# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1128 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1129 --- ## [Time picker with enddate relative to startdate](https://discuss.elastic.co/t/time-picker-with-enddate-relative-to-startdate/290892)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 10:22am UTC](https://discuss.elastic.co/t/time-picker-with-enddate-relative-to-startdate/290892 "2021-12-14T10:22:33Z")
Hi All, This might be a stupid question but here goes..! We have log data within Elasticsearch that I want to summarise in a visualisation so that it gives me the count of records from 0800 yesterday until 0800 today. … --- ## [Iterate over searchResponse](https://discuss.elastic.co/t/iterate-over-searchresponse/291648)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:06am UTC](https://discuss.elastic.co/t/iterate-over-searchresponse/291648 "2021-12-14T10:06:20Z")
I'd like to iterate over my searchResponse so I can use the value from an id field in every found document in order to do a new search where this id matches another one in another index. So first I'm doing this var… --- ## [Kibana index pattern creation through UI and REST leading to duplicates](https://discuss.elastic.co/t/kibana-index-pattern-creation-through-ui-and-rest-leading-to-duplicates/291553)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:00am UTC](https://discuss.elastic.co/t/kibana-index-pattern-creation-through-ui-and-rest-leading-to-duplicates/291553 "2021-12-14T10:00:27Z")
Found similar issue reported in Same index-pattern created with kibana UI and REST command which got auto-closed due to lack of response. Version: Kibana-oss 7.10.2 Issue: Say an index pattern say journal-2021.07.27 is… --- ## [URL Handlebars referencing value from other column (drilldown workaround)](https://discuss.elastic.co/t/url-handlebars-referencing-value-from-other-column-drilldown-workaround/291612)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 9:55am UTC](https://discuss.elastic.co/t/url-handlebars-referencing-value-from-other-column-drilldown-workaround/291612 "2021-12-14T09:55:21Z")
Hi, to get you in the context, my main goal was to find out if its possible to create dashboard drill down which would refer to different index with different name of columns but values would match e.g. index1 has colum… --- ## [Multiple filebeat config files](https://discuss.elastic.co/t/multiple-filebeat-config-files/291769)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 9:47am UTC](https://discuss.elastic.co/t/multiple-filebeat-config-files/291769 "2021-12-14T09:47:23Z")
I have two different logs format at input so I want to use multiple filebeat yml files and those pointing out to different logstash port my logstash configuration is based on these inputs filebeat1.yml filebeat.input… --- ## [Example dashboard module hasn't appeared](https://discuss.elastic.co/t/example-dashboard-module-hasnt-appeared/291766)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 9:07am UTC](https://discuss.elastic.co/t/example-dashboard-module-hasnt-appeared/291766 "2021-12-14T09:07:55Z")
Hi! I configured Filebeat with module kafka. /opt/filebeat/config/filebeat.ym filebeat.inputs: - type: log enabled: false paths: - /var/log/\*.log - type: filestream enabled: false paths: - /var/log/\*.l… --- ## [Heartbeat autodiscover kubernetes pod](https://discuss.elastic.co/t/heartbeat-autodiscover-kubernetes-pod/290629)
**Author:** [@lalchand\_rajak](https://discuss.elastic.co/u/lalchand_rajak)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 9:02am UTC](https://discuss.elastic.co/t/heartbeat-autodiscover-kubernetes-pod/290629 "2021-12-14T09:02:41Z")
Hi I want heartbeat to find every single kubernetes pod and send it to Elasticsearch uptime, however all I am able to currently get is the kubernetes nodes. Below is the config. apiVersion: v1 kind: ConfigMap metadata:… --- ## [Can not get any logs after create a datastream](https://discuss.elastic.co/t/can-not-get-any-logs-after-create-a-datastream/291629)
