# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1086 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1087 --- ## [Can I improve this aggregation query?](https://discuss.elastic.co/t/can-i-improve-this-aggregation-query/294843)
**Author:** [@elasticshane](https://discuss.elastic.co/u/elasticshane)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 3:49pm UTC](https://discuss.elastic.co/t/can-i-improve-this-aggregation-query/294843 "2022-01-20T15:49:34Z")
Hello, I'm quite new to Elasticsearch, but have made some progress with a query, and I'd really appreciate your feedback/ideas about how I've approached my requirement. Introduction/Mappings I'm writing a query to det… --- ## [Remove duplicate tokens after edge\_ngram on array](https://discuss.elastic.co/t/remove-duplicate-tokens-after-edge-ngram-on-array/294945)
**Author:** [@timon](https://discuss.elastic.co/u/timon)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 3:31pm UTC](https://discuss.elastic.co/t/remove-duplicate-tokens-after-edge-ngram-on-array/294945 "2022-01-20T15:31:41Z")
I have a field where multiple values are stored: field: \["testOneTwo", "testThreeFour"\] I would like to analyze this field with an edge\_ngram filter, but also remove duplicate tokens. I tried the unique and remove\_dupl… --- ## [Multiple Config Files - Duplicate data](https://discuss.elastic.co/t/multiple-config-files-duplicate-data/294898)
**Author:** [@sujeetkp](https://discuss.elastic.co/u/sujeetkp)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 3:31pm UTC](https://discuss.elastic.co/t/multiple-config-files-duplicate-data/294898 "2022-01-20T15:31:01Z")
I am new to logstash and filebeat. I am trying to set up multiple config files for my logstash instance. Using filebeat to send data to logstash. Even if I have filters created for both the logstash config files, I am g… --- ## [Attempted to resurrect connection to dead ES instance, but got an error... Received fatal alert: bad\_certificate"}](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error-received-fatal-alert-bad-certificate/294708)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 3:19pm UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error-received-fatal-alert-bad-certificate/294708 "2022-01-20T15:19:05Z")
Hello, I wanted to run the old logstash config that once was working. It is not working anymore I guess that because now Elasticsearch is set up with xpack.security.transport.ssl.verification\_mode: certificate Logsta… --- ## [Generating shingles with synonyms in Elasticsearch](https://discuss.elastic.co/t/generating-shingles-with-synonyms-in-elasticsearch/294964)
**Author:** [@Yawan\_Gupta](https://discuss.elastic.co/u/Yawan_Gupta)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 2:58pm UTC](https://discuss.elastic.co/t/generating-shingles-with-synonyms-in-elasticsearch/294964 "2022-01-20T14:58:09Z")
I have a file of alternate spellings for the terms in my index. I want to produce bigrams containing those alternate spellings for particular terms. For example, I have biriyani, biryani, briyani in my alternate spelling… --- ## [Top URLs by response code\[Filebeat Apache\] ECS](https://discuss.elastic.co/t/top-urls-by-response-code-filebeat-apache-ecs/294961)
**Author:** [@Alphonse\_Kambo](https://discuss.elastic.co/u/Alphonse_Kambo)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 2:37pm UTC](https://discuss.elastic.co/t/top-urls-by-response-code-filebeat-apache-ecs/294961 "2022-01-20T14:37:56Z")
Hello All, I want to create in Canvas a pie chart that replicates the visualization "Top URLs by response code\[Filebeat Apache\] ECS". I have for the Split chart the following ES SQL: SELECT url.original as url, cou… --- ## [The error response for search\_geometry query with ES 6.7.2](https://discuss.elastic.co/t/the-error-response-for-search-geometry-query-with-es-6-7-2/294914)
**Author:** [@Eduardo\_Montes](https://discuss.elastic.co/u/Eduardo_Montes)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 2:37pm UTC](https://discuss.elastic.co/t/the-error-response-for-search-geometry-query-with-es-6-7-2/294914 "2022-01-20T14:37:46Z")
Hello, I sent the search\_geometry query to ES V6.7.2 and got error (see below). With another ES server V6.2.4 I got correct response without error. Is there any bug in version 6.7.2? Or could be this error caused by the… --- ## [Resource 'filebeat-7.16.2' exists, but it is not an alias](https://discuss.elastic.co/t/resource-filebeat-7-16-2-exists-but-it-is-not-an-alias/294903)
