# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1158 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1159 --- ## [About repeating parameters when using if/else conditions](https://discuss.elastic.co/t/about-repeating-parameters-when-using-if-else-conditions/289448)
**Author:** [@espala](https://discuss.elastic.co/u/espala)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 5:04pm UTC](https://discuss.elastic.co/t/about-repeating-parameters-when-using-if-else-conditions/289448 "2021-11-18T17:04:44Z")
Hello there, I'm using the config I've added as "original" below on my logstash server. My configuration works fine. my purpose; I have a lot of servers and I collect the general system logs of all of them on elk. I i… --- ## [Roles to support lowest privilege](https://discuss.elastic.co/t/roles-to-support-lowest-privilege/289216)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 8\ **Last updated:** [November 18, 2021, 4:55pm UTC](https://discuss.elastic.co/t/roles-to-support-lowest-privilege/289216 "2021-11-18T16:55:58Z")
Hi, I'd like to have a user configured in kibana/elastic that has limited permissions. In this case the user should be able to insert data into elastic. I believe that this will require a role. What I do not understa… --- ## [Multi Terms aggregation does not exist in Java High Level REST Client！](https://discuss.elastic.co/t/multi-terms-aggregation-does-not-exist-in-java-high-level-rest-client/288609)
**Author:** [@Ethan.Winst](https://discuss.elastic.co/u/Ethan.Winst)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 4:40pm UTC](https://discuss.elastic.co/t/multi-terms-aggregation-does-not-exist-in-java-high-level-rest-client/288609 "2021-11-18T16:40:07Z")
Multi Terms aggregation does not exist in Java High Level REST Client！ Does Multi Terms aggregation currently only provide this function for kibana? --- ## [Copy a value from one field to other if a field exists by using ingestnode pipeline](https://discuss.elastic.co/t/copy-a-value-from-one-field-to-other-if-a-field-exists-by-using-ingestnode-pipeline/289484)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 10\ **Last updated:** [November 18, 2021, 4:39pm UTC](https://discuss.elastic.co/t/copy-a-value-from-one-field-to-other-if-a-field-exists-by-using-ingestnode-pipeline/289484 "2021-11-18T16:39:28Z")
Hi Team, I want to create a new field called kubernetes.pod.name if fields called prometheus.labels.pod exists in the logs. I found out that from the set processor I could copy the value which is present in prometheus.l… --- ## [Combined nested query returning wrong result](https://discuss.elastic.co/t/combined-nested-query-returning-wrong-result/289612)
**Author:** [@identify](https://discuss.elastic.co/u/identify)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 3:56pm UTC](https://discuss.elastic.co/t/combined-nested-query-returning-wrong-result/289612 "2021-11-18T15:56:51Z")
Hello, I am trying to do a query with two conditions within the "must" part of a "bool" query. Each condition is a nested query. The query is as follows: { "query":{ "bool":{ "filter":\[ { … --- ## [Tableau Connector with TLS on HTTP layer](https://discuss.elastic.co/t/tableau-connector-with-tls-on-http-layer/289335)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 3:39pm UTC](https://discuss.elastic.co/t/tableau-connector-with-tls-on-http-layer/289335 "2021-11-18T15:39:02Z")
How do I configure the tableau connector Elasticsearch by Elastic to include the certificate for my production cluster? I have followed the instructions to Set up basic security for the Elastic Stack plus secured HTTPS … --- ## [Elasticsearch query](https://discuss.elastic.co/t/elasticsearch-query/288504)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 5\ **Last updated:** [November 18, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504 "2021-11-18T15:06:23Z")
I cannot get this query to work. Note i cannot use the Filter field i GET /index-\*/\_search { "query": { "term": { "result": "Reputation" }, "range": { "@timestamp": { "gte":… --- ## [Error in creating Index patterns for Join Field](https://discuss.elastic.co/t/error-in-creating-index-patterns-for-join-field/288554)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 2:04pm UTC](https://discuss.elastic.co/t/error-in-creating-index-patterns-for-join-field/288554 "2021-11-18T14:04:42Z")