**Author:** [@bilgicsin](https://discuss.elastic.co/u/bilgicsin)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 8:48am UTC](https://discuss.elastic.co/t/can-not-get-any-logs-after-create-a-datastream/291629 "2021-12-14T08:48:11Z")
Hi Everyone! I am trying to change my data to the datastream. Normally I can get logs, I can see indice first. After I create a datastream I could not get any logs even though logs keep coming. I followed this steps: … --- ## [ECK Operator not resetting shard\_allocation setting to "all"](https://discuss.elastic.co/t/eck-operator-not-resetting-shard-allocation-setting-to-all/291763)
**Author:** [@phoerious](https://discuss.elastic.co/u/phoerious)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 8:40am UTC](https://discuss.elastic.co/t/eck-operator-not-resetting-shard-allocation-setting-to-all/291763 "2021-12-14T08:40:08Z")
Hi, I've always had the the problem that the ECK operator does not reset the shard\_allocation cluster setting after restarting a node. The result is that after a rolling restart over night, I end up with hundreds of una… --- ## [Scripted\_fields for child records in elasticsearch](https://discuss.elastic.co/t/scripted-fields-for-child-records-in-elasticsearch/291761)
**Author:** [@BIRENDRA](https://discuss.elastic.co/u/BIRENDRA)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 8:25am UTC](https://discuss.elastic.co/t/scripted-fields-for-child-records-in-elasticsearch/291761 "2021-12-14T08:25:10Z")
Hi Team, I have a requirement where I have to put a flag as True or False if my parent record has child records exists in the elastic index. For this purpose I am making use of scripted field but I guess I cannot use it… --- ## [Trouble setting up Elastic Agent Fleet server on self-managed Elasticsearch setup](https://discuss.elastic.co/t/trouble-setting-up-elastic-agent-fleet-server-on-self-managed-elasticsearch-setup/291443)
**Author:** [@iamuser](https://discuss.elastic.co/u/iamuser)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 8:14am UTC](https://discuss.elastic.co/t/trouble-setting-up-elastic-agent-fleet-server-on-self-managed-elasticsearch-setup/291443 "2021-12-14T08:14:06Z")
hi all! I'm having a hard time setting up the elastic agent fleet server. The environment: single node Elasticsearch/wazuh installation with filebeat/metricbeat/heartbeat installed on the node host. I used to copy & past… --- ## [Using Elasticsearch as primary database](https://discuss.elastic.co/t/using-elasticsearch-as-primary-database/291694)
**Author:** [@Lylian1](https://discuss.elastic.co/u/Lylian1)\ **Replies:** 0\ **Last updated:** [December 13, 2021, 5:01pm UTC](https://discuss.elastic.co/t/using-elasticsearch-as-primary-database/291694 "2021-12-13T17:01:53Z")
Some blogs say that Elasticsearch is reliable enough to be used as a primary database and some say that Elasticsearch has issues and can loose data. In order to implement a new project , we have as requirements: store… --- ## [Alert trigger monitor new index](https://discuss.elastic.co/t/alert-trigger-monitor-new-index/291757)
**Author:** [@Anatolii\_Huliaiev](https://discuss.elastic.co/u/Anatolii_Huliaiev)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 7:34am UTC](https://discuss.elastic.co/t/alert-trigger-monitor-new-index/291757 "2021-12-14T07:34:43Z")
I configured trigger inside my alerting panel of Kibana for processing events detected from logs which uses index and it worked fine for a month But after a month of successful work new indices was created by ELK an… --- ## [Kibana build from source always include xpack](https://discuss.elastic.co/t/kibana-build-from-source-always-include-xpack/290678)
**Author:** [@salamani](https://discuss.elastic.co/u/salamani)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 6:59am UTC](https://discuss.elastic.co/t/kibana-build-from-source-always-include-xpack/290678 "2021-12-14T06:59:18Z")
Hi, I am trying to build kibana 7.14.0 from source and would like to have only standard features (without the X-Pack feature). But somehow, I am to able to run yarn kbn bootstrap --oss, however yarn build --skip-os-pac… --- ## [Regarding log4j with Elasticsearch 2.x which uses log4j 1.2](https://discuss.elastic.co/t/regarding-log4j-with-elasticsearch-2-x-which-uses-log4j-1-2/291751)
**Author:** [@nipun\_reddy](https://discuss.elastic.co/u/nipun_reddy)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 6:50am UTC](https://discuss.elastic.co/t/regarding-log4j-with-elasticsearch-2-x-which-uses-log4j-1-2/291751 "2021-12-14T06:50:47Z")
Hi All, I am looking for impact analysis of Elasticsearch 2.4.1 with the newly detected vulnerabilities. As per update from elastic, there is no impact on Elasticsearch 2 and below with cve-2021-44228. But based on CVE-2… --- ## [Esrally gets stuck on check-cluster-health](https://discuss.elastic.co/t/esrally-gets-stuck-on-check-cluster-health/291264)
**Author:** [@vtex](https://discuss.elastic.co/u/vtex)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 6:32am UTC](https://discuss.elastic.co/t/esrally-gets-stuck-on-check-cluster-health/291264 "2021-12-14T06:32:58Z")
Hi, I'm running a local/single-node esrally. My esrally version is 2.30. When I run the below command the execution hangs while checking the status of the cluster -- i.e. in check-cluster-health. $ esrally race --distr… --- ## [Issues with jvm lock](https://discuss.elastic.co/t/issues-with-jvm-lock/291318)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 9\ **Last updated:** [December 14, 2021, 6:25am UTC](https://discuss.elastic.co/t/issues-with-jvm-lock/291318 "2021-12-14T06:25:33Z")
Hello, I have below issues, after start Elasticsearch I see warnings "message": "Unable to lock JVM Memory: error=12, reason=Cannot allocate memory" "message": "This can result in part of the JVM being swapped out." "… --- ## [Translate Filter Error, Not Getting file Path?](https://discuss.elastic.co/t/translate-filter-error-not-getting-file-path/291590)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 6:25am UTC](https://discuss.elastic.co/t/translate-filter-error-not-getting-file-path/291590 "2021-12-14T06:25:08Z")
I am working on 7.14.1 Elasticsearch version. I am running it using docker-compose file. I have different files in json format. I am trying to read all those files in logstash config file but I am getting error. I think … --- ## [Data node vs level of data](https://discuss.elastic.co/t/data-node-vs-level-of-data/291708)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 5:46am UTC](https://discuss.elastic.co/t/data-node-vs-level-of-data/291708 "2021-12-14T05:46:47Z")
How do I equalize data levels between data nodes? --- ## [Count the occurrence of words in ElasticSearch](https://discuss.elastic.co/t/count-the-occurrence-of-words-in-elasticsearch/291595)
**Author:** [@Ashrut](https://discuss.elastic.co/u/Ashrut)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 5:20am UTC](https://discuss.elastic.co/t/count-the-occurrence-of-words-in-elasticsearch/291595 "2021-12-14T05:20:31Z")
Hello Everyone, I am a newbie in Elasticsearch. I was wondering if there is any technique to search for the count of occurrence of a word (or an array of words) in a document. For e.g. if I want to search for the arra… --- ## [Extracting fields from existing message field in windows logs](https://discuss.elastic.co/t/extracting-fields-from-existing-message-field-in-windows-logs/291705)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 4:55am UTC](https://discuss.elastic.co/t/extracting-fields-from-existing-message-field-in-windows-logs/291705 "2021-12-14T04:55:32Z")
Hi, I have winlogbeat that sends evtx files to logstash and than the output of logstash goes to elastic. In the windows event logs, there is a field named "message". the problem is that the field type is text, so i ca… --- ## [Elasticsearch upgrade using Ansible with https](https://discuss.elastic.co/t/elasticsearch-upgrade-using-ansible-with-https/291741)
**Author:** [@Roberto\_Chacon](https://discuss.elastic.co/u/Roberto_Chacon)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 3:32am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-using-ansible-with-https/291741 "2021-12-14T03:32:10Z")
Hello I have been following the following post, there is one response that provide an ansible script that seems to do all the magic. Question on Elasticsearch upgrade using Ansible I have found a blocker that my setup… --- ## [Configure filebeat to use API keys](https://discuss.elastic.co/t/configure-filebeat-to-use-api-keys/291726)
**Author:** [@bbangerter](https://discuss.elastic.co/u/bbangerter)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 12:58am UTC](https://discuss.elastic.co/t/configure-filebeat-to-use-api-keys/291726 "2021-12-14T00:58:06Z")
I have Elasticsearch, kibana, and filebeat (version 7.15.2 for all) running on a CentOS 8 machine using minimal security settings. I now want to get it working with TLS enabled. I have Elasticsearch and kibana working w… --- ## [Regression: Painless script fails for BinaryOperator lamdba](https://discuss.elastic.co/t/regression-painless-script-fails-for-binaryoperator-lamdba/291714)
**Author:** [@Sebastian\_Bathke](https://discuss.elastic.co/u/Sebastian_Bathke)\ **Replies:** 2\ **Last updated:** [December 13, 2021, 11:24pm UTC](https://discuss.elastic.co/t/regression-painless-script-fails-for-binaryoperator-lamdba/291714 "2021-12-13T23:24:56Z")
Hey there, we noticed previously working painless scripts that make use of the Java Stream API passing lamdbas for BinaryOperator parameters to fail with Elasticsearch 7.16.0 onwards. E.g. the following sample works fi… --- ## [Filebeat multiline config not working](https://discuss.elastic.co/t/filebeat-multiline-config-not-working/290383)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 5\ **Last updated:** [December 13, 2021, 10:40pm UTC](https://discuss.elastic.co/t/filebeat-multiline-config-not-working/290383 "2021-12-13T22:40:30Z")
I have a 3rd party app that spits out a text file with multiple lines for a single event. An event has a consistent start line and an end line. I have tried filebeat configurations that grab everything after a specific … --- ## [Data displayed in Watcher email having issue with float values](https://discuss.elastic.co/t/data-displayed-in-watcher-email-having-issue-with-float-values/291722)
**Author:** [@keyu](https://discuss.elastic.co/u/keyu)\ **Replies:** 0\ **Last updated:** [December 13, 2021, 10:20pm UTC](https://discuss.elastic.co/t/data-displayed-in-watcher-email-having-issue-with-float-values/291722 "2021-12-13T22:20:31Z")
Hi, I am new to Elasticsearch cloud. I have used aggregations in watchers to accumulate a float field. But the value of the aggregated amount is displaying incorrectly The value should be displayed as 10,800,050 but i… --- ## [Kibana converting to dubble](https://discuss.elastic.co/t/kibana-converting-to-dubble/291521)
**Author:** [@amjad-alarori](https://discuss.elastic.co/u/amjad-alarori)\ **Replies:** 2\ **Last updated:** [December 13, 2021, 9:44pm UTC](https://discuss.elastic.co/t/kibana-converting-to-dubble/291521 "2021-12-13T21:44:47Z")
im trying to upload a csv file in kibana with fields of type "long", but somehow it convert to type "dubble" i see this error when i brows the Analysis explanation: --- ## ["invalid sequence of tokens near \['for'\]" error in painless script query](https://discuss.elastic.co/t/invalid-sequence-of-tokens-near-for-error-in-painless-script-query/291709)
**Author:** [@aashini](https://discuss.elastic.co/u/aashini)\ **Replies:** 0\ **Last updated:** [December 13, 2021, 7:45pm UTC](https://discuss.elastic.co/t/invalid-sequence-of-tokens-near-for-error-in-painless-script-query/291709 "2021-12-13T19:45:40Z")
I an getting error while executing this script query using Nest : new ScriptQuery { Lang = "painless", … --- ## [Best browser for Kibana 7.16](https://discuss.elastic.co/t/best-browser-for-kibana-7-16/291703)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 2\ **Last updated:** [December 13, 2021, 7:08pm UTC](https://discuss.elastic.co/t/best-browser-for-kibana-7-16/291703 "2021-12-13T19:08:30Z")
Hello everyone, Which browser is best compatible with Kibana 7.16 ? I know that Internet explorer is old now and should use latest browsers like Google Chrome or Microsoft Edge. But is there any explanation about that … --- ## [Logstash - OutOfMemoryError from TCP input](https://discuss.elastic.co/t/logstash-outofmemoryerror-from-tcp-input/291702)
**Author:** [@vishnug](https://discuss.elastic.co/u/vishnug)\ **Replies:** 1\ **Last updated:** [December 13, 2021, 6:38pm UTC](https://discuss.elastic.co/t/logstash-outofmemoryerror-from-tcp-input/291702 "2021-12-13T18:38:38Z")
Hi, I have a logstash pipeline that uses TCP as input. The pipeline handles around 150k to 200k events per day. I was getting the below errors. An exception was thrown by org.logstash.tcp.InputLoop$InputHandler$FlushOn… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1127) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1129)