automatically configures TLS security, solves previous complex deployments, and is perfect for a little white like me. But I'm also having pr… --- ## [Undocumented behaviour: Term query on date field becomes a range query](https://discuss.elastic.co/t/undocumented-behaviour-term-query-on-date-field-becomes-a-range-query/300113)
**Author:** [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\ **Replies:** 0\ **Last updated:** [March 19, 2022, 9:36pm UTC](https://discuss.elastic.co/t/undocumented-behaviour-term-query-on-date-field-becomes-a-range-query/300113 "2022-03-19T21:36:40Z")
I was speaking with a colleague recently and I mentioned I use a term query over a date field to find matches on a certain day, like this: { "query": { "term": { "@timestamp": { "value": "2021-10-08"… --- ## [7.16.2 - ILM - max primary shard size not working](https://discuss.elastic.co/t/7-16-2-ilm-max-primary-shard-size-not-working/299975)
**Author:** [@SteveParker](https://discuss.elastic.co/u/SteveParker)\ **Replies:** 2\ **Last updated:** [March 19, 2022, 5:14pm UTC](https://discuss.elastic.co/t/7-16-2-ilm-max-primary-shard-size-not-working/299975 "2022-03-19T17:14:04Z")
My ILM policy has a max shard size of 50gb but my indexes are growing to 100gb+, I must have missed something, help required please --- ## [ELK 8.1: loading std. dashboards failing w/error 403](https://discuss.elastic.co/t/elk-8-1-loading-std-dashboards-failing-w-error-403/300093)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [March 19, 2022, 2:00am UTC](https://discuss.elastic.co/t/elk-8-1-loading-std-dashboards-failing-w-error-403/300093 "2022-03-19T02:00:31Z")
On a PoC v.8.1 single elastic node + kibana + grafana, I'm trying to load std. metricbeat dashboards etc. into kibana like below only it returns an 403 error: $ metricbeat setup dashboards -c /etc/metricbeat/metricbeat.… --- ## [The issue with Elasticsearch 6.8 & repository-s3](https://discuss.elastic.co/t/the-issue-with-elasticsearch-6-8-repository-s3/299984)
**Author:** [@jtsunne](https://discuss.elastic.co/u/jtsunne)\ **Replies:** 2\ **Last updated:** [March 18, 2022, 11:24pm UTC](https://discuss.elastic.co/t/the-issue-with-elasticsearch-6-8-repository-s3/299984 "2022-03-18T23:24:05Z")
I'm facing a strange issue. It was working 6 months ago. Elasticsearch version 6.8.12 was created based on the CentOS Linux release 7.9.2009 (Core) from RPM (we are using Puppet) { "name": "az-es68-master-1", "cluster… --- ## [Is there a way to have visulisation's use the most recent event even if its outside of the specified time range?](https://discuss.elastic.co/t/is-there-a-way-to-have-visulisations-use-the-most-recent-event-even-if-its-outside-of-the-specified-time-range/300067)
**Author:** [@Tooty-Fruity](https://discuss.elastic.co/u/Tooty-Fruity)\ **Replies:** 1\ **Last updated:** [March 18, 2022, 8:30pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-have-visulisations-use-the-most-recent-event-even-if-its-outside-of-the-specified-time-range/300067 "2022-03-18T20:30:36Z")
Hi there, I have a Kibana dashboard where new events are continuously pushed into Elasticsearch. If I were to use the time range filter and set it to lets say 15 mins, my dashboard would only show me events that have ar… --- ## [Vector Tile API response id: (integer) Unique ID for the feature within the layer not found in hits or aggs layer](https://discuss.elastic.co/t/vector-tile-api-response-id-integer-unique-id-for-the-feature-within-the-layer-not-found-in-hits-or-aggs-layer/299952)
**Author:** [@Joseph\_Parish](https://discuss.elastic.co/u/Joseph_Parish)\ **Replies:** 6\ **Last updated:** [March 18, 2022, 8:26pm UTC](https://discuss.elastic.co/t/vector-tile-api-response-id-integer-unique-id-for-the-feature-within-the-layer-not-found-in-hits-or-aggs-layer/299952 "2022-03-18T20:26:32Z")
Hi I am testing the Vector Tile API using this repo which is an excellent tool. I would like to use the feature-id within the hits layer of a polygon, but get this: Error: The feature id parameter must be provided. I … --- ## [Pivot Transform Count of documents](https://discuss.elastic.co/t/pivot-transform-count-of-documents/300082)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 1\ **Last updated:** [March 18, 2022, 7:14pm UTC](https://discuss.elastic.co/t/pivot-transform-count-of-documents/300082 "2022-03-18T19:14:20Z")
