# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1157 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1158 --- ## [Split chart with individual y axis?](https://discuss.elastic.co/t/split-chart-with-individual-y-axis/288492)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 12:40pm UTC](https://discuss.elastic.co/t/split-chart-with-individual-y-axis/288492 "2021-11-19T12:40:52Z")
Hi, I have a field that contains a string representation of a state. Some states are normal which means that there are many documents with these states. Other states represents errors. Usually, the number of documents c… --- ## [Query with wildcard do not return result if the item has data repeat more than 2 times](https://discuss.elastic.co/t/query-with-wildcard-do-not-return-result-if-the-item-has-data-repeat-more-than-2-times/289500)
**Author:** [@Tu\_Phan](https://discuss.elastic.co/u/Tu_Phan)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 11:11am UTC](https://discuss.elastic.co/t/query-with-wildcard-do-not-return-result-if-the-item-has-data-repeat-more-than-2-times/289500 "2021-11-19T11:11:46Z")
Hi Elastic team & community, I got a trouble with wildcard query do not return expected result when having items with repeated data. With the code below I expected that search query returns 2 items but it returns only … --- ## [How to parse duplicated keys with different values](https://discuss.elastic.co/t/how-to-parse-duplicated-keys-with-different-values/288994)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 9:33am UTC](https://discuss.elastic.co/t/how-to-parse-duplicated-keys-with-different-values/288994 "2021-11-19T09:33:14Z")
Hello! I'm trying to parse CheckPoint log which contains duplicated keys but with different values. For example ... match\_id:"555"; match\_id:"777"; ... When I use kv plugin kv { source =\> "message" field\_split =\> … --- ## [Elasticsearch files in tmp folder: how to change there location](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543)
**Author:** [@1ac727ff300829bca0fa](https://discuss.elastic.co/u/1ac727ff300829bca0fa)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 7:02am UTC](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543 "2021-11-19T07:02:16Z")
Hello guys, I have set up elk in linx server using tar, but my tmp directory gets filled with files in following formates /tmp/elasticsearch-17741669071348173933 How to change there location? --- ## [Java application using BulkProcessing hangs When "circuit\_breaking\_exception" occurs](https://discuss.elastic.co/t/java-application-using-bulkprocessing-hangs-when-circuit-breaking-exception-occurs/289660)
**Author:** [@Vinay\_Gayki](https://discuss.elastic.co/u/Vinay_Gayki)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 6:27am UTC](https://discuss.elastic.co/t/java-application-using-bulkprocessing-hangs-when-circuit-breaking-exception-occurs/289660 "2021-11-19T06:27:20Z")
Using ES 7.5.1 as the server and RestHighLevelClient in java application. Java application hangs after circuit\_breaking\_exception and becomes unresponsive. We are indexing data using bulk API. Stack trace: Name: Orac… --- ## [Comparison of two aggregation results](https://discuss.elastic.co/t/comparison-of-two-aggregation-results/289659)
**Author:** [@Nikita95](https://discuss.elastic.co/u/Nikita95)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 6:19am UTC](https://discuss.elastic.co/t/comparison-of-two-aggregation-results/289659 "2021-11-19T06:19:08Z")
Hi everyone! I'm new to elastic. The question arises, how can I compare two aggregation results and output the number of matches and differences. { "size": 0, "aggs": { "list\_ids\_in\_current\_range": { "ra… --- ## [Do I need to clear all scroll id when get difference scroll id in mutiple scroll request?](https://discuss.elastic.co/t/do-i-need-to-clear-all-scroll-id-when-get-difference-scroll-id-in-mutiple-scroll-request/289574)
**Author:** [@yuhaowin](https://discuss.elastic.co/u/yuhaowin)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 5:57am UTC](https://discuss.elastic.co/t/do-i-need-to-clear-all-scroll-id-when-get-difference-scroll-id-in-mutiple-scroll-request/289574 "2021-11-19T05:57:41Z")
I know in every scroll request we may get difference scroll id,, when I have a list of difference scroll id, need clear all of them? I see search-scroll api example in elasticsearch guide, just clear recently scroll id. … --- ## [Super user that creates api keys on behalf of other user](https://discuss.elastic.co/t/super-user-that-creates-api-keys-on-behalf-of-other-user/289511)
