# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1080 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1081 --- ## [Logstash on prem - Kubernetes or not](https://discuss.elastic.co/t/logstash-on-prem-kubernetes-or-not/295372)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 4:15pm UTC](https://discuss.elastic.co/t/logstash-on-prem-kubernetes-or-not/295372 "2022-01-25T16:15:47Z")
Hi, I'm checking for the advantages/disadvantages to install logstash on openshift (On Prem) or VMWare. Someone has some tips/advice/.. ? thanks in advance. --- ## [Tried to override GC log settings, doubled the logging instead](https://discuss.elastic.co/t/tried-to-override-gc-log-settings-doubled-the-logging-instead/294277)
**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 4:14pm UTC](https://discuss.elastic.co/t/tried-to-override-gc-log-settings-doubled-the-logging-instead/294277 "2022-01-25T16:14:36Z")
I used to edit /etc/elasticsearch/jvm.options in order to reduce the amount of GC logging. As directed in a recent update, I've now moved my changes to /etc/elasticsearch/jvm.options.d/gc.options. However, instead of o… --- ## [Why some boolean settings has two different suffix one is "enable" and another is "enabled"](https://discuss.elastic.co/t/why-some-boolean-settings-has-two-different-suffix-one-is-enable-and-another-is-enabled/294906)
**Author:** [@GrandFisher](https://discuss.elastic.co/u/GrandFisher)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 4:09pm UTC](https://discuss.elastic.co/t/why-some-boolean-settings-has-two-different-suffix-one-is-enable-and-another-is-enabled/294906 "2022-01-25T16:09:43Z")
I want to know why the class EnableAllocationDecider has a setting called cluster.routing.allocation.enable which end with "enable", while class IndicesService has setting indices.id\_field\_data.enabled which end with "e… --- ## [Query Against Minhash Field](https://discuss.elastic.co/t/query-against-minhash-field/295370)
**Author:** [@Nutchapol\_Dendumrong](https://discuss.elastic.co/u/Nutchapol_Dendumrong)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 4:08pm UTC](https://discuss.elastic.co/t/query-against-minhash-field/295370 "2022-01-25T16:08:45Z")
I have been following this tutorial to create minhash signature. However, it is unclear to me how to perform searching using minhash properly. I have attempted the following query, which I quickly learned that it is v… --- ## [SiemConnector with Filebeat problem](https://discuss.elastic.co/t/siemconnector-with-filebeat-problem/295365)
**Author:** [@Juan\_Fernandez\_Bernt](https://discuss.elastic.co/u/Juan_Fernandez_Bernt)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 4:05pm UTC](https://discuss.elastic.co/t/siemconnector-with-filebeat-problem/295365 "2022-01-25T16:05:13Z")
Hello, im trying to use crowdstrike Siem Connector with filebeat. I've been checking some documentation but can't find a way to solve my problem. I think is kind of working but the field message looks like a bunch of h… --- ## [Rank Feature Query as multiplier](https://discuss.elastic.co/t/rank-feature-query-as-multiplier/294022)
**Author:** [@ajay\_15](https://discuss.elastic.co/u/ajay_15)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 4:05pm UTC](https://discuss.elastic.co/t/rank-feature-query-as-multiplier/294022 "2022-01-25T16:05:11Z")
I am looking to multiply score from Rank feature query(Rank feature query | Elasticsearch Guide \[7.16\] | Elastic) to relevancy score calculated from my query. I know we can do something similar using rescore query and f… --- ## [Run aggregation separately on time based indices](https://discuss.elastic.co/t/run-aggregation-separately-on-time-based-indices/293981)
**Author:** [@Nowrin\_Hossain](https://discuss.elastic.co/u/Nowrin_Hossain)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 3:57pm UTC](https://discuss.elastic.co/t/run-aggregation-separately-on-time-based-indices/293981 "2022-01-25T15:57:46Z")
I have time based indices in Elasticsearch of an index and I want to run aggregation separately for every index. Is it possible ? There is any way to tell Elasticsearch not to run aggregation on whole data of all time in… --- ## [Use script in suggestion](https://discuss.elastic.co/t/use-script-in-suggestion/294069)