Hi, I am following this tutorial Parent ID query | Elasticsearch Guide \[7.15\] | Elastic After creating an index and inserting documents, the search is working fine both in my local and dev server. But when I am creatin… --- ## [elasticsearch.exceptions.RequestError: RequestError(400, 'search\_phase\_execution\_exception', '\[match\] analyzer \[name\_phonetic\] not found')](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-requesterror-400-search-phase-execution-exception-match-analyzer-name-phonetic-not-found/289572)
**Author:** [@pk5859](https://discuss.elastic.co/u/pk5859)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 2:03pm UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-requesterror-400-search-phase-execution-exception-match-analyzer-name-phonetic-not-found/289572 "2021-11-18T14:03:40Z")
Mapping example- spouseNameQuery = { "match": { "Spouse\_Name": { # "query": input\_dict\['Spouse\_Name'\], "query": val, "analyzer": "name\_phonetic", … --- ## [Kibana removing fields from index pattern](https://discuss.elastic.co/t/kibana-removing-fields-from-index-pattern/288330)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 1:57pm UTC](https://discuss.elastic.co/t/kibana-removing-fields-from-index-pattern/288330 "2021-11-18T13:57:27Z")
Hello. During the test, I created a lot of fields that are now irrelevant and interfere with the search. Can I delete fields that I don't need? --- ## [How to match all tokens? (get rid of false positive result)](https://discuss.elastic.co/t/how-to-match-all-tokens-get-rid-of-false-positive-result/289602)
**Author:** [@vavra7](https://discuss.elastic.co/u/vavra7)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 1:54pm UTC](https://discuss.elastic.co/t/how-to-match-all-tokens-get-rid-of-false-positive-result/289602 "2021-11-18T13:54:02Z")
Hi, I need to find out by the title whether searched game already exists in my ES. I use custom analyzer to meet my needs with features like transform roman numerals, lowercase, custom stopwords etc... So when I create… --- ## [Replace file path with it's content](https://discuss.elastic.co/t/replace-file-path-with-its-content/289599)
**Author:** [@Mohammed\_Sayeed](https://discuss.elastic.co/u/Mohammed_Sayeed)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 1:33pm UTC](https://discuss.elastic.co/t/replace-file-path-with-its-content/289599 "2021-11-18T13:33:14Z")
I'm trying to read a csv and replace file path with it's content. for example i have a csv file like this: data1, data2, path1 data3, data4, path2 path1 data:- data5 path2 data:- data6 i want to create a document l… --- ## [Filebeat's stdin harvester\_buffer\_size leads to not processing messages](https://discuss.elastic.co/t/filebeats-stdin-harvester-buffer-size-leads-to-not-processing-messages/289597)
**Author:** [@djmcgreal-cc](https://discuss.elastic.co/u/djmcgreal-cc)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 1:31pm UTC](https://discuss.elastic.co/t/filebeats-stdin-harvester-buffer-size-leads-to-not-processing-messages/289597 "2021-11-18T13:31:29Z")
I'd like to read from stdin to filebeat. It's in JSONL with json set on the stdin input. When I send a single message of about 1600 bytes nothing gets processed, even if I ask the filebeat process to quit. I can get thi… --- ## [How to Find a document with maximum number of fields in ElasticSearch](https://discuss.elastic.co/t/how-to-find-a-document-with-maximum-number-of-fields-in-elasticsearch/289593)
**Author:** [@amars39](https://discuss.elastic.co/u/amars39)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 1:19pm UTC](https://discuss.elastic.co/t/how-to-find-a-document-with-maximum-number-of-fields-in-elasticsearch/289593 "2021-11-18T13:19:25Z")
Hi, we are trying to find a document in elastic index with maximum number of fields , my document is below format . is there any way to get the document or the highest number of fields count in the document. { "caseId"… --- ## [Query error with .keywords](https://discuss.elastic.co/t/query-error-with-keywords/289587)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 12:41pm UTC](https://discuss.elastic.co/t/query-error-with-keywords/289587 "2021-11-18T12:41:42Z")