**Author:** [@tejas.tech](https://discuss.elastic.co/u/tejas.tech)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 2:18pm UTC](https://discuss.elastic.co/t/resource-filebeat-7-16-2-exists-but-it-is-not-an-alias/294903 "2022-01-20T14:18:40Z")
Team, I've installed Filebeat 7.16.2 on two machines, and I'm able to get data from one but not the other, and I'm getting the following problem. --- ## [Clamp function for two dynamic value doesn't work](https://discuss.elastic.co/t/clamp-function-for-two-dynamic-value-doesnt-work/294844)
**Author:** [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 2:15pm UTC](https://discuss.elastic.co/t/clamp-function-for-two-dynamic-value-doesnt-work/294844 "2022-01-20T14:15:36Z")
Hi everyone, I saw this post and tried. To get max of fieldA and fieldB, I tried Formula: clamp(max(fieldA), max(fieldB), 10000), but it does not worked and the cell remains empty. in my case, max(fieldA)=3 and max… --- ## [Metricbeat-7.16.2 does not support billing api version 2019-10-01](https://discuss.elastic.co/t/metricbeat-7-16-2-does-not-support-billing-api-version-2019-10-01/293582)
**Author:** [@adhiraj-g](https://discuss.elastic.co/u/adhiraj-g)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 1:53pm UTC](https://discuss.elastic.co/t/metricbeat-7-16-2-does-not-support-billing-api-version-2019-10-01/293582 "2022-01-20T13:53:28Z")
Hi @MarianaD , Hope you had a great Christmas and New year Break. Sorry to bother you again. I had upgraded to Elasticsearch version 7.16-2. I am now using metricbeat version 7.16.2. Still its showing that the billing… --- ## [About Process tag under Observability](https://discuss.elastic.co/t/about-process-tag-under-observability/294956)
**Author:** [@varsharain-a11y](https://discuss.elastic.co/u/varsharain-a11y)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 1:49pm UTC](https://discuss.elastic.co/t/about-process-tag-under-observability/294956 "2022-01-20T13:49:42Z")
I am first time user of Elastic . I was trying some of the quickstarts to ingest data in elastic. I was trying to use elastic agent method for data ingesting and with system Integration agent trying to visualize process… --- ## [How to get the minimum value of a timespan TSVB](https://discuss.elastic.co/t/how-to-get-the-minimum-value-of-a-timespan-tsvb/294950)
**Author:** [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 1:34pm UTC](https://discuss.elastic.co/t/how-to-get-the-minimum-value-of-a-timespan-tsvb/294950 "2022-01-20T13:34:36Z")
Hi Team, I have a TSVB time series, I'm doing a filter ratio do divide the number x by the number y. Everything goes right here. Then, I have another TSVB metric that I'm doing the same thing, I have a filter ratio wh… --- ## [Kibana doesnt log stderr](https://discuss.elastic.co/t/kibana-doesnt-log-stderr/294949)
**Author:** [@gorbroth](https://discuss.elastic.co/u/gorbroth)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 1:19pm UTC](https://discuss.elastic.co/t/kibana-doesnt-log-stderr/294949 "2022-01-20T13:19:54Z")
Hi , We've recently changed our log dentation from the default /var/log but ever since that we are unable to get stderr logs to our kibana.log file , its only able to capture stdout (info) logs. We also tried the optio… --- ## [Looking for a plugin that provides default logstash metrics](https://discuss.elastic.co/t/looking-for-a-plugin-that-provides-default-logstash-metrics/294948)
**Author:** [@Mohitj252](https://discuss.elastic.co/u/Mohitj252)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 1:11pm UTC](https://discuss.elastic.co/t/looking-for-a-plugin-that-provides-default-logstash-metrics/294948 "2022-01-20T13:11:31Z")
Hi Team, we want to analyse the default metrics provided by the logstash, is there any plugin available to help us for collecting the metrics at a single place. --- ## [Logstash EVTX Ingestion](https://discuss.elastic.co/t/logstash-evtx-ingestion/294947)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 1:00pm UTC](https://discuss.elastic.co/t/logstash-evtx-ingestion/294947 "2022-01-20T13:00:22Z")
Hi Guys, Is there a way to ingest cold EVTX files with logstash? The reason I am asking, is that winlogbeat is really slow. I have big files, some of them takes hours to upload into ELK with winlogbeat. Thanks --- ## [Abrir por iFrame](https://discuss.elastic.co/t/abrir-por-iframe/294930)
