# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1057 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1058 --- ## [Date format err in query?](https://discuss.elastic.co/t/date-format-err-in-query/296964)
**Author:** [@kin122](https://discuss.elastic.co/u/kin122)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 10:38am UTC](https://discuss.elastic.co/t/date-format-err-in-query/296964 "2022-02-11T10:38:21Z")
hi,i got a error in the following query. but its ok in this format Officially, the two formats are the same. I'm confused, please tell me the reason --- ## [Finding the first occurrence of all Unique IDs within a term](https://discuss.elastic.co/t/finding-the-first-occurrence-of-all-unique-ids-within-a-term/296908)
**Author:** [@SkipJ](https://discuss.elastic.co/u/SkipJ)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 10:35am UTC](https://discuss.elastic.co/t/finding-the-first-occurrence-of-all-unique-ids-within-a-term/296908 "2022-02-11T10:35:12Z")
I'm trying to create a visualization that captures all new users a from the last month (now/M-1 to now/M), then capture the amount of sessions they've ran from counting their unique session IDs. The challenge I'm facing… --- ## [Is it possible for buckets\_path to reference a scripted\_metric aggregation?](https://discuss.elastic.co/t/is-it-possible-for-buckets-path-to-reference-a-scripted-metric-aggregation/296953)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 9:03am UTC](https://discuss.elastic.co/t/is-it-possible-for-buckets-path-to-reference-a-scripted-metric-aggregation/296953 "2022-02-11T09:03:30Z")
I am working on the kibana\_sample\_data\_logs index. I ran the following aggregation: GET kibana\_sample\_data\_logs/\_search?size=0 { "query": { "match\_all": {} }, "aggs": { "doc\_buckets\_for\_terms\_aggregation… --- ## [Netflow v9 upload bytes and download bytes](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 8:59am UTC](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951 "2022-02-11T08:59:27Z")
Hi all, I have configured netflow v9 and try to use elk to monitor the upload and download bytes. I tried to upload the file (4MB) from local (192.168.x.x ) to the ftp server (211.x.x.x), log is like this Convers… --- ## [Kibana Discover Filter "There aren't any options available"](https://discuss.elastic.co/t/kibana-discover-filter-there-arent-any-options-available/296821)
**Author:** [@WookWook](https://discuss.elastic.co/u/WookWook)\ **Replies:** 4\ **Last updated:** [February 11, 2022, 8:29am UTC](https://discuss.elastic.co/t/kibana-discover-filter-there-arent-any-options-available/296821 "2022-02-11T08:29:45Z")
Hi, I created a new role to seperate access to see only filebeat logs from specific Openshift namespaces. So far so good. The user with the role can only see logs from the granted namespaces. Granted Kibana privileg… --- ## [PUT "ignore\_malformed" on index\_template](https://discuss.elastic.co/t/put-ignore-malformed-on-index-template/296861)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 3\ **Last updated:** [February 11, 2022, 8:17am UTC](https://discuss.elastic.co/t/put-ignore-malformed-on-index-template/296861 "2022-02-11T08:17:42Z")
Hi, Is it possible to insert the parameter "ignore\_malformed" on a template by a PUT? My actual config is: GET \_template/http-access { "http-access" : { "order" : 0, "version" : 60001, "index\_patterns" … --- ## [Bitbucket and Elastic security question!](https://discuss.elastic.co/t/bitbucket-and-elastic-security-question/296855)
**Author:** [@Simha\_Gontmaher](https://discuss.elastic.co/u/Simha_Gontmaher)\ **Replies:** 3\ **Last updated:** [February 11, 2022, 8:17am UTC](https://discuss.elastic.co/t/bitbucket-and-elastic-security-question/296855 "2022-02-11T08:17:22Z")
Hi everyone, Your advice would be very much appreciated! Is Elasticsearch version 6.8.22 or Elastic 7.16.2 considered vulnerable? Do we need to perform any manual mitigation? Also, having the Elasticsearch version 6.5… --- ## [NiFi + ElasticSearch + filebeat](https://discuss.elastic.co/t/nifi-elasticsearch-filebeat/296946)
**Author:** [@iconm](https://discuss.elastic.co/u/iconm)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 8:13am UTC](https://discuss.elastic.co/t/nifi-elasticsearch-filebeat/296946 "2022-02-11T08:13:21Z")
I urgently need to create a pipeline in NiFi that accepts syslog on local UDP port 514 and sends it to Elasticsearch. And I have to use filebeat and build a simple Nifi pipeline that collects data from local /var /log/m… --- ## [ES 7.13.2 - Not starting up - elasticsearch.bat error Invalid initial heap size](https://discuss.elastic.co/t/es-7-13-2-not-starting-up-elasticsearch-bat-error-invalid-initial-heap-size/296945)
**Author:** [@Jothi\_Kiruthika](https://discuss.elastic.co/u/Jothi_Kiruthika)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 8:08am UTC](https://discuss.elastic.co/t/es-7-13-2-not-starting-up-elasticsearch-bat-error-invalid-initial-heap-size/296945 "2022-02-11T08:08:16Z")
HI I am trying to start up ES by running Elasticsearch.bat. I have created an options file under JVM.options.d folder setting the heap size to 2 gb as below - -Xms2g -Xmx2g But When running the batch file, i get the … --- ## [Custom rally docker image](https://discuss.elastic.co/t/custom-rally-docker-image/296874)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 8:07am UTC](https://discuss.elastic.co/t/custom-rally-docker-image/296874 "2022-02-11T08:07:57Z")
Hi, I am extending rally docker image. getting permission denied issue. for COPY or RUN eg RUN mkfifo /logs ---\> permission denied. I am new to esrally kindly help --- ## [Get indexed Elasticsearch document body from Logstash](https://discuss.elastic.co/t/get-indexed-elasticsearch-document-body-from-logstash/296865)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 8:01am UTC](https://discuss.elastic.co/t/get-indexed-elasticsearch-document-body-from-logstash/296865 "2022-02-11T08:01:42Z")
Hi, Is there a way to see the exact body of a document that Logstash indexed? I'm using the Elasticsearch output plugin. Context: in our production environment, some data is output into Elasticsearch by Logstash. In El… --- ## [Adding multiple input files](https://discuss.elastic.co/t/adding-multiple-input-files/296832)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 5\ **Last updated:** [February 11, 2022, 7:05am UTC](https://discuss.elastic.co/t/adding-multiple-input-files/296832 "2022-02-11T07:05:19Z")
Hello, Is it possible to add two inputs files in filebeat.yml? Example:- - /etc/filebeat/inputs.d/\*.yml - /etc/filebeat-oss/inputs.d/\*.yml I wanna add these two files in filebeat.yml under filebeat.config.inp… --- ## [Pipeline aggregation throwing an error](https://discuss.elastic.co/t/pipeline-aggregation-throwing-an-error/296839)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 6:57am UTC](https://discuss.elastic.co/t/pipeline-aggregation-throwing-an-error/296839 "2022-02-11T06:57:50Z")
I am working with the kibana\_sample\_data\_ecommerce index. I will display two queries here: GET kibana\_sample\_data\_ecommerce/\_search?size=0 { "aggs": { "customer\_centric": { "terms": { "field": "custo… --- ## [Logstash in K8s: Deployment vs StatefulSet](https://discuss.elastic.co/t/logstash-in-k8s-deployment-vs-statefulset/296595)
**Author:** [@Nadiia\_Maltseva](https://discuss.elastic.co/u/Nadiia_Maltseva)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 6:43am UTC](https://discuss.elastic.co/t/logstash-in-k8s-deployment-vs-statefulset/296595 "2022-02-11T06:43:50Z")
Hi, community! I am running Logstash on an EC2 instance in AWS. And I want to migrate to Kubernetes (since all our applications are running there). Could you, please, advise me on what factors should be taken into acco… --- ## [Logstash cmd displaying wrong output](https://discuss.elastic.co/t/logstash-cmd-displaying-wrong-output/296938)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 6:40am UTC](https://discuss.elastic.co/t/logstash-cmd-displaying-wrong-output/296938 "2022-02-11T06:40:45Z")
Hi, I am new to ELK stack and I am trying to test out parsing sample syslog messages by following the steps mentioned on the official website -- https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_pro… --- ## [Date filter year not parsing correctly](https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883)