Hello! I am trying to enrich my index with logstash's elastic filter. the problem is that it analyzes instead of taking the concrete value. How can I query to use the .keyword? im want something like this: elasti… --- ## [Filebeat Pods OOMKilled](https://discuss.elastic.co/t/filebeat-pods-oomkilled/289586)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 12:41pm UTC](https://discuss.elastic.co/t/filebeat-pods-oomkilled/289586 "2021-11-18T12:41:03Z")
Hi Filebeat version: 7.9.3 I am running Filebeat as a deployment on IBM Kubernetes and reading the logs from a PVC mounted on the cluster. I am seeing Filebeat pods restarting due to OOMKilled. There are some log file… --- ## [How to extract a function from Kibana source code?](https://discuss.elastic.co/t/how-to-extract-a-function-from-kibana-source-code/288996)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 12:07pm UTC](https://discuss.elastic.co/t/how-to-extract-a-function-from-kibana-source-code/288996 "2021-11-18T12:07:21Z")
Dear all =) I would like to be able to convert KQL to Lucene in my NodeJS application that uses the Kibana API to create rules. In this I see fromExpression(expression) and toElasticsearchQuery(node, indexPattern) does… --- ## [How to remove write-lock for elasticsearch segment after reindexing?](https://discuss.elastic.co/t/how-to-remove-write-lock-for-elasticsearch-segment-after-reindexing/289580)
**Author:** [@Adarsh\_Nair](https://discuss.elastic.co/u/Adarsh_Nair)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 11:35am UTC](https://discuss.elastic.co/t/how-to-remove-write-lock-for-elasticsearch-segment-after-reindexing/289580 "2021-11-18T11:35:15Z")
How to remove write-lock for elasticsearch segment after reindexing? Looking at the stack trace there is a missing Lucene file which is not good. Did this index/shard have any docs in it before shutdown? Can you list … --- ## [Index management](https://discuss.elastic.co/t/index-management/289444)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 11:24am UTC](https://discuss.elastic.co/t/index-management/289444 "2021-11-18T11:24:12Z")
I am reading through the documentation and cannot find a section that describes how to set up date retention, such that data is deleted as it ages. I believe its possible to slim data down over time, but i've not yet se… --- ## [413 Request Entity Too Large - how to debug this? \[Elastic\]\[Logstash\]\[Filebeat\]](https://discuss.elastic.co/t/413-request-entity-too-large-how-to-debug-this-elastic-logstash-filebeat/289584)
**Author:** [@bhrt](https://discuss.elastic.co/u/bhrt)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 11:10am UTC](https://discuss.elastic.co/t/413-request-entity-too-large-how-to-debug-this-elastic-logstash-filebeat/289584 "2021-11-18T11:10:59Z")
Hello, I am facing issue with my logstash configuration. I am feeding logstash with log events using filebeat as a client. There are multiple logfiles (with different file formats) parsed in single logstash pipeline (I… --- ## [How to remove write-lock in elasticsearch segment after re-indexing](https://discuss.elastic.co/t/how-to-remove-write-lock-in-elasticsearch-segment-after-re-indexing/289545)
**Author:** [@Adarsh\_Nair](https://discuss.elastic.co/u/Adarsh_Nair)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 11:02am UTC](https://discuss.elastic.co/t/how-to-remove-write-lock-in-elasticsearch-segment-after-re-indexing/289545 "2021-11-18T11:02:42Z")
Caused by: java.io.FileNotFoundException: no segments\* file found in store(mmapfs(E:\\nice\_systems\\RTServer\\Elasticsearch\\data\\nodes\\0\\indices\\AgGE3T0CQqmNUbTa7mgxog\\0\\index)): files: \[recovery.AXzg-JDdOOIh9tEF6n7G.\_f7t.d… --- ## [Combine Information from different log lines into one event](https://discuss.elastic.co/t/combine-information-from-different-log-lines-into-one-event/289518)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 10:58am UTC](https://discuss.elastic.co/t/combine-information-from-different-log-lines-into-one-event/289518 "2021-11-18T10:58:58Z")
Hello team, I have case where information is being displayed in different lines. These lines are not even consecutive lines. Unique field is order ID. I have to triggered email if orