# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1039 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1040 --- ## [Design Question - Better to have a summary text field or index each field as keyword and text](https://discuss.elastic.co/t/design-question-better-to-have-a-summary-text-field-or-index-each-field-as-keyword-and-text/297815)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 1:03am UTC](https://discuss.elastic.co/t/design-question-better-to-have-a-summary-text-field-or-index-each-field-as-keyword-and-text/297815 "2022-02-24T01:03:39Z")
So I have a general design question. I have long been indexing documents where all string fields generally are stored as keywords. However now we are wanting to add the capability to allow users to enter a string and t… --- ## [Data enrichment](https://discuss.elastic.co/t/data-enrichment/298099)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 12:35am UTC](https://discuss.elastic.co/t/data-enrichment/298099 "2022-02-24T00:35:51Z")
How is best way for data enrichment? I have events with IDs of employees in ES, and want change them on their surname. How do it best way? Should I do it in logstash? Most helpful would be to change static lookup but I … --- ## [Should Data Nodes still be the same size?](https://discuss.elastic.co/t/should-data-nodes-still-be-the-same-size/298059)
**Author:** [@bunste](https://discuss.elastic.co/u/bunste)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 11:20pm UTC](https://discuss.elastic.co/t/should-data-nodes-still-be-the-same-size/298059 "2022-02-23T23:20:53Z")
Hello all, In our company we run a small Elasticsearch cluster with meanwhile 6 data nodes. These have been added over time and are therefore equipped quite differently - especially in terms of disk capacity. Now we ar… --- ## [Pivot transform copying values](https://discuss.elastic.co/t/pivot-transform-copying-values/297919)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 10\ **Last updated:** [February 23, 2022, 11:05pm UTC](https://discuss.elastic.co/t/pivot-transform-copying-values/297919 "2022-02-23T23:05:21Z")
I'm attempting my first pivot transform with a goal of calculating duration between timestamps. In the group\_by clause, it results in a two documents, each with a timestamp. I have been able to calculate the duration u… --- ## [Kibana Controls shows only top 10 values](https://discuss.elastic.co/t/kibana-controls-shows-only-top-10-values/297949)
**Author:** [@Eduard\_Abril](https://discuss.elastic.co/u/Eduard_Abril)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 10:14pm UTC](https://discuss.elastic.co/t/kibana-controls-shows-only-top-10-values/297949 "2022-02-23T22:14:15Z")
Hi guys, I'm building some kibana dashbaords using control panel and I have a problem because control panel is showing only the first 10 values or at least it seems so. I understand that control panel does a terms aggr… --- ## [Python Elasticsearch](https://discuss.elastic.co/t/python-elasticsearch/298053)
**Author:** [@Achraf\_MENSI](https://discuss.elastic.co/u/Achraf_MENSI)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 10:02pm UTC](https://discuss.elastic.co/t/python-elasticsearch/298053 "2022-02-23T22:02:53Z")
Hello it's possible to update ILM policy directly with python? --- ## [Logstash 7.x support on Debian 10 or 11](https://discuss.elastic.co/t/logstash-7-x-support-on-debian-10-or-11/298087)
**Author:** [@jeroen.antsec](https://discuss.elastic.co/u/jeroen.antsec)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 9:48pm UTC](https://discuss.elastic.co/t/logstash-7-x-support-on-debian-10-or-11/298087 "2022-02-23T21:48:06Z")
Hi all. Do any of you know the reason why Logstash 7.x (all versions up to 7.17) are not officially supported on Debian 10 or 11? Elastic and Kibana are, but Logstash not. Only version 8.0 is supported on Debian 10. Wil… --- ## [Logstash parshing unicode characters](https://discuss.elastic.co/t/logstash-parshing-unicode-characters/296890)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 16\ **Last updated:** [February 23, 2022, 8:46pm UTC](https://discuss.elastic.co/t/logstash-parshing-unicode-characters/296890 "2022-02-23T20:46:48Z")