**Author:** [@leandrofakada](https://discuss.elastic.co/u/leandrofakada)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 11:18am UTC](https://discuss.elastic.co/t/abrir-por-iframe/294930 "2022-01-20T11:18:46Z")
Atualizei para a última versão do Kibana e agora não consigo mais logar adicionado os dashboards por iframe. Alguém tem alguma ideia de qual opção posso ter esquecido de habilitar? --- ## [\[Metricbeat\] Process modules produces high load / cpu usage](https://discuss.elastic.co/t/metricbeat-process-modules-produces-high-load-cpu-usage/294923)
**Author:** [@adsr](https://discuss.elastic.co/u/adsr)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 9:58am UTC](https://discuss.elastic.co/t/metricbeat-process-modules-produces-high-load-cpu-usage/294923 "2022-01-20T09:58:54Z")
Hi, after upgrading metricbeat from 7.11.2 to 7.16.3 I notice very high load/cpu usage for the metricbeat process. I narrowed it down to the process module in combination with a python process. Furthermore I tried sev… --- ## [Updating a mapping in existing indicese](https://discuss.elastic.co/t/updating-a-mapping-in-existing-indicese/294918)
**Author:** [@pruttle](https://discuss.elastic.co/u/pruttle)\ **Replies:** 6\ **Last updated:** [January 20, 2022, 11:14am UTC](https://discuss.elastic.co/t/updating-a-mapping-in-existing-indicese/294918 "2022-01-20T11:14:42Z")
Hi I have added a new mapping to an Index Template and it is updating new Indices as they are created. I need to update all the pre-existing retrospective Indices with the new mapping. What is the best approach to this… --- ## [Logstash Filter help - Newbie question](https://discuss.elastic.co/t/logstash-filter-help-newbie-question/294580)
**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\ **Replies:** 5\ **Last updated:** [January 20, 2022, 11:05am UTC](https://discuss.elastic.co/t/logstash-filter-help-newbie-question/294580 "2022-01-20T11:05:18Z")
Hi All, Sorry I'm just a bit lost on where to start with this one, I was hoping someone would be kind enough to point me in the right direction please? I have a log that looks like this {"host":"192.168.221.11","messa… --- ## [ES sort in server end when given fileds are equal](https://discuss.elastic.co/t/es-sort-in-server-end-when-given-fileds-are-equal/294517)
**Author:** [@LIU\_HAI](https://discuss.elastic.co/u/LIU_HAI)\ **Replies:** 4\ **Last updated:** [January 20, 2022, 11:04am UTC](https://discuss.elastic.co/t/es-sort-in-server-end-when-given-fileds-are-equal/294517 "2022-01-20T11:04:53Z")
Very simple case, I need to sort docs by one field, say, 'money'. What will the order be if the money of several docs are equal. I use filter to query cuz scores are not necessary. Here's my query example: GET /index/\_s… --- ## [JSON Filter Errors help](https://discuss.elastic.co/t/json-filter-errors-help/294830)
**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\ **Replies:** 10\ **Last updated:** [January 20, 2022, 11:03am UTC](https://discuss.elastic.co/t/json-filter-errors-help/294830 "2022-01-20T11:03:38Z")
Hi All, I'm trying to run the JSON filter on this input with continual errors. Any suggestions on how i do it please? Thanks {"host":"192.168.221.11","message":"HAL GetChassisSlot called from LACPD\_USER(timeout=3000 … --- ## [How can we convert POD CPU usage to percentage when pod has 2 containers with different cpu limits](https://discuss.elastic.co/t/how-can-we-convert-pod-cpu-usage-to-percentage-when-pod-has-2-containers-with-different-cpu-limits/294937)
**Author:** [@Soundarya\_Peddakotla](https://discuss.elastic.co/u/Soundarya_Peddakotla)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 10:55am UTC](https://discuss.elastic.co/t/how-can-we-convert-pod-cpu-usage-to-percentage-when-pod-has-2-containers-with-different-cpu-limits/294937 "2022-01-20T10:55:37Z")
With single container we can convert cpu usage to percentage by using cpu limits. But how can we convert cpu usage to percentage when 2 containers with different cpu limits are there --- ## [NEST - Create a custom function score to use a custom plugin](https://discuss.elastic.co/t/nest-create-a-custom-function-score-to-use-a-custom-plugin/294935)
**Author:** [@SimNightmare](https://discuss.elastic.co/u/SimNightmare)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 10:52am UTC](https://discuss.elastic.co/t/nest-create-a-custom-function-score-to-use-a-custom-plugin/294935 "2022-01-20T10:52:49Z")
Hi, We are migrating our application from NEST 6 to NEST 7.13.2 and now we can't call our plugin score function the way we do before. So with NEST 6 we have a function extending FunctionScoreFunctionBase, and with that… --- ## [Migration to Elasticsearch 6 : request with script and params not working](https://discuss.elastic.co/t/migration-to-elasticsearch-6-request-with-script-and-params-not-working/294570)
**Author:** [@drapej](https://discuss.elastic.co/u/drapej)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 10:50am UTC](https://discuss.elastic.co/t/migration-to-elasticsearch-6-request-with-script-and-params-not-working/294570 "2022-01-20T10:50:04Z")
Hello, I am migrating my Elasticsearch from v5.16 to 6.8 (and after to 7.16) but I have some problem with this type of request (see below) : using params\['\_source'\] in a script I don't understand why. I didn't find any… --- ## [Question: Can I add the IP that issued a command to that command?](https://discuss.elastic.co/t/question-can-i-add-the-ip-that-issued-a-command-to-that-command/294932)
**Author:** [@ziv1](https://discuss.elastic.co/u/ziv1)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 10:47am UTC](https://discuss.elastic.co/t/question-can-i-add-the-ip-that-issued-a-command-to-that-command/294932 "2022-01-20T10:47:09Z")
Hi, Context: auditbeat on RHEL, auditd module Ideally, I would like to remove a ton of fields that are of no use to a human being (not related to this topic), and add a field that would show me the IP that issued a giv… --- ## [Filebeat mixing pod logs](https://discuss.elastic.co/t/filebeat-mixing-pod-logs/294834)
**Author:** [@mnbill](https://discuss.elastic.co/u/mnbill)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 2:39pm UTC](https://discuss.elastic.co/t/filebeat-mixing-pod-logs/294834 "2022-01-19T14:39:00Z")
Hello May be anyone can check that ? I am facing mixing logs on windows filebeat. I build a windows filebeat docker image (based on windows server 1909) and i deployed daemonset on k8s cluster, everyting work fine w… --- ## [Dropdown and Time filters stopped working](https://discuss.elastic.co/t/dropdown-and-time-filters-stopped-working/294913)
**Author:** [@lynchpin82](https://discuss.elastic.co/u/lynchpin82)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 10:02am UTC](https://discuss.elastic.co/t/dropdown-and-time-filters-stopped-working/294913 "2022-01-20T10:02:59Z")
Hi, I'm using Kibana 7.3.2 and had a canvas page using time and dropdown filters. Since last week these have stopped working and I can't understand why. This includes using the demo test data available. Time filter exa… --- ## [Elastic search not starting](https://discuss.elastic.co/t/elastic-search-not-starting/294789)
**Author:** [@rohit45](https://discuss.elastic.co/u/rohit45)\ **Replies:** 12\ **Last updated:** [January 20, 2022, 9:49am UTC](https://discuss.elastic.co/t/elastic-search-not-starting/294789 "2022-01-20T09:49:53Z")
at org.elasticsearch.bootstrap.Bootstrap$5.\(Bootstrap.java:234) ~\[elasticsearch-7.16.3.jar:7.16.3\] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:234) ~\[elasticsearch-7.16.3.jar:7.16… --- ## [Is there a list of files that get changes for account creation/disabling, login and connection attempts as well as api calls etc. for ELK?](https://discuss.elastic.co/t/is-there-a-list-of-files-that-get-changes-for-account-creation-disabling-login-and-connection-attempts-as-well-as-api-calls-etc-for-elk/294005)
**Author:** [@Huseyin\_Tunctepe](https://discuss.elastic.co/u/Huseyin_Tunctepe)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 9:24am UTC](https://discuss.elastic.co/t/is-there-a-list-of-files-that-get-changes-for-account-creation-disabling-login-and-connection-attempts-as-well-as-api-calls-etc-for-elk/294005 "2022-01-20T09:24:42Z")
How are creating/disabling an Elasticsearch account, logging in to Elasticsearch, network connection to ELK or API calls are logged? Also, interested to know if there is a ELK specific audit logging. The purpose of thi… --- ## [Add time range filter in this prometheus.yml of metricbeat to get output for a particular time interval](https://discuss.elastic.co/t/add-time-range-filter-in-this-prometheus-yml-of-metricbeat-to-get-output-for-a-particular-time-interval/294822)
**Author:** [@tweet2santosh86](https://discuss.elastic.co/u/tweet2santosh86)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 9:24am UTC](https://discuss.elastic.co/t/add-time-range-filter-in-this-prometheus-yml-of-metricbeat-to-get-output-for-a-particular-time-interval/294822 "2022-01-20T09:24:28Z")
Hello Team, For metricbeat prometheus module we need output for a particular time interval.. How can we add the filter in at modules.d/prometheus.yml to get the output for a particular time interval.. Request for your … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1085) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1087)