# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1069 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1070 --- ## [How to nested and other field search](https://discuss.elastic.co/t/how-to-nested-and-other-field-search/296147)
**Author:** [@sramana235](https://discuss.elastic.co/u/sramana235)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 7:11am UTC](https://discuss.elastic.co/t/how-to-nested-and-other-field-search/296147 "2022-02-03T07:11:59Z")
Hello! I want to know about the search conditions. { "query": { "nested": { "path": "others", "query": { "bool": { "must": \[ { "match": { "others.key": "0204key" } }, … --- ## [Iteration In Logstash | Looping](https://discuss.elastic.co/t/iteration-in-logstash-looping/296148)
**Author:** [@Mayank\_Malhotra](https://discuss.elastic.co/u/Mayank_Malhotra)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 6:59am UTC](https://discuss.elastic.co/t/iteration-in-logstash-looping/296148 "2022-02-03T06:59:52Z")
Hi All, I am creating a logstasg config in which I need to use iteration at some point giving an example below in terms of simpler programing language :- int n=300000; int counter=0,skip=0; while(counter\<300000) { skip… --- ## [ELK Query For Percentage](https://discuss.elastic.co/t/elk-query-for-percentage/296149)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 6:58am UTC](https://discuss.elastic.co/t/elk-query-for-percentage/296149 "2022-02-03T06:58:52Z")
Hi Team, We have three fields like, system.memory.total: 8181809152 system.memory.actual.used.bytes: 1474260992 system.memory.actual.free: 6707548160 Is it possible to write a query for more than 80 percentage of … --- ## [Embedding Kibana Dashboards in a custom AngluarJS/ReactJS Web Application](https://discuss.elastic.co/t/embedding-kibana-dashboards-in-a-custom-angluarjs-reactjs-web-application/292768)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 6:05am UTC](https://discuss.elastic.co/t/embedding-kibana-dashboards-in-a-custom-angluarjs-reactjs-web-application/292768 "2022-02-03T06:05:19Z")
Would like to know what is the best practice to embed the Kibana Dashboards in AngularJS/ReactJS web application without using iframe. It should display only the dashboards and not any controls which are present in Kiban… --- ## [How to pagination many data?(data count example 100,000)](https://discuss.elastic.co/t/how-to-pagination-many-data-data-count-example-100-000/295205)
**Author:** [@sramana235](https://discuss.elastic.co/u/sramana235)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 5:58am UTC](https://discuss.elastic.co/t/how-to-pagination-many-data-data-count-example-100-000/295205 "2022-02-03T05:58:08Z")
I want to display more than 100,000 data on a 1page 10data. For example, when i press page 1023, Data from 10221 to 10230 should be displayed. In this case, should I use 'search after' instead of 'scroll'? If it is be… --- ## [Elastic Agent Standalone Kubernetes ICMP Check; Heartbeat won't Start](https://discuss.elastic.co/t/elastic-agent-standalone-kubernetes-icmp-check-heartbeat-wont-start/296005)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 11:30pm UTC](https://discuss.elastic.co/t/elastic-agent-standalone-kubernetes-icmp-check-heartbeat-wont-start/296005 "2022-02-02T23:30:55Z")
Hi All, I'm trying to setup a standalone Elastic Agent config on Kubernetes, but am running into an issue where Heartbeat doesn't start, and eventually enters a failed state. Elastic Agent: 7.16.2 ECK: 1.9.1 Elastics… --- ## [Removing original index after split](https://discuss.elastic.co/t/removing-original-index-after-split/296073)
**Author:** [@kalikasan](https://discuss.elastic.co/u/kalikasan)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 11:11pm UTC](https://discuss.elastic.co/t/removing-original-index-after-split/296073 "2022-02-02T23:11:57Z")
Hi, I've got a single shard index of 75GB taking 40% of my physical disk space (according to df) which I needed to split into two shards. After the split, the disk space taken by the new index is around the double of th… --- ## [How to update date field type to a string in ES?](https://discuss.elastic.co/t/how-to-update-date-field-type-to-a-string-in-es/296131)
**Author:** [@srk1](https://discuss.elastic.co/u/srk1)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 10:57pm UTC](https://discuss.elastic.co/t/how-to-update-date-field-type-to-a-string-in-es/296131 "2022-02-02T22:57:41Z")
Hi ES team, I am trying to build a custom ES template where one field would occasionally passes a string that matches with date format causing mapping conflicts and dropping of data by logstash. If i try to disable a… --- ## [Ansible deployment of Filebeat](https://discuss.elastic.co/t/ansible-deployment-of-filebeat/296132)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 10:35pm UTC](https://discuss.elastic.co/t/ansible-deployment-of-filebeat/296132 "2022-02-02T22:35:22Z")
I was wondering if it was recommended to deploy filebeat through ansible. I am interested in installing and configuring filebeat on multiple machines (each with different log configurations), however I can't seem to find… --- ## [Problem using fingerprint for my documents stored in elasticsearch](https://discuss.elastic.co/t/problem-using-fingerprint-for-my-documents-stored-in-elasticsearch/295101)
**Author:** [@MKH](https://discuss.elastic.co/u/MKH)\ **Replies:** 16\ **Last updated:** [February 2, 2022, 9:23pm UTC](https://discuss.elastic.co/t/problem-using-fingerprint-for-my-documents-stored-in-elasticsearch/295101 "2022-02-02T21:23:23Z")
Hi, I want to provide a unique id for the data I store in Elasticsearch index using fingerprint. But when I feed a bulk of docs to logstash I only one of the documents is stored in the index. I have 9 docs (9 json dicti… --- ## [ILM policy based on index and not on index template](https://discuss.elastic.co/t/ilm-policy-based-on-index-and-not-on-index-template/296123)
**Author:** [@srk1](https://discuss.elastic.co/u/srk1)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 8:51pm UTC](https://discuss.elastic.co/t/ilm-policy-based-on-index-and-not-on-index-template/296123 "2022-02-02T20:51:49Z")
Hi, Is there a way to configure ILM policy specific to index and not based on index template? it is annoying to have multiple templates and specifying index patterns for each type (daily, monthly, yearly). If i want to … --- ## [Google Workspace Setup](https://discuss.elastic.co/t/google-workspace-setup/293581)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 4\ **Last updated:** [February 2, 2022, 8:43pm UTC](https://discuss.elastic.co/t/google-workspace-setup/293581 "2022-02-02T20:43:17Z")
Hello, I'm attempting to start up the Google Workspace Audit Reports Integration in fleet and have successfully followed the steps to create service accounts, grant API access and oAuth IDs. I also have the json file fo… --- ## [Timestamp Event at Logstash Input](https://discuss.elastic.co/t/timestamp-event-at-logstash-input/296122)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 8:24pm UTC](https://discuss.elastic.co/t/timestamp-event-at-logstash-input/296122 "2022-02-02T20:24:44Z")
We are using Persistent Queues, and I would like to calculate the time an event is in queue before actually being sent through the pipeline, but in order to do so, I need to add a timestamp in the input section of the pi… --- ## [Rollup Search results differ based on timeline interval](https://discuss.elastic.co/t/rollup-search-results-differ-based-on-timeline-interval/296120)
**Author:** [@rfox](https://discuss.elastic.co/u/rfox)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 8:02pm UTC](https://discuss.elastic.co/t/rollup-search-results-differ-based-on-timeline-interval/296120 "2022-02-02T20:02:56Z")
If I use different timeline intervals on a rollup search I get a different set of resulting keys where I expect the same resulting keys but just in different time buckets and counts. It seems the larger the interval the… --- ## [Elastic crash](https://discuss.elastic.co/t/elastic-crash/295791)
**Author:** [@Grace\_A](https://discuss.elastic.co/u/Grace_A)\ **Replies:** 14\ **Last updated:** [February 2, 2022, 7:55pm UTC](https://discuss.elastic.co/t/elastic-crash/295791 "2022-02-02T19:55:16Z")
Elastic have some issue about java heap size. Elastic, Kibana, and Logstash live on 1 server that has 52 GB RAM. We've also tried change the jvm options for elastic from 1 to 40 Gb. But the elastic always shut down all … --- ## [Fleet Agent not showing logs - Fleet Agent not opening port syslog (panw module - filebeat)](https://discuss.elastic.co/t/fleet-agent-not-showing-logs-fleet-agent-not-opening-port-syslog-panw-module-filebeat/296111)
**Author:** [@AMe](https://discuss.elastic.co/u/AMe)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 7:23pm UTC](https://discuss.elastic.co/t/fleet-agent-not-showing-logs-fleet-agent-not-opening-port-syslog-panw-module-filebeat/296111 "2022-02-02T19:23:31Z")
Elastic Agent has not opened the port for Syslog to receive data. Fleet integration - filebeat module - Palo Alto firewall network (panw) - via Syslog. Use Case: I set up a fleet server, created a new policy and added … --- ## [Saved object is missing Could not locate that visualization](https://discuss.elastic.co/t/saved-object-is-missing-could-not-locate-that-visualization/295624)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 6:53pm UTC](https://discuss.elastic.co/t/saved-object-is-missing-could-not-locate-that-visualization/295624 "2022-02-02T18:53:54Z")
Hello all, I am using ELK 7.16.2. I have been using custom plugin. So, I have been creating charts with the data I have with my plugin and visualizing in kibana. but Now, I am getting the following error. Saved object … --- ## [ElasticSearch keyword mapping leads to illegal\_state\_exception](https://discuss.elastic.co/t/elasticsearch-keyword-mapping-leads-to-illegal-state-exception/296107)
**Author:** [@Jabest](https://discuss.elastic.co/u/Jabest)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 6:24pm UTC](https://discuss.elastic.co/t/elasticsearch-keyword-mapping-leads-to-illegal-state-exception/296107 "2022-02-02T18:24:08Z")
In a spring boot application when indexing an object into es I get the following exception. Suppressed: org.elasticsearch.client.ResponseException: method \[PUT\], host \[http://localhost:9299\], URI \[/my\_index\_name/\_doc/1… --- ## [Is it possible to use a (previously created) runtime field in a transform?](https://discuss.elastic.co/t/is-it-possible-to-use-a-previously-created-runtime-field-in-a-transform/296104)
**Author:** [@colin1](https://discuss.elastic.co/u/colin1)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 6:13pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-a-previously-created-runtime-field-in-a-transform/296104 "2022-02-02T18:13:55Z")
Hi, I'm trying to use kibana's 'transform' gui to aggregate some data. One of the fields I'd like to aggregate is a runtime field that I created in the index mappings. This field is an integer whose value is set depen… --- ## [Failed to setup password in APM\_SYSTEM in 7.16](https://discuss.elastic.co/t/failed-to-setup-password-in-apm-system-in-7-16/293815)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 5:29pm UTC](https://discuss.elastic.co/t/failed-to-setup-password-in-apm-system-in-7-16/293815 "2022-02-02T17:29:16Z")
How to setup basic + tls security in Elasticsearch i am following Set up minimal security for Elasticsearch | Elasticsearch Guide \[7.16\] | Elastic my elk was in 7.12 with "xpack.security.enabled" to true and discovery… --- ## [Update Kibana Filter from Vega](https://discuss.elastic.co/t/update-kibana-filter-from-vega/295598)
**Author:** [@TUKTUK](https://discuss.elastic.co/u/TUKTUK)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 5:12pm UTC](https://discuss.elastic.co/t/update-kibana-filter-from-vega/295598 "2022-02-02T17:12:46Z")
Hello all, I am quite new to the Vega world inside Kibana and would like to make a Vega visualization interactive so that the Kibana filters are updated on click. I have seen the following tutorial --\> \[Update Timefilt… --- ## [Elastic Ingest Pipeline Works with Test, but Fails on real usage](https://discuss.elastic.co/t/elastic-ingest-pipeline-works-with-test-but-fails-on-real-usage/295984)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 16\ **Last updated:** [February 2, 2022, 4:57pm UTC](https://discuss.elastic.co/t/elastic-ingest-pipeline-works-with-test-but-fails-on-real-usage/295984 "2022-02-02T16:57:05Z")
Hi All, Elasticsearch: 7.16.2 Logstash: 7.16.2 I have an ingest pipeline which processes syslog messages: Example message: \<86\>Feb 1 18:38:07 ASDF1234 sudo: pam\_unix(sudo:session): session closed for user root The … --- ## [Metricbeat 7.16.3 error determining cgroups version: error reading /proc/\/cgroup:](https://discuss.elastic.co/t/metricbeat-7-16-3-error-determining-cgroups-version-error-reading-proc-pid-cgroup/296100)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 4:55pm UTC](https://discuss.elastic.co/t/metricbeat-7-16-3-error-determining-cgroups-version-error-reading-proc-pid-cgroup/296100 "2022-02-02T16:55:45Z")