**Author:** [@Amir\_Faramarzi](https://discuss.elastic.co/u/Amir_Faramarzi)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 3:54pm UTC](https://discuss.elastic.co/t/use-script-in-suggestion/294069 "2022-01-25T15:54:47Z")
hello how to use script(painless) in suggestion?? --- ## [Local index replication to support terms query lookups](https://discuss.elastic.co/t/local-index-replication-to-support-terms-query-lookups/295325)
**Author:** [@rhart](https://discuss.elastic.co/u/rhart)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 3:43pm UTC](https://discuss.elastic.co/t/local-index-replication-to-support-terms-query-lookups/295325 "2022-01-25T15:43:12Z")
The documentation in ES version 6.8 (Terms Query | Elasticsearch Guide \[6.8\] | Elastic) eluded to an approach to improve performance for terms lookups by searching for terms on a local node that has a fully replicated in… --- ## [How to retrieve results with certain amount of hits](https://discuss.elastic.co/t/how-to-retrieve-results-with-certain-amount-of-hits/295360)
**Author:** [@Almog\_Wertzberger](https://discuss.elastic.co/u/Almog_Wertzberger)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 2:37pm UTC](https://discuss.elastic.co/t/how-to-retrieve-results-with-certain-amount-of-hits/295360 "2022-01-25T14:37:39Z")
Hi, Having this query for example: GET person\_group/\_search { "query": { "bool": { "filter": \[ { "exists": { "field": "educations" } … --- ## [Integrating kibana dashboard into react App](https://discuss.elastic.co/t/integrating-kibana-dashboard-into-react-app/295227)
**Author:** [@Fillipe\_Developer](https://discuss.elastic.co/u/Fillipe_Developer)\ **Replies:** 4\ **Last updated:** [January 25, 2022, 2:30pm UTC](https://discuss.elastic.co/t/integrating-kibana-dashboard-into-react-app/295227 "2022-01-25T14:30:51Z")
Hi guys, I want to know if it is possible to integrate Kibana into a react app, using its graphs and data? If there is already this possibility, please let me know what documentation? --- ## [Kibana Api](https://discuss.elastic.co/t/kibana-api/295309)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 2:22pm UTC](https://discuss.elastic.co/t/kibana-api/295309 "2022-01-25T14:22:08Z")
Is there any Library or api that can be done with a code with python and add changes in kibana Dashboard and how can we done changes through the code ? --- ## [Nested Composite Aggregations with ElasticSearch](https://discuss.elastic.co/t/nested-composite-aggregations-with-elasticsearch/295282)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 1:48pm UTC](https://discuss.elastic.co/t/nested-composite-aggregations-with-elasticsearch/295282 "2022-01-25T13:48:54Z")
I have an index that stores sales by salesperson, and each sale has a service rating. Using composite I get these separate ratings within an object by duplicating the seller ID. Is it possible to nest within a single obj… --- ## [Add ILM to existing index](https://discuss.elastic.co/t/add-ilm-to-existing-index/295352)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 1:35pm UTC](https://discuss.elastic.co/t/add-ilm-to-existing-index/295352 "2022-01-25T13:35:28Z")
Hi, im having an index called 'jenkins\_jobs\_logs' and i want to add ILM policy. after some investigation, i understood that i must perform a reindex. i reindex to the ILM pattern(jenkins\_jobs\_logs --\> jenkins\_jobs\_log… --- ## [Faceted Search Query](https://discuss.elastic.co/t/faceted-search-query/295351)
**Author:** [@andrew\_1555](https://discuss.elastic.co/u/andrew_1555)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 1:31pm UTC](https://discuss.elastic.co/t/faceted-search-query/295351 "2022-01-25T13:31:38Z")
So I am trying to write a query which returns aggregations of facets. So for example (Red: 12, Green: 8, XL : 4 etc) where the numbers are the document counts. I have been following this article which explains what I am… --- ## [Auditbeat processor ignores drop\_event](https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917)
**Author:** [@ziv1](https://discuss.elastic.co/u/ziv1)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 1:28pm UTC](https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917 "2022-01-25T13:28:11Z")
Hi, Trying to filter out some spam generated by auditbeat using a processor but it looks like, depending on how/where I set it up in the yml, it either completely ignores the processor, or stops processing events all to… --- ## [Configure ElasticSearch ingest pipeline at startup?](https://discuss.elastic.co/t/configure-elasticsearch-ingest-pipeline-at-startup/295087)