This seems to work, is it the best way? In a pivot transform, I want a count of the documents included in the aggregation. I tried this and it seemed to work. However feeling uneasy without a vote of confidence from t… --- ## [How Do I Add A Location Header To My Kibana App?](https://discuss.elastic.co/t/how-do-i-add-a-location-header-to-my-kibana-app/300003)
**Author:** [@hyattc](https://discuss.elastic.co/u/hyattc)\ **Replies:** 2\ **Last updated:** [March 18, 2022, 5:34pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-location-header-to-my-kibana-app/300003 "2022-03-18T17:34:03Z")
I've created a custom app plugin for Kibana 7.16.3. I'd like to add a header similar to other apps in Kibana. For example... Dev Tools has a header that works like a link. I'd like to do something similar for my ap… --- ## [Logstash concatenate two field values from metricbeat](https://discuss.elastic.co/t/logstash-concatenate-two-field-values-from-metricbeat/300060)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 3\ **Last updated:** [March 18, 2022, 5:11pm UTC](https://discuss.elastic.co/t/logstash-concatenate-two-field-values-from-metricbeat/300060 "2022-03-18T17:11:10Z")
Hello All, Can someone help with this,I need to concatenate two fileds from metricbeat and create other filed with this concatenated value.Tried to use mutate filter didn't worked. filter{ mutate { add\_field =\> { "moun… --- ## [Cisco ASA Integration not working (Kibana version 8.1)](https://discuss.elastic.co/t/cisco-asa-integration-not-working-kibana-version-8-1/300066)
**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 4:17pm UTC](https://discuss.elastic.co/t/cisco-asa-integration-not-working-kibana-version-8-1/300066 "2022-03-18T16:17:42Z")
Hello, im quite new to Elasticsearch /ELK-Stack and ran into a problem with monitoring my logfiles from a Cisco ASA 5520. The problem seems to be the logfile format of my ASA and therefore they dont get parsed correctl… --- ## [How to make writing on ElasticSearch safe?](https://discuss.elastic.co/t/how-to-make-writing-on-elasticsearch-safe/300018)
**Author:** [@TonyAgosta](https://discuss.elastic.co/u/TonyAgosta)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 9:18am UTC](https://discuss.elastic.co/t/how-to-make-writing-on-elasticsearch-safe/300018 "2022-03-18T09:18:34Z")
Hi to all, I'm new on this community. My application write on Elasticsearch index using Apache Camel routes. Sometimes it happens that my Elasticsearch is not reachable and therefore the data that should be written at … --- ## [Issue with master nodes being deleted and no new master being selected](https://discuss.elastic.co/t/issue-with-master-nodes-being-deleted-and-no-new-master-being-selected/300062)
**Author:** [@arvinds](https://discuss.elastic.co/u/arvinds)\ **Replies:** 3\ **Last updated:** [March 18, 2022, 3:51pm UTC](https://discuss.elastic.co/t/issue-with-master-nodes-being-deleted-and-no-new-master-being-selected/300062 "2022-03-18T15:51:24Z")
Hi, all, thanks in advance for taking the time to read through this: I am running a cluster on a docker swarm on a bare metal server and I have gotten into a state where the master node is never selected: { "type":… --- ## [Logstash 8.1.0-1 fails to start](https://discuss.elastic.co/t/logstash-8-1-0-1-fails-to-start/300059)
**Author:** [@lmalossi](https://discuss.elastic.co/u/lmalossi)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 3:13pm UTC](https://discuss.elastic.co/t/logstash-8-1-0-1-fails-to-start/300059 "2022-03-18T15:13:12Z")
Hi all, I'm trying to start logstash with systemctl but in log i get the following \[2022-03-18T16:07:32,888\]\[INFO \]\[logstash.runner \] Log4j configuration path used is: /etc/logstash/log4j2.properties \[2022-03-… --- ## [Kibana Vega bar chart errors](https://discuss.elastic.co/t/kibana-vega-bar-chart-errors/299440)