**Author:** [@Scotturbina](https://discuss.elastic.co/u/Scotturbina)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:36am UTC](https://discuss.elastic.co/t/super-user-that-creates-api-keys-on-behalf-of-other-user/289511 "2021-11-19T04:36:05Z")
I got a super user, I need this super user can grant api keys on behalf other user (these users are not native, they sign in via SSO with Open Id) I saw that Grant API key API | Elasticsearch Guide \[7.15\] | Elastic need… --- ## [Confluence(Cloud) Sync Error](https://discuss.elastic.co/t/confluence-cloud-sync-error/289516)
**Author:** [@sungho](https://discuss.elastic.co/u/sungho)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:28am UTC](https://discuss.elastic.co/t/confluence-cloud-sync-error/289516 "2021-11-19T04:28:57Z")
"incremental": \[ { "createdAt": "2021-11-17T22:40:41Z", "status": "complete", "fatalException": null, "errorReason": null, "completedAt": "2021-11-17T22:40:50Z", "durationSeconds": 9.0, "documentErrorCount": 1, … --- ## [Total Indices size per node drops every midnight and back to normal after an hour](https://discuss.elastic.co/t/total-indices-size-per-node-drops-every-midnight-and-back-to-normal-after-an-hour/289541)
**Author:** [@binmats](https://discuss.elastic.co/u/binmats)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 8:08am UTC](https://discuss.elastic.co/t/total-indices-size-per-node-drops-every-midnight-and-back-to-normal-after-an-hour/289541 "2021-11-18T08:08:17Z")
Hi , We have 3 master and 3 data node clusters. We are monitoring the stats with metricbeat. We use elastic 7.9.3 version and metricbeat 7.11 This is the metric: Elasticsearch.node.stats.indices.store.size.bytes We ha… --- ## [Enabling xpack security TLS](https://discuss.elastic.co/t/enabling-xpack-security-tls/289636)
**Author:** [@mwoods269](https://discuss.elastic.co/u/mwoods269)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:22am UTC](https://discuss.elastic.co/t/enabling-xpack-security-tls/289636 "2021-11-19T04:22:30Z")
Just upgraded 3 node cluster (sandbox) to 7.15.2 Basic license Following these instructions to enable security and ultimately tls transport communications. directions say to enable security -enabled security -Elas… --- ## [How do I process sended data?](https://discuss.elastic.co/t/how-do-i-process-sended-data/288991)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 6\ **Last updated:** [November 19, 2021, 4:04am UTC](https://discuss.elastic.co/t/how-do-i-process-sended-data/288991 "2021-11-19T04:04:28Z")
Hello, I managed to send my data to Elasticsearch via Logstash/Filebeat and the modules Plugin aknowledges that. ("Received data from this module") but how can I actually get from the Elasticsearch start page to the Ana… --- ## [Date\_histogram date formatter results in error in ElasticSearch Version 7.15 & above](https://discuss.elastic.co/t/date-histogram-date-formatter-results-in-error-in-elasticsearch-version-7-15-above/289626)
**Author:** [@inspirebharath](https://discuss.elastic.co/u/inspirebharath)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 5:12pm UTC](https://discuss.elastic.co/t/date-histogram-date-formatter-results-in-error-in-elasticsearch-version-7-15-above/289626 "2021-11-18T17:12:48Z")
The below query used to work fine in the Elasticsearch Versions 6.8.x to 7.13.4. But the same breaks from 7.15.x version. Kindly suggest the fix for this. { "size": 0, "\_source": false, "query": { "… --- ## [How to enable https connection in the Bitnami ES](https://discuss.elastic.co/t/how-to-enable-https-connection-in-the-bitnami-es/289650)
**Author:** [@maulin](https://discuss.elastic.co/u/maulin)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:00am UTC](https://discuss.elastic.co/t/how-to-enable-https-connection-in-the-bitnami-es/289650 "2021-11-19T04:00:54Z")
Need to Enable HTTPS connection in Bitnami Elasticsearch cluster --- ## [If the condition is two fields equal how to write?](https://discuss.elastic.co/t/if-the-condition-is-two-fields-equal-how-to-write/289531)
**Author:** [@KhalidDu](https://discuss.elastic.co/u/KhalidDu)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/if-the-condition-is-two-fields-equal-how-to-write/289531 "2021-11-19T03:10:48Z")
Excuse me, I am a novice, so I would like to ask about the query ES, if the condition is two fields equal how to write? --- ## [Java ssl "Too Short" error](https://discuss.elastic.co/t/java-ssl-too-short-error/289244)
