# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1094 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1095 --- ## [Post filter results by score and max\_score](https://discuss.elastic.co/t/post-filter-results-by-score-and-max-score/294366)
**Author:** [@faza.zheten123](https://discuss.elastic.co/u/faza.zheten123)\ **Replies:** 5\ **Last updated:** [January 14, 2022, 11:59am UTC](https://discuss.elastic.co/t/post-filter-results-by-score-and-max-score/294366 "2022-01-14T11:59:59Z")
Hello, I want to show only max scored results. Is it possible? If possible could you tell me how to do it? Thanks as lot! --- ## [Field Correlations In Kibana Canvas](https://discuss.elastic.co/t/field-correlations-in-kibana-canvas/294275)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 1:22pm UTC](https://discuss.elastic.co/t/field-correlations-in-kibana-canvas/294275 "2022-01-13T13:22:09Z")
Hi Guys, I've been using the kibana canvas dashboards and so far I'm really impressed. The only issue I have is with the correlations. I understand that SQL JOIN is not supported. What is the alternative? in big data… --- ## [Language identification making Elasticsearch cluster unresponsive?](https://discuss.elastic.co/t/language-identification-making-elasticsearch-cluster-unresponsive/294406)
**Author:** [@Pyppe](https://discuss.elastic.co/u/Pyppe)\ **Replies:** 0\ **Last updated:** [January 14, 2022, 11:36am UTC](https://discuss.elastic.co/t/language-identification-making-elasticsearch-cluster-unresponsive/294406 "2022-01-14T11:36:07Z")
We've got a dockerized 7.16.2 Elaticsearch server running. E.g. /\_cat/indices and /\_cat/nodes endpoints hang out and never give a response. In logs we have warnings such as: {"type": "server", "timestamp": "2022-01-14T… --- ## [Help with pfsense integration](https://discuss.elastic.co/t/help-with-pfsense-integration/294404)
**Author:** [@tsourtsouris](https://discuss.elastic.co/u/tsourtsouris)\ **Replies:** 0\ **Last updated:** [January 14, 2022, 11:22am UTC](https://discuss.elastic.co/t/help-with-pfsense-integration/294404 "2022-01-14T11:22:22Z")
Hello there, I installed the pfsense integration, but I get this fields only: I ship the pfsense logs to an ubuntu server and there I have installed the policy. The syslog server listens only to 9001 udp. How do th… --- ## [About the source map of RUM](https://discuss.elastic.co/t/about-the-source-map-of-rum/294386)
**Author:** [@xxxxz](https://discuss.elastic.co/u/xxxxz)\ **Replies:** 2\ **Last updated:** [January 14, 2022, 9:59am UTC](https://discuss.elastic.co/t/about-the-source-map-of-rum/294386 "2022-01-14T09:59:38Z")
I successfully collected monitoring data in my frontend project (react). Now I use the serverUrl I got from inti to upload the map file, but this link seems to be 404 all the time. This problem has been bothering me for … --- ## [Range queries with custom format dates](https://discuss.elastic.co/t/range-queries-with-custom-format-dates/292852)
**Author:** [@vincen.zo](https://discuss.elastic.co/u/vincen.zo)\ **Replies:** 4\ **Last updated:** [January 14, 2022, 10:31am UTC](https://discuss.elastic.co/t/range-queries-with-custom-format-dates/292852 "2022-01-14T10:31:07Z")
Hi, I am having some troubles using single and multiple range clauses in queries with date fields that use dynamic mappings. I frist create an empty index with the following dynamic mappings, including a custom date fo… --- ## [HTTPJSON input : share request identifier among events](https://discuss.elastic.co/t/httpjson-input-share-request-identifier-among-events/293924)
**Author:** [@thopic](https://discuss.elastic.co/u/thopic)\ **Replies:** 5\ **Last updated:** [January 14, 2022, 10:23am UTC](https://discuss.elastic.co/t/httpjson-input-share-request-identifier-among-events/293924 "2022-01-14T10:23:41Z")
Hi, I've been struggling for a long time to configure my filebeat to request RESTful APIs when the response is a JSON array of multiple objects. Because I want to sum a metric over time (this metric is present in each … --- ## [Filebeat ingesta de AWS CloudTrail](https://discuss.elastic.co/t/filebeat-ingesta-de-aws-cloudtrail/294184)
**Author:** [@Elisa\_LB](https://discuss.elastic.co/u/Elisa_LB)\ **Replies:** 1\ **Last updated:** [January 14, 2022, 9:46am UTC](https://discuss.elastic.co/t/filebeat-ingesta-de-aws-cloudtrail/294184 "2022-01-14T09:46:31Z")
Buenas tardes, Estoy teniendo inconvenientes con la ingesta de AWS CloudTrail mediante filebeat, tengo el agente conectado a la consola de Elastic Cloud y la configuración del modulo de aws en filebeat desde la consola … --- ## [Failed to load metata when restarting elasticsearch](https://discuss.elastic.co/t/failed-to-load-metata-when-restarting-elasticsearch/293709)
**Author:** [@bruce2](https://discuss.elastic.co/u/bruce2)\ **Replies:** 7\ **Last updated:** [January 14, 2022, 8:23am UTC](https://discuss.elastic.co/t/failed-to-load-metata-when-restarting-elasticsearch/293709 "2022-01-14T08:23:05Z")
When I restart a node of the elasticsearch cluster, it failed to start. I set log level to trace. The logs is like below: \[2022-01-05T19:2...\]\[TRACE\]\[o.e.g.PersistedClusterStateService\] \[HOSTNAME\] found index metadata … --- ## [Syncing SQL data with Elastic](https://discuss.elastic.co/t/syncing-sql-data-with-elastic/294372)
**Author:** [@Satyan\_Gupta](https://discuss.elastic.co/u/Satyan_Gupta)\ **Replies:** 0\ **Last updated:** [January 14, 2022, 7:27am UTC](https://discuss.elastic.co/t/syncing-sql-data-with-elastic/294372 "2022-01-14T07:27:02Z")
Hello Everyone, I am new to elastic and facing issue to keep my sql database in sync with elastic. Here is my logstash config file. input { jdbc { jdbc\_driver\_library =\> "C:\\Users\\satyang.sw\\Desktop\\ELK\_Stack\\log… --- ## [Kibana Yellow Status due to new encryptedSavedObjects encryptionkey](https://discuss.elastic.co/t/kibana-yellow-status-due-to-new-encryptedsavedobjects-encryptionkey/294362)
**Author:** [@ikbal](https://discuss.elastic.co/u/ikbal)\ **Replies:** 1\ **Last updated:** [January 14, 2022, 6:56am UTC](https://discuss.elastic.co/t/kibana-yellow-status-due-to-new-encryptedsavedobjects-encryptionkey/294362 "2022-01-14T06:56:55Z")
Hello everyone, I currently having issues with Kibana where the xpack.encryptedSavedObjects.encryptionKey been changed to a new one. I forgot to backup the old key and now using the new key. After restarting the kibana,… --- ## [Logstash User Survey](https://discuss.elastic.co/t/logstash-user-survey/294248)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 2\ **Last updated:** [January 14, 2022, 6:48am UTC](https://discuss.elastic.co/t/logstash-user-survey/294248 "2022-01-14T06:48:19Z")
Hi, I know it's been a while ago, but I ran into the post about Logstash user survey Logstash User Survey Results | Elastic Blog recently and I found the blog really useful, since it also includes the link to the raw fi… --- ## [Confused about Explicit Mapping in Synonym Graph](https://discuss.elastic.co/t/confused-about-explicit-mapping-in-synonym-graph/294368)
**Author:** [@learningmore](https://discuss.elastic.co/u/learningmore)\ **Replies:** 0\ **Last updated:** [January 14, 2022, 6:35am UTC](https://discuss.elastic.co/t/confused-about-explicit-mapping-in-synonym-graph/294368 "2022-01-14T06:35:31Z")
I've read the document on Synonym Graph, but I am still confused about explicit mapping. Assume that we have the following data: horse mouse chicken rooster duck cow Let's assume the synonym file has the following ent… --- ## [How to copy from Kibana Logs easily?](https://discuss.elastic.co/t/how-to-copy-from-kibana-logs-easily/294140)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 4\ **Last updated:** [January 14, 2022, 5:32am UTC](https://discuss.elastic.co/t/how-to-copy-from-kibana-logs-easily/294140 "2022-01-14T05:32:01Z")
I use Kibana to view the Logs, and I want to copy some lines from it. However, when copying, I get something like the following in my clipboard: 16:55:10.943 MyTag \[Debug\] my message 16:55:10.956 AnotherTag \[Info\] anoth… --- ## [Incomplete data transfer on winlogbeat 7.16.1](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 2\ **Last updated:** [January 14, 2022, 3:40am UTC](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607 "2022-01-14T03:40:11Z")
hi, We upgraded ELK clusters to v7.16.1 on 2021/12/21. (winlogbeat v7.4.2) Everything is fine. And our AD servers updated patch 'KB5008218' on 2021/21/27. Winlogbeat transferred incomplete data to logstash! Our wind… --- ## [Updating documents within a Hot-Warm-Cold Index Management Lifecycle](https://discuss.elastic.co/t/updating-documents-within-a-hot-warm-cold-index-management-lifecycle/294314)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 6:43pm UTC](https://discuss.elastic.co/t/updating-documents-within-a-hot-warm-cold-index-management-lifecycle/294314 "2022-01-13T18:43:41Z")
Hello, I have set up an index lifecycle policy with rollover enable either for a max index size of 50gb or 30 days. The indices will move to a warm phase on rollover and to a cold phase after 90 days. Phase descriptio… --- ## [Get parent field from join mapping](https://discuss.elastic.co/t/get-parent-field-from-join-mapping/294341)
**Author:** [@tleduong](https://discuss.elastic.co/u/tleduong)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 11:26pm UTC](https://discuss.elastic.co/t/get-parent-field-from-join-mapping/294341 "2022-01-13T23:26:58Z")
I have a join mapping relationship where units is the parent and wells is child. I'm trying to run this query to return the child but also include a field from the parent. This would only return the parent ID. How do i … --- ## [Deprecating less popular technology support in es-hadoop](https://discuss.elastic.co/t/deprecating-less-popular-technology-support-in-es-hadoop/294336)
**Author:** [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 10:07pm UTC](https://discuss.elastic.co/t/deprecating-less-popular-technology-support-in-es-hadoop/294336 "2022-01-13T22:07:33Z")
We are deprecating support for Apache Pig, Apache Storm, Hadoop 1, Spark 1, and Scala 2.10 on Spark 2 (we are still supporting Scala 2.11 and 2.12 on Spark 2). See Deprecating old technology by masseyke · Pull Request #1… --- ## [Elastic Agent is Healthy, but no data streams](https://discuss.elastic.co/t/elastic-agent-is-healthy-but-no-data-streams/294224)
**Author:** [@harwinds](https://discuss.elastic.co/u/harwinds)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 10:06pm UTC](https://discuss.elastic.co/t/elastic-agent-is-healthy-but-no-data-streams/294224 "2022-01-13T22:06:34Z")
Hi, I'm running fleet managed elastic agent on Elastic 7.15.1. I've multiple agents running on Linux and Windows endpoints. All agents are showing healthy. On both Linux and Windows, custom certificate is added to system… --- ## [Frequent log in kibana 7.16.2](https://discuss.elastic.co/t/frequent-log-in-kibana-7-16-2/294148)
**Author:** [@Suresh\_Ghatuwa](https://discuss.elastic.co/u/Suresh_Ghatuwa)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 10:06pm UTC](https://discuss.elastic.co/t/frequent-log-in-kibana-7-16-2/294148 "2022-01-13T22:06:07Z")
After upgrading Kibana 7.11.1 to 7.16.2, we are seeing continuous log in Kibana log file. Also, ES queries is being printed in log. We are seeing such continuous log in Kibana 7.11.1 after successful startup. But We ar… --- ## [Error fetching data for metricset beat.state: error making http request: Get "https://xxx.xxxx.cloudapp.azure.com:5066/state": dial tcp connect: connection refused](https://discuss.elastic.co/t/error-fetching-data-for-metricset-beat-state-error-making-http-request-get-https-xxx-xxxx-cloudapp-azure-com-5066-state-dial-tcp-connect-connection-refused/294003)
**Author:** [@aviad.co1](https://discuss.elastic.co/u/aviad.co1)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 9:08pm UTC](https://discuss.elastic.co/t/error-fetching-data-for-metricset-beat-state-error-making-http-request-get-https-xxx-xxxx-cloudapp-azure-com-5066-state-dial-tcp-connect-connection-refused/294003 "2022-01-13T21:08:42Z")
Hi, I'm Build remote monitoring cluster elastic stack to monitor elastic production environment. I'm install metricbeats on the target and success to configure elasticsearch-xpack and kibana-xpack, and I see metrics on… --- ## [Filebeat deployed as deamonset reports wrong image versions for containers](https://discuss.elastic.co/t/filebeat-deployed-as-deamonset-reports-wrong-image-versions-for-containers/294329)
**Author:** [@vikas1389](https://discuss.elastic.co/u/vikas1389)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 8:46pm UTC](https://discuss.elastic.co/t/filebeat-deployed-as-deamonset-reports-wrong-image-versions-for-containers/294329 "2022-01-13T20:46:00Z")
Hey Team- seeing filebeat is reporting older image where is container has latest image- I see lot of logs like below on filebeat- what could be issue 2022-01-13T20:29:34.022Z INFO log/harvester.go:333 File is inactive: … --- ## [Stuck with lots of empty indices for every beat version I've ever used](https://discuss.elastic.co/t/stuck-with-lots-of-empty-indices-for-every-beat-version-ive-ever-used/294204)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 6\ **Last updated:** [January 13, 2022, 8:10pm UTC](https://discuss.elastic.co/t/stuck-with-lots-of-empty-indices-for-every-beat-version-ive-ever-used/294204 "2022-01-13T20:10:14Z")
Hello, I run a small 2-node cluster with a kitchen sink of beats and elastic agents on approx. 20 hosts. Nevertheless, I have a ton of indices and I'm hitting the cluster.max\_shards\_per\_node. There is not much data in … --- ## [Ansible roles being deprecated and to support Version 8.0.0?](https://discuss.elastic.co/t/ansible-roles-being-deprecated-and-to-support-version-8-0-0/292233)
**Author:** [@Andrew\_DeMarsh](https://discuss.elastic.co/u/Andrew_DeMarsh)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 7:38pm UTC](https://discuss.elastic.co/t/ansible-roles-being-deprecated-and-to-support-version-8-0-0/292233 "2022-01-13T19:38:11Z")
Hey I've found notices in Elastic's git repos inside the Ansible roles that I currently use for rolling out Elasticsearch in our different environments saying: This Ansible role is being deprecated and will not be upda… --- ## [Unique feilds count](https://discuss.elastic.co/t/unique-feilds-count/294268)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 9\ **Last updated:** [January 13, 2022, 6:25pm UTC](https://discuss.elastic.co/t/unique-feilds-count/294268 "2022-01-13T18:25:16Z")
How can i right DSL query for count of unique value in fields (Colom) for one day. where unique value is greater than 15 SQL example: select /+parallel(15)/ fruits ,count(1) from all\_items where LOAD\_DATE=trunc(sysda… --- ## [Share visualization in editable mode in iFrame](https://discuss.elastic.co/t/share-visualization-in-editable-mode-in-iframe/293920)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 5:25pm UTC](https://discuss.elastic.co/t/share-visualization-in-editable-mode-in-iframe/293920 "2022-01-13T17:25:46Z")
Hi, is it possible to share visualization in editable mode? If I share dashboard in edit mode, I see the gearwheel in the corner for choosing option "edit visualization" but when I click on it, my iFrame just spreads … --- ## [Usage coordinator node before ingest node and data node](https://discuss.elastic.co/t/usage-coordinator-node-before-ingest-node-and-data-node/294149)
**Author:** [@acidborn601](https://discuss.elastic.co/u/acidborn601)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:42pm UTC](https://discuss.elastic.co/t/usage-coordinator-node-before-ingest-node-and-data-node/294149 "2022-01-13T16:42:42Z")
Hi all! We have cluster with 3 dedicated master nodes, 4 dedicated ingest nodes and 28 dedicated data nodes. Data sent to ingest nodes from filebeat. Max.performance indexing on this configuration ~200000 tps. Question… --- ## [How to escape new line character?](https://discuss.elastic.co/t/how-to-escape-new-line-character/294254)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:17pm UTC](https://discuss.elastic.co/t/how-to-escape-new-line-character/294254 "2022-01-13T16:17:22Z")
"MethodParameter" =\> "{\\r\\n \\"getCardholderBalance\\": {\\r\\n \\"acquirer\\": {\\r\\n \\"id\\": \\"testdemo\\",\\r\\n \\"userId\\": \\"xxxxx\\",\\r\\n \\"password\\": \\"xxxxxxxxxxxxxxx\\"\\r\\n },\\r\\n \\"card\\": {\\r\\n… --- ## [Winlogbeat sending data to default index](https://discuss.elastic.co/t/winlogbeat-sending-data-to-default-index/294210)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:00pm UTC](https://discuss.elastic.co/t/winlogbeat-sending-data-to-default-index/294210 "2022-01-13T16:00:28Z")
Trying to setup winlogbeat but it seems to be sending documents only to default index - winlogbeat-7\* instead of the one I explicity mentioned in the winlogbeat.yml. I must be missing something basic but can't figure out… --- ## [Enrich processor limitations](https://discuss.elastic.co/t/enrich-processor-limitations/294295)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 3:33pm UTC](https://discuss.elastic.co/t/enrich-processor-limitations/294295 "2022-01-13T15:33:26Z")
Hey, I'm working with enrich processor to add data from my already existing logs to the ones that are being ingested. What makes it challenging is the fact that the logs that are the »source« of information are also con… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1093) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1095)