**Author:** [@tlc](https://discuss.elastic.co/u/tlc)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 12:54pm UTC](https://discuss.elastic.co/t/configure-elasticsearch-ingest-pipeline-at-startup/295087 "2022-01-25T12:54:11Z")
I've ported a logstash pipeline to an ES ingest pipeline, because I found out that some of our deployments use filebeat-\>logstash-\>ES, but others use Elastic Agent-\>ES. (I know nothing about Agent, I know a little about… --- ## [Point In Time creation failure after upgrade](https://discuss.elastic.co/t/point-in-time-creation-failure-after-upgrade/295172)
**Author:** [@RapTvin](https://discuss.elastic.co/u/RapTvin)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 12:50pm UTC](https://discuss.elastic.co/t/point-in-time-creation-failure-after-upgrade/295172 "2022-01-25T12:50:38Z")
Hello, I need some help in an issue, I recently upgraded my Elasticsearch on local setup ( i.e downloaded 7.16.2 ). Now when I try to run a Point in Time API to retrieve the PIT id, on the Elasticsearch logs it gives me … --- ## [Watcher: http input specify current date in path](https://discuss.elastic.co/t/watcher-http-input-specify-current-date-in-path/293391)
**Author:** [@Kevin\_Gonzalez](https://discuss.elastic.co/u/Kevin_Gonzalez)\ **Replies:** 7\ **Last updated:** [January 25, 2022, 12:36pm UTC](https://discuss.elastic.co/t/watcher-http-input-specify-current-date-in-path/293391 "2022-01-25T12:36:15Z")
I'm trying to create a watcher that monitors the size of a specific index. I have daily indices with this naming convention: "indexname-YYYY.MM.dd", example: "test-index-2022.01.03". I want to monitor the size of that s… --- ## [Convert Timestamp to milliseconds in ingest pipeline](https://discuss.elastic.co/t/convert-timestamp-to-milliseconds-in-ingest-pipeline/294602)
**Author:** [@Rakesh\_Rayabarapu](https://discuss.elastic.co/u/Rakesh_Rayabarapu)\ **Replies:** 9\ **Last updated:** [January 25, 2022, 11:47am UTC](https://discuss.elastic.co/t/convert-timestamp-to-milliseconds-in-ingest-pipeline/294602 "2022-01-25T11:47:26Z")
Hi, I am trying to find a way to get millis from string date time field using ingest pipeline and getting following error. please help me to correct the script. POST /\_ingest/pipeline/\_simulate { "pipeline": { "des… --- ## [Exact match on log message field](https://discuss.elastic.co/t/exact-match-on-log-message-field/295228)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 5\ **Last updated:** [January 25, 2022, 11:27am UTC](https://discuss.elastic.co/t/exact-match-on-log-message-field/295228 "2022-01-25T11:27:05Z")
Hi, I am evaluating the Alerts feature in the latest Kibana version. We are collecting logs from our server and I want to set up exact-match alerting rules. When creating an alert and setting up a condition on the messag… --- ## [Delete by Query Impact in terms of Data size vs Time taken](https://discuss.elastic.co/t/delete-by-query-impact-in-terms-of-data-size-vs-time-taken/295339)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 11:17am UTC](https://discuss.elastic.co/t/delete-by-query-impact-in-terms-of-data-size-vs-time-taken/295339 "2022-01-25T11:17:05Z")
Hi Everyone, I am trying to understand the impact of using delete by query API in Elasticsearch. I am looking for some formula/metrics in terms of the time taken to delete a certain amount of data. Can anyone please hel… --- ## [Fetch installed software details in Elasticsearch using elastic beats](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527)
**Author:** [@Tirtharaj\_Karbotkar1](https://discuss.elastic.co/u/Tirtharaj_Karbotkar1)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 11:13am UTC](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527 "2022-01-25T11:13:27Z")
Hi all, I am trying to fetch installed software details from my system (windows) into the Elasticsearch. Does any one have idea how to do the same? I have tried using metricbeat but at most I can get the running proce… --- ## [Repository creation fails (disk quota)](https://discuss.elastic.co/t/repository-creation-fails-disk-quota/295328)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 10:24am UTC](https://discuss.elastic.co/t/repository-creation-fails-disk-quota/295328 "2022-01-25T10:24:14Z")