**Author:** [@bchill](https://discuss.elastic.co/u/bchill)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 1:54am UTC](https://discuss.elastic.co/t/java-ssl-too-short-error/289244 "2021-11-19T01:54:30Z")
I have an odd problem with a cert signed by our local CA. I get a java error about something being 'too short', but I have no clue what that is. The problem definitely seems to be related to the locally-signed cert, bec… --- ## [Metricbeat : Certificate signed by unknow authority](https://discuss.elastic.co/t/metricbeat-certificate-signed-by-unknow-authority/288391)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 1:51am UTC](https://discuss.elastic.co/t/metricbeat-certificate-signed-by-unknow-authority/288391 "2021-11-19T01:51:08Z")
Hi, I have a metricbeat on debian. It has been a week since the metricbeat service stopped sending data. The cause: ERROR \[esclientleg\] transport/logging.go:37 Error dialing x509: certificate signed by unknown authorit… --- ## [Private key issues connecting beats to logstash & elasticsearch](https://discuss.elastic.co/t/private-key-issues-connecting-beats-to-logstash-elasticsearch/289412)
**Author:** [@K5SF](https://discuss.elastic.co/u/K5SF)\ **Replies:** 5\ **Last updated:** [November 19, 2021, 1:42am UTC](https://discuss.elastic.co/t/private-key-issues-connecting-beats-to-logstash-elasticsearch/289412 "2021-11-19T01:42:01Z")
Hi all, I am writing to you because I am doing an installation of the suite ELK with Logstash elastic kibana et file beat. Only, during my SSL configuration for logstash I end up with this error " Private key cannot be … --- ## [Improve Logstash data resiliency](https://discuss.elastic.co/t/improve-logstash-data-resiliency/289378)
**Author:** [@Rodolffo](https://discuss.elastic.co/u/Rodolffo)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 12:19am UTC](https://discuss.elastic.co/t/improve-logstash-data-resiliency/289378 "2021-11-19T00:19:41Z")
Hi everyone! I'm working on an architecture in which we will ingest transactions into Elasticsearch from our application servers, and want to make absolutely sure that we store 100% of the data. I just want to validate … --- ## [Upgrading kibana from elastic cloud](https://discuss.elastic.co/t/upgrading-kibana-from-elastic-cloud/289606)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 12:18am UTC](https://discuss.elastic.co/t/upgrading-kibana-from-elastic-cloud/289606 "2021-11-19T00:18:58Z")
Hello, good morning I have a question about the kibana upgrade from elastic cloud, my question is if all the data, graphs, machine learning jobs, dashboards, watchers, etc. will be saved. Since the kibana I have in ela… --- ## [ELasticseacrh Cluster won't form bc of no username/pass but setting up user/pass needs a healthy cluster](https://discuss.elastic.co/t/elasticseacrh-cluster-wont-form-bc-of-no-username-pass-but-setting-up-user-pass-needs-a-healthy-cluster/289601)
**Author:** [@Maryam2021](https://discuss.elastic.co/u/Maryam2021)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 11:17pm UTC](https://discuss.elastic.co/t/elasticseacrh-cluster-wont-form-bc-of-no-username-pass-but-setting-up-user-pass-needs-a-healthy-cluster/289601 "2021-11-18T23:17:49Z")
Hi All, I am new and probably missing something, stuck in an infinite loop! I am trying to build an ES cluster of 3 nodes. without any xpack it works fine and comes up. now I need to enable the security (btw I am on bas… --- ## [Input 'aws-s3' failed with: failed to initialize s3 poller: failed to get AWS region for bucket\_arn:](https://discuss.elastic.co/t/input-aws-s3-failed-with-failed-to-initialize-s3-poller-failed-to-get-aws-region-for-bucket-arn/289355)
**Author:** [@sguillen18](https://discuss.elastic.co/u/sguillen18)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 9:41pm UTC](https://discuss.elastic.co/t/input-aws-s3-failed-with-failed-to-initialize-s3-poller-failed-to-get-aws-region-for-bucket-arn/289355 "2021-11-18T21:41:46Z")
Hello, I'm having trouble using the S3 module as described here I'm authenticating with access and secret key and my .yml begins like this: filebeat.inputs: - type: aws-s3 bucket\_arn: arn:aws:s3:::guillens number… --- ## [Get all IP's and mac's of hosts in network](https://discuss.elastic.co/t/get-all-ips-and-macs-of-hosts-in-network/289585)
**Author:** [@Markus\_Lindner](https://discuss.elastic.co/u/Markus_Lindner)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 11:18am UTC](https://discuss.elastic.co/t/get-all-ips-and-macs-of-hosts-in-network/289585 "2021-11-18T11:18:54Z")
Hey guys, I want to monitor the hosts in my network and track the ip's and mac's. I use a metricbeat with "add\_host\_metadata" and "add\_cloud\_metadata" processors. Now i can see all IP's and Mac's of the host, but they … --- ## [Composite Aggregation Impact on ES Performance](https://discuss.elastic.co/t/composite-aggregation-impact-on-es-performance/289638)