hi, we are running into parsing errors when sending data through logstash pipelines. After digging a little, found that the source system has been sending a lot of unicode special characters - something like below: \\u00… --- ## [Explanation of terms in a search](https://discuss.elastic.co/t/explanation-of-terms-in-a-search/297523)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 7\ **Last updated:** [February 23, 2022, 8:36pm UTC](https://discuss.elastic.co/t/explanation-of-terms-in-a-search/297523 "2022-02-23T20:36:19Z")
Hello. I am trying to understand this passage, which is in the 6.8 REST API docs: By default, all terms are optional, as long as one term matches. A search for foo bar baz will find any document that contains one or mo… --- ## [Can not connect to localhost:9600 for logstash](https://discuss.elastic.co/t/can-not-connect-to-localhost-9600-for-logstash/297687)
**Author:** [@TomYang1993](https://discuss.elastic.co/u/TomYang1993)\ **Replies:** 13\ **Last updated:** [February 23, 2022, 7:23pm UTC](https://discuss.elastic.co/t/can-not-connect-to-localhost-9600-for-logstash/297687 "2022-02-23T19:23:22Z")
logstash 7.17.0 Elasticsearch 7.17.0 logstash with all default settings, fresh install use sudo systemctl start logstash to start, sudo status shows logstash actively running However, curl -XGET 'localhost:9600/?pret… --- ## [Geoip stopped consolidating coordinates after logstash upgrade to 8.0](https://discuss.elastic.co/t/geoip-stopped-consolidating-coordinates-after-logstash-upgrade-to-8-0/298067)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 6:46pm UTC](https://discuss.elastic.co/t/geoip-stopped-consolidating-coordinates-after-logstash-upgrade-to-8-0/298067 "2022-02-23T18:46:22Z")
My logstash for geo tagging IPs are failing after logstash upgrade 8.0. Here's a snippet , i get the lat and lon values , but cant seem to get into the "destlocation" field "Dest\_IP" =\> { "geo" =\> { … --- ## [Using eql to query for custom log](https://discuss.elastic.co/t/using-eql-to-query-for-custom-log/297834)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 5:20pm UTC](https://discuss.elastic.co/t/using-eql-to-query-for-custom-log/297834 "2022-02-23T17:20:40Z")
Hi all, I have question on the ability to query data for eql, Can eql be used to query for any log source other than from elastic-agent or winlogbeat. For example: i use filebeat to collect log from iis server then pu… --- ## [Get output value of powershell script](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 5:02pm UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768 "2022-02-23T17:02:38Z")
Hi, In winlogbeat, I'm able to get the body of PowerShell script that is executed on device using: powershell.file.script\_block\_text: But is there a way to get the 'stdout' or return / output of the script? Regrdas, --- ## [Multiple Must queries not working inside a should query as expected](https://discuss.elastic.co/t/multiple-must-queries-not-working-inside-a-should-query-as-expected/298024)
**Author:** [@Venkat\_Pavan](https://discuss.elastic.co/u/Venkat_Pavan)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:51pm UTC](https://discuss.elastic.co/t/multiple-must-queries-not-working-inside-a-should-query-as-expected/298024 "2022-02-23T16:51:41Z")
I am trying to write a query of the form A or B or C or D where condition A is of the form A11 and A12, similarly B = B11 and B12 and so on. I am using elastic version 6.8 and executing the queries in Kibana. I have add… --- ## [Database Management](https://discuss.elastic.co/t/database-management/298060)
**Author:** [@John\_Dever\_Rusiana](https://discuss.elastic.co/u/John_Dever_Rusiana)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:49pm UTC](https://discuss.elastic.co/t/database-management/298060 "2022-02-23T16:49:57Z")
Hi All, good day! I just want to ask from someone who have experienced in Database Management. As a database designer or manager, which would you prefer doing, normalization or denormalization of database? Why? Any ide… --- ## [Run Elastic Agent and Auditbeat](https://discuss.elastic.co/t/run-elastic-agent-and-auditbeat/298061)