These errors keep being generated in the metricbeat logs. 2022-02-02T16:11:02.411Z ERROR metrics/metrics.go:304 error determining cgroups version: error reading /proc/3950736/cgroup: open /proc/3950736/cgroup:… --- ## [Process custom logs format](https://discuss.elastic.co/t/process-custom-logs-format/296092)
**Author:** [@MHQurashi](https://discuss.elastic.co/u/MHQurashi)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 4:28pm UTC](https://discuss.elastic.co/t/process-custom-logs-format/296092 "2022-02-02T16:28:49Z")
Hi I’m trying to ingest log files with custom format so the line looks like this: \[date and time\]\[tab\]\[info1\]\[tab\]\[info2\]\[pipe\]\[info3\]\[pipe\]\[info4\] So separators are mix of tabs and pipes. Not to mention that last inf… --- ## [Kibana how to hide panels and display them after filter](https://discuss.elastic.co/t/kibana-how-to-hide-panels-and-display-them-after-filter/295945)
**Author:** [@fionachan](https://discuss.elastic.co/u/fionachan)\ **Replies:** 6\ **Last updated:** [February 2, 2022, 4:16pm UTC](https://discuss.elastic.co/t/kibana-how-to-hide-panels-and-display-them-after-filter/295945 "2022-02-02T16:16:21Z")
Hi, I would like to ask a question about Kibana. I would like to hide some panels at the beginning and when I filter, the panels that are hidden show. How can I come true to it? Thanks. --- ## [Cluster Upgrade, Shard Allocation and null vs all](https://discuss.elastic.co/t/cluster-upgrade-shard-allocation-and-null-vs-all/295867)
**Author:** [@georgef](https://discuss.elastic.co/u/georgef)\ **Replies:** 6\ **Last updated:** [February 2, 2022, 4:08pm UTC](https://discuss.elastic.co/t/cluster-upgrade-shard-allocation-and-null-vs-all/295867 "2022-02-02T16:08:19Z")
Good Afternoon, I was conducting a rolling upgrade from 7.16.2 to 7.16.3 using the directions at Rolling upgrades | Elasticsearch Guide \[7.16\]. I stopped shard allocation with "cluster.routing.allocation.enable": prima… --- ## [Illegal\_argument\_exception when opening dashboard](https://discuss.elastic.co/t/illegal-argument-exception-when-opening-dashboard/295270)
**Author:** [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 3:03pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-when-opening-dashboard/295270 "2022-02-02T15:03:58Z")
For ref we're using Elastic Cloud. When opening a particular dashboard we see a shard failure. The error reason is: Text fields are not optimised for operations that require per-document field data like aggregations a… --- ## [Ingest pipeline: weird behaviour in changing the order of the grok processor patterns](https://discuss.elastic.co/t/ingest-pipeline-weird-behaviour-in-changing-the-order-of-the-grok-processor-patterns/295918)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 2:26pm UTC](https://discuss.elastic.co/t/ingest-pipeline-weird-behaviour-in-changing-the-order-of-the-grok-processor-patterns/295918 "2022-02-02T14:26:13Z")
Kibana 7.16.3 in latest Firefox and Brave (chromium) browsers steps to reproduce: go to app/management/ingest/ingest\_pipelines create pipeline name: any add processor: grok field: message first pattern: ^%{GREEDYDATA:… --- ## [New aggregation based visualisation line percentiles does not show y-axis labels anymore](https://discuss.elastic.co/t/new-aggregation-based-visualisation-line-percentiles-does-not-show-y-axis-labels-anymore/295914)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 2:22pm UTC](https://discuss.elastic.co/t/new-aggregation-based-visualisation-line-percentiles-does-not-show-y-axis-labels-anymore/295914 "2022-02-02T14:22:26Z")
Kibana 7.16.3 in latest Firefox and Brave (chromium) browser Steps to reproduce: app/visualize create aggregation based line select a saved search aggregation: percentiles field: any number field bucket: add x-axis ag… --- ## [Logstash reading from .log file is not consistent](https://discuss.elastic.co/t/logstash-reading-from-log-file-is-not-consistent/295661)
**Author:** [@HungNV](https://discuss.elastic.co/u/HungNV)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 2:03pm UTC](https://discuss.elastic.co/t/logstash-reading-from-log-file-is-not-consistent/295661 "2022-02-02T14:03:21Z")
I got some error when logstash reading from .log file. Some time it cannot read whole content in a line. Im using logstash version 7.16.1 Here the input config: input { file { path =\> "${LOG\_PATH}" codec =\> json … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1068) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1070)