**Author:** [@pkrishnan](https://discuss.elastic.co/u/pkrishnan)\ **Replies:** 3\ **Last updated:** [February 11, 2022, 6:26am UTC](https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883 "2022-02-11T06:26:32Z")
This is my sample log line 2021-06-28 10:25:29.537695 traceID=d283c222257e0e92ba97269a5f780d81 spanID=f46645e821cb4dab A4 LG 4 Logger.cpp:250 - Configuring log file: /home/rxm/log/latest/2021-06-28-102529-log-%3N.log Ar… --- ## [Kibana configuration to automatically add visualization and add it into the dashboard for a microservice](https://discuss.elastic.co/t/kibana-configuration-to-automatically-add-visualization-and-add-it-into-the-dashboard-for-a-microservice/296928)
**Author:** [@thujitha\_p](https://discuss.elastic.co/u/thujitha_p)\ **Replies:** 11\ **Last updated:** [February 11, 2022, 6:16am UTC](https://discuss.elastic.co/t/kibana-configuration-to-automatically-add-visualization-and-add-it-into-the-dashboard-for-a-microservice/296928 "2022-02-11T06:16:38Z")
Hi there, I'm using kibana version 7.17.0. I have created couple of microservices and set up them to send logs to kibana using logstash and Elasticsearch. Then I have created visualization for each microservice to vie… --- ## [Elasticsearch Log deletion not happening as per defined days in log4j.pproperties file](https://discuss.elastic.co/t/elasticsearch-log-deletion-not-happening-as-per-defined-days-in-log4j-pproperties-file/296934)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 5:21am UTC](https://discuss.elastic.co/t/elasticsearch-log-deletion-not-happening-as-per-defined-days-in-log4j-pproperties-file/296934 "2022-02-11T05:21:29Z")
Dear Team, We are facing an issue where Elasticsearch logging with log4j2.properties not performing the log rotation on the basis of lfLastmodified age condition, we want to rotate the logs every after 7days but it is n… --- ## [Scripted Field in Data Table](https://discuss.elastic.co/t/scripted-field-in-data-table/296871)
**Author:** [@stemons](https://discuss.elastic.co/u/stemons)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 4:04am UTC](https://discuss.elastic.co/t/scripted-field-in-data-table/296871 "2022-02-11T04:04:48Z")
Hello, I'm working with data tables in kibana and would like to create an additional column from a script. The following script is working { "script" : "if (doc\['cpu.used.pct'\].value \> 100) { return 1 }" } But I w… --- ## [I am new to Elastic search and trying to fetch data for one of the attribute whose value(lengh \>15)](https://discuss.elastic.co/t/i-am-new-to-elastic-search-and-trying-to-fetch-data-for-one-of-the-attribute-whose-value-lengh-15/294984)
**Author:** [@anji.nersu](https://discuss.elastic.co/u/anji.nersu)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 3:21am UTC](https://discuss.elastic.co/t/i-am-new-to-elastic-search-and-trying-to-fetch-data-for-one-of-the-attribute-whose-value-lengh-15/294984 "2022-02-11T03:21:44Z")
GET catalog-us/\_search { "query": { "bool": { "must": \[ { "term": { "relation\_type": { "value": "product" } } }, { … --- ## [Filebeat can be collected normally after starting and will stop automatically soon](https://discuss.elastic.co/t/filebeat-can-be-collected-normally-after-starting-and-will-stop-automatically-soon/296925)
**Author:** [@y792872131](https://discuss.elastic.co/u/y792872131)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 3:05am UTC](https://discuss.elastic.co/t/filebeat-can-be-collected-normally-after-starting-and-will-stop-automatically-soon/296925 "2022-02-11T03:05:58Z")
An error is as follows: --- ## [Elastic Cloud - Out Of Memory restarts](https://discuss.elastic.co/t/elastic-cloud-out-of-memory-restarts/296912)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 10\ **Last updated:** [February 11, 2022, 1:57am UTC](https://discuss.elastic.co/t/elastic-cloud-out-of-memory-restarts/296912 "2022-02-11T01:57:16Z")
Hi, We are running a small deployment in the Elastic Cloud ingesting very low events per second, however every couple of days we receive an email advising that a node has been restarted as it is out of memory. Checking… --- ## [Invert Axis](https://discuss.elastic.co/t/invert-axis/296902)
**Author:** [@NJ.SE](https://discuss.elastic.co/u/NJ.SE)\ **Replies:** 8\ **Last updated:** [February 11, 2022, 1:32am UTC](https://discuss.elastic.co/t/invert-axis/296902 "2022-02-11T01:32:30Z")
Using for RSSI values whereas negative numbers are worse than positive. So I want -80 to be at the top, not the bottom. Any easy way to flip the values? --- ## [How to create a pie chart of same value with two different filters](https://discuss.elastic.co/t/how-to-create-a-pie-chart-of-same-value-with-two-different-filters/296127)