**Author:** [@M\_Chiorboli](https://discuss.elastic.co/u/M_Chiorboli)\ **Replies:** 4\ **Last updated:** [March 18, 2022, 2:24pm UTC](https://discuss.elastic.co/t/kibana-vega-bar-chart-errors/299440 "2022-03-18T14:24:54Z")
Hello, I am trying to produce a bar chart in Kibana using Vega. I use Vega because I have to use nested fields, and it seems there are not other options. This is my script: { "$schema": "https://vega.github.io/sche… --- ## [Kibana service failed to start](https://discuss.elastic.co/t/kibana-service-failed-to-start/296334)
**Author:** [@gabal007](https://discuss.elastic.co/u/gabal007)\ **Replies:** 5\ **Last updated:** [March 18, 2022, 1:58pm UTC](https://discuss.elastic.co/t/kibana-service-failed-to-start/296334 "2022-03-18T13:58:25Z")
Hi all, I hope that message finds you well. I have installed elk version 7.17 on CentOS Linux release 7.9.2009. I've tried to install kibana as a service, and it's failing to start. Based on what I'm reading on other … --- ## [Kibana Document download limit at 10,000](https://discuss.elastic.co/t/kibana-document-download-limit-at-10-000/300010)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [March 18, 2022, 11:35am UTC](https://discuss.elastic.co/t/kibana-document-download-limit-at-10-000/300010 "2022-03-18T11:35:55Z")
Hi all, I'm trying to download discover search data with some of my filters. However, When i download I see that document limit in CSV is at 10,000 documents. Any way or setting to increase document download limit? --- ## [Httpjson Input Config Issue](https://discuss.elastic.co/t/httpjson-input-config-issue/299909)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 1\ **Last updated:** [March 18, 2022, 11:34am UTC](https://discuss.elastic.co/t/httpjson-input-config-issue/299909 "2022-03-18T11:34:13Z")
I am using the Fleet integration for httpjson to attempt to pull down API logs. The request I am mimicking in the config is the curl request below (which works correctly). curl --location --request POST 'https://api.ju… --- ## [Frozen tier heap space](https://discuss.elastic.co/t/frozen-tier-heap-space/300032)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 11:23am UTC](https://discuss.elastic.co/t/frozen-tier-heap-space/300032 "2022-03-18T11:23:58Z")
What are recommendations for size of heap space on frozen data tier nodes? --- ## [How to get inner hits field values in Nest or Elastic.Net library ? Alterantivly how to specify output type in Nest or Elastic.Net library?](https://discuss.elastic.co/t/how-to-get-inner-hits-field-values-in-nest-or-elastic-net-library-alterantivly-how-to-specify-output-type-in-nest-or-elastic-net-library/299977)
**Author:** [@SZHURAVSKYI](https://discuss.elastic.co/u/SZHURAVSKYI)\ **Replies:** 0\ **Last updated:** [March 17, 2022, 4:57pm UTC](https://discuss.elastic.co/t/how-to-get-inner-hits-field-values-in-nest-or-elastic-net-library-alterantivly-how-to-specify-output-type-in-nest-or-elastic-net-library/299977 "2022-03-17T16:57:07Z")
Hi, I am new to Elasticsearch and I am having troubles with the Nest/Elastic.Net library. I would like to retrieve not entire document but just part of it. I am able to do it in Postman but I cannot do it via Elastic.N… --- ## [Mongodb connection](https://discuss.elastic.co/t/mongodb-connection/300023)
**Author:** [@shamir](https://discuss.elastic.co/u/shamir)\ **Replies:** 2\ **Last updated:** [March 18, 2022, 10:41am UTC](https://discuss.elastic.co/t/mongodb-connection/300023 "2022-03-18T10:41:03Z")
curl -XPUT 'https://localhost:9200/\_river/mongodb/\_meta' -d '{ \> "type": "mongodb", \> "mongodb": { \> "db": "appbroda", \> "collection": "users" \> }, \> "index": { \> "name": "appbrodai… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1007) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1009)