Hi All, I have an issue with creation of snapshot repository. PUT \_snapshot/test-repo { "type": "fs", "settings": { "location": "test\_repo" } } The reply was this: { "error" : { "root\_cause" : \[ … --- ## [Helm chart - readinessProbe failure without errors](https://discuss.elastic.co/t/helm-chart-readinessprobe-failure-without-errors/295091)
**Author:** [@aumthanki](https://discuss.elastic.co/u/aumthanki)\ **Replies:** 2\ **Last updated:** [January 24, 2022, 2:21pm UTC](https://discuss.elastic.co/t/helm-chart-readinessprobe-failure-without-errors/295091 "2022-01-24T14:21:39Z")
Hi, Has anyone been forced to tweak the readinessprobe for the filebeat chart? readinessProbe: exec: command: - sh - -c - | #!/usr/bin/env bash -e filebeat test output failureThreshold: 3 initialDelaySeconds: … --- ## [Elasticsearch7.x have any solutions to replace existing searchAction or override?](https://discuss.elastic.co/t/elasticsearch7-x-have-any-solutions-to-replace-existing-searchaction-or-override/295334)
**Author:** [@Howells](https://discuss.elastic.co/u/Howells)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 10:57am UTC](https://discuss.elastic.co/t/elasticsearch7-x-have-any-solutions-to-replace-existing-searchaction-or-override/295334 "2022-01-25T10:57:08Z")
I want to do some custom function in RestSearchAction.prepareRequest before "request.withContentOrSourceParamParserOrNull(parser -\> parseSearchRequest(searchRequest, request, parser, setSize));" , like verify query stat… --- ## [Pie chart Lens starting position for bigger slices](https://discuss.elastic.co/t/pie-chart-lens-starting-position-for-bigger-slices/295315)
**Author:** [@howai](https://discuss.elastic.co/u/howai)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 10:38am UTC](https://discuss.elastic.co/t/pie-chart-lens-starting-position-for-bigger-slices/295315 "2022-01-25T10:38:03Z")
Hi experts, I'm creating a pie chart as below(labels hidden) but struggling with the following below points. Could you please advise? Pic1. The chart clockwise manner in Aggregation Chart Pic2. The chart clockw… --- ## [Readiness Probe Failing - clusterHealthCheckParams: "wait\_for\_status=yellow&timeout=1s"](https://discuss.elastic.co/t/readiness-probe-failing-clusterhealthcheckparams-wait-for-status-yellow-timeout-1s/295319)
**Author:** [@aniesh.mathew](https://discuss.elastic.co/u/aniesh.mathew)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 10:16am UTC](https://discuss.elastic.co/t/readiness-probe-failing-clusterhealthcheckparams-wait-for-status-yellow-timeout-1s/295319 "2022-01-25T10:16:02Z")
We have a deployed a elastic master with single replica in kubernetes and have added the parameter clusterHealthCheckParams: wait\_for\_status=yellow&timeout=1s as suggested in post. The elastic master was working fine e… --- ## [Debugging root cause for high Purgatory size in Kafka](https://discuss.elastic.co/t/debugging-root-cause-for-high-purgatory-size-in-kafka/295324)
**Author:** [@LHozzan](https://discuss.elastic.co/u/LHozzan)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 9:54am UTC](https://discuss.elastic.co/t/debugging-root-cause-for-high-purgatory-size-in-kafka/295324 "2022-01-25T09:54:34Z")
We using ELK stack (7.10.2) in Kubernetes (1.21.5). After several time our service provider Gardener change OS version (318.9.0 -\> 576.1.0) and our troubles with logging stack started. It seems, that Kafka (v 2.8.1, 2 p… --- ## [Added corp certs instead of self certs now - "Kibana server is not ready yet"](https://discuss.elastic.co/t/added-corp-certs-instead-of-self-certs-now-kibana-server-is-not-ready-yet/295260)
**Author:** [@g0nz0](https://discuss.elastic.co/u/g0nz0)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 9:44am UTC](https://discuss.elastic.co/t/added-corp-certs-instead-of-self-certs-now-kibana-server-is-not-ready-yet/295260 "2022-01-25T09:44:39Z")
Hello, I'm trying to use our own certs with ELK but when I use them instead of the working self certs I get the error "Kibana server is not ready yet" when I go to the website. With the self certs I just use https://ip… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1079) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1081)