**Author:** [@Tingda\_Du](https://discuss.elastic.co/u/Tingda_Du)\ **Replies:** 17\ **Last updated:** [February 11, 2022, 1:20am UTC](https://discuss.elastic.co/t/how-to-create-a-pie-chart-of-same-value-with-two-different-filters/296127 "2022-02-11T01:20:38Z")
I would like to create a pie chart based on two different filters and put the two values in a pie chart to have two sections value to be percentage of the sum of the two values. Is this doable? --- ## [Kibana login loop while use iframe](https://discuss.elastic.co/t/kibana-login-loop-while-use-iframe/296542)
**Author:** [@petertw6235](https://discuss.elastic.co/u/petertw6235)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 12:31am UTC](https://discuss.elastic.co/t/kibana-login-loop-while-use-iframe/296542 "2022-02-11T00:31:57Z")
Hi, I shared my Kibana dashboard with public link(anonymous) and user can visit my dashboard in our website used iframe. But the browser will try to login again and again without showing anything. I got the following … --- ## [Elastic indexed data but response has error](https://discuss.elastic.co/t/elastic-indexed-data-but-response-has-error/296859)
**Author:** [@tleduong](https://discuss.elastic.co/u/tleduong)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 11:46pm UTC](https://discuss.elastic.co/t/elastic-indexed-data-but-response-has-error/296859 "2022-02-10T23:46:39Z")
Data was indexed successfully but we got the response below from Elastic. Is there a reason why Elastic returned error but data is still indexed? Error: %{"errors" =\> true, "items" =\> \[%{"index" =\> %{"\_id" =\> "tracts-59… --- ## [3 Single Node Elastic search to 3 Node cluster](https://discuss.elastic.co/t/3-single-node-elastic-search-to-3-node-cluster/296866)
**Author:** [@shivam060897](https://discuss.elastic.co/u/shivam060897)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 11:32pm UTC](https://discuss.elastic.co/t/3-single-node-elastic-search-to-3-node-cluster/296866 "2022-02-10T23:32:04Z")
Hi, I have 3 single-node Elasticsearch nodes on 3 hosts all working file. As of now all my data is on first host (say host-1) and ES on host-2 and host-3 are not being used. Now my requirement is to have all 3 running … --- ## [Nodes out of memory with completion suggester / ngrams](https://discuss.elastic.co/t/nodes-out-of-memory-with-completion-suggester-ngrams/296907)
**Author:** [@ravib](https://discuss.elastic.co/u/ravib)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 10:01pm UTC](https://discuss.elastic.co/t/nodes-out-of-memory-with-completion-suggester-ngrams/296907 "2022-02-10T22:01:32Z")
Hello, I am still using Elasticsearch 5.6 version I have an index with a completion suggest field and also a text field with edge ngram size 3 to 10 \[i don't query both of them at the same time\]…. so I got few queries … --- ## [FsCrawler does not do anything, does not index pfd's](https://discuss.elastic.co/t/fscrawler-does-not-do-anything-does-not-index-pfds/296747)
**Author:** [@jank12](https://discuss.elastic.co/u/jank12)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 11:21pm UTC](https://discuss.elastic.co/t/fscrawler-does-not-do-anything-does-not-index-pfds/296747 "2022-02-10T23:21:16Z")
This n00b is thoroughly confused. I have severa quite large pdf files I want to be able to full text search. They comrpise of raw text and images contaning text. So I want to index the text in the pdf, OCR the images a… --- ## [Indexing 100GB of Dataa](https://discuss.elastic.co/t/indexing-100gb-of-dataa/296891)
**Author:** [@deepakray](https://discuss.elastic.co/u/deepakray)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 9:43pm UTC](https://discuss.elastic.co/t/indexing-100gb-of-dataa/296891 "2022-02-10T21:43:05Z")
Hello, We are trying to index having 83,286,866 documents. It takes around 3 days to index. This is the first time we are creating the indexes. Configuration: Elasticsearch 7.10 Windows Server 2016 Heap Size 16Gb … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1056) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1058)