**Author:** [@lethalMango](https://discuss.elastic.co/u/lethalMango)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:40pm UTC](https://discuss.elastic.co/t/run-elastic-agent-and-auditbeat/298061 "2022-02-23T16:40:08Z")
I am upgrading our environment to use Elastic Agent. Currently we use Auditbeat, Winglogbeat and Filebeat. From what I can see Winlog and Filebeat are implemented, Auditbeat (specifically around file integrity monitori… --- ## [Function rate\_counter not working properly when multiple dimensions](https://discuss.elastic.co/t/function-rate-counter-not-working-properly-when-multiple-dimensions/298062)
**Author:** [@Yves\_Blt](https://discuss.elastic.co/u/Yves_Blt)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 4:19pm UTC](https://discuss.elastic.co/t/function-rate-counter-not-working-properly-when-multiple-dimensions/298062 "2022-02-23T16:19:20Z")
Hello everybody, I am currently using counter\_rate function in TSBV for my incremental counter, but I found out that this is not working properly when several dimensions are presents. I have a counter called "http\_serv… --- ## [Kibana Short URL Intended Use](https://discuss.elastic.co/t/kibana-short-url-intended-use/297619)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 5\ **Last updated:** [February 23, 2022, 4:26pm UTC](https://discuss.elastic.co/t/kibana-short-url-intended-use/297619 "2022-02-23T16:26:21Z")
Hi, We've historically used Kibana's short URL feature to provide users with reliable links to predefined Kibana discover queries. This has been needed as we have Kibana behind a single sign-on flow which causes URL fr… --- ## [Shard Siem cause cluster red V2](https://discuss.elastic.co/t/shard-siem-cause-cluster-red-v2/296575)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:14pm UTC](https://discuss.elastic.co/t/shard-siem-cause-cluster-red-v2/296575 "2022-02-23T16:14:43Z")
Hello everyone, I have a problem with my .siem-signals-default index. The shard goes to red status and I can't reallocate the shard to another node. Because the shard seems to not be in my cluster and I can't get it bac… --- ## [Logstash array how to and filter](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 4:11pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054 "2022-02-23T16:11:26Z")
Hi. I have a list of user name's with user ID 1-100 each user id case a name that contains to it. Exmaple 01 "user 1" 02 "user2" etc. I my log events I have user id known but not user name. How can I match user id … --- ## [Watcher error when force executing](https://discuss.elastic.co/t/watcher-error-when-force-executing/297648)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 3:46pm UTC](https://discuss.elastic.co/t/watcher-error-when-force-executing/297648 "2022-02-23T15:46:54Z")
Hi - I noticed this error when attempting to force execute a watcher that triggers out the alert to our monitoring tool - Nagios. could not parse \[webhook\] action \[inlined/notify-nagios\]. failed parsing http request te… --- ## [Packetbeat Logstash and Elastic cloud](https://discuss.elastic.co/t/packetbeat-logstash-and-elastic-cloud/298034)
**Author:** [@kasuma](https://discuss.elastic.co/u/kasuma)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 3:42pm UTC](https://discuss.elastic.co/t/packetbeat-logstash-and-elastic-cloud/298034 "2022-02-23T15:42:03Z")
Hello, I have a problem were my dashboard showing an "error" message when data are loaded from logstash, but if i load data directly from packetbeat to elastic cloud everything is working This is my setup: packetbeat.… --- ## [Cannot convert date to string by mutate](https://discuss.elastic.co/t/cannot-convert-date-to-string-by-mutate/298022)
**Author:** [@ivanhoe-dev](https://discuss.elastic.co/u/ivanhoe-dev)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 3:25pm UTC](https://discuss.elastic.co/t/cannot-convert-date-to-string-by-mutate/298022 "2022-02-23T15:25:15Z")
I want to force my search\_varchar\_1 data type as string, but it always auto detect my data and parse as date type. Is there something I missed? My config filter { split {} csv { separator =\> "," skip\_header =\> "t… --- ## [What's the disk watermark actually applied while specified in both node configuration file and cluster settings?](https://discuss.elastic.co/t/whats-the-disk-watermark-actually-applied-while-specified-in-both-node-configuration-file-and-cluster-settings/297966)