**Author:** [@RahulSingh1905](https://discuss.elastic.co/u/RahulSingh1905)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 7:30pm UTC](https://discuss.elastic.co/t/composite-aggregation-impact-on-es-performance/289638 "2021-11-18T19:30:45Z")
The ES7.x doc for composite aggregation warns that : “The composite aggregation is expensive. Load test your application before deploying a composite aggregation in production.” Some context: My team and I are hoping to… --- ## [Assistance Multiplying 2 SQL Variables in Canvas](https://discuss.elastic.co/t/assistance-multiplying-2-sql-variables-in-canvas/289481)
**Author:** [@butchkelley](https://discuss.elastic.co/u/butchkelley)\ **Replies:** 5\ **Last updated:** [November 18, 2021, 6:50pm UTC](https://discuss.elastic.co/t/assistance-multiplying-2-sql-variables-in-canvas/289481 "2021-11-18T18:50:42Z")
Hello I'm trying to multiply 2 variables together in Canvas using tiny math. My Elastic version is 7.9. I started with this as an example (which works fine): filters | demodata | var\_set "val1" value=2 | var\_set "val… --- ## [Elasticsearch 7.10 .zip installation, Windows service will not start](https://discuss.elastic.co/t/elasticsearch-7-10-zip-installation-windows-service-will-not-start/289629)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 6:31pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-zip-installation-windows-service-will-not-start/289629 "2021-11-18T18:31:42Z")
Followed the install steps. Installed Elastic as a service. Started service. Service failed to start Nothing in the logs folders Using dedicated service account (not local system) System error log error 7034 ...se… --- ## [Elastic migrating from 6.8.8 to 7.10.2 in cluster mode : 1st node not starting until 2nd node starts in earlier version this was not the case](https://discuss.elastic.co/t/elastic-migrating-from-6-8-8-to-7-10-2-in-cluster-mode-1st-node-not-starting-until-2nd-node-starts-in-earlier-version-this-was-not-the-case/289610)
**Author:** [@cssingh](https://discuss.elastic.co/u/cssingh)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 6:03pm UTC](https://discuss.elastic.co/t/elastic-migrating-from-6-8-8-to-7-10-2-in-cluster-mode-1st-node-not-starting-until-2nd-node-starts-in-earlier-version-this-was-not-the-case/289610 "2021-11-18T18:03:56Z")
I am making 3 node cluster. Below is my elastic.yml file cluster.name: SpectrumCluster node.name: node-1 cluster.initial\_master\_nodes: 10.2.107.14:9300,172.30.6.22:9300,172.30.5.255:9300 discovery.seed\_hosts: 10.2.10… --- ## [Add Default Date Format on Mapping](https://discuss.elastic.co/t/add-default-date-format-on-mapping/289341)
**Author:** [@Mehmet\_Gencol](https://discuss.elastic.co/u/Mehmet_Gencol)\ **Replies:** 12\ **Last updated:** [November 18, 2021, 5:45pm UTC](https://discuss.elastic.co/t/add-default-date-format-on-mapping/289341 "2021-11-18T17:45:19Z")
I have a mapping that dynamically detects date and stores. Fields are dynamically created, and I don't have any configuration about date formatting. so dates are detected and stored as their formats. They are generally s… --- ## [Unable to Parse Syslog messages into Elasticsearch](https://discuss.elastic.co/t/unable-to-parse-syslog-messages-into-elasticsearch/288755)
**Author:** [@Elie\_Sbat1](https://discuss.elastic.co/u/Elie_Sbat1)\ **Replies:** 9\ **Last updated:** [November 18, 2021, 5:34pm UTC](https://discuss.elastic.co/t/unable-to-parse-syslog-messages-into-elasticsearch/288755 "2021-11-18T17:34:48Z")
Hello, I am sending syslog messages from barracuda mail spammer directly into Elasticsearch database. The index got populated with data but the data are not parsed correctly. The log attributes are all shown in the mes… --- ## [Date format in Elasticsearch](https://discuss.elastic.co/t/date-format-in-elasticsearch/289608)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 8\ **Last updated:** [November 18, 2021, 5:30pm UTC](https://discuss.elastic.co/t/date-format-in-elasticsearch/289608 "2021-11-18T17:30:20Z")
Hello. I am trying to import a .csv file to Elasticsearch. In the .csv file there is a date field in the "yyyyMMdd" format (for example 20220326). This is what I have in my logstash conf file: filter { date { m… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1156) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1158)