**Author:** [@Hao\_Yellow](https://discuss.elastic.co/u/Hao_Yellow)\ **Replies:** 13\ **Last updated:** [February 23, 2022, 3:21pm UTC](https://discuss.elastic.co/t/whats-the-disk-watermark-actually-applied-while-specified-in-both-node-configuration-file-and-cluster-settings/297966 "2022-02-23T15:21:44Z")
Hello, I have a cluster of several nodes, where each node has the following configuration about the disk watermark: cluster.routing.allocation.disk.watermark.low=60gb cluster.routing.allocation.disk.watermark.high=50gb … --- ## [Filebeat not sending data to Elasticsearch, index\_not\_found\_exception](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch-index-not-found-exception/298047)
**Author:** [@nspeaks](https://discuss.elastic.co/u/nspeaks)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch-index-not-found-exception/298047 "2022-02-23T15:03:45Z")
I am using this guide: How To Build A Security Information and Event Management (SIEM) System with Suricata and the Elastic Stack on Rocky Linux 8 | DigitalOcean to install Suricata along with ELK stack on a Rocky Linux… --- ## [Parse json data with logstash](https://discuss.elastic.co/t/parse-json-data-with-logstash/297792)
**Author:** [@sylar11](https://discuss.elastic.co/u/sylar11)\ **Replies:** 7\ **Last updated:** [February 23, 2022, 2:54pm UTC](https://discuss.elastic.co/t/parse-json-data-with-logstash/297792 "2022-02-23T14:54:12Z")
Hi all, I'm a newbie to logstash and I'm trying to parse a JSON data file like the following { "A001": { "X": 503744.7, "Y": 4726339.0, "Z": 458.84, "LON": -2.954286956913572, … --- ## [Heatmap will show success rate using vega-lite or vega](https://discuss.elastic.co/t/heatmap-will-show-success-rate-using-vega-lite-or-vega/297600)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 7\ **Last updated:** [February 23, 2022, 2:48pm UTC](https://discuss.elastic.co/t/heatmap-will-show-success-rate-using-vega-lite-or-vega/297600 "2022-02-23T14:48:50Z")
Hi Everyone, I need to create a heatmap that will show the success rate for the two Types of Partners. Now let me brief you about my requirement. We have transaction-level data for two types of partners, ex: Type A, … --- ## [Exists query problem](https://discuss.elastic.co/t/exists-query-problem/298037)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 2:45pm UTC](https://discuss.elastic.co/t/exists-query-problem/298037 "2022-02-23T14:45:37Z")
Hello friends, I need your help on a subject. There is a field with a nested type in an index and another field with a string type in this field. Any record has this field, but I would be very happy if you could help me … --- ## [Filebeat httpjson input](https://discuss.elastic.co/t/filebeat-httpjson-input/297730)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 2:17pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-input/297730 "2022-02-23T14:17:48Z")
Hi Im trying to use filebeat httpjson to ingest some mongodb atlas metrics but Im struggling with the authentication, Its looks by the way the examples in mongo atlas site that they use digest authentication example cu… --- ## [Why only elasticsearch container starts and kibana and filebeat containers are not getting up?](https://discuss.elastic.co/t/why-only-elasticsearch-container-starts-and-kibana-and-filebeat-containers-are-not-getting-up/298040)
**Author:** [@Mahesh\_Abnave](https://discuss.elastic.co/u/Mahesh_Abnave)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 1:19pm UTC](https://discuss.elastic.co/t/why-only-elasticsearch-container-starts-and-kibana-and-filebeat-containers-are-not-getting-up/298040 "2022-02-23T13:19:41Z")
I have an application running on six services (or containers) running on an existing docker network. I have deployed them on my local machine using docker stack deploy command. I wanted to create another set of container… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1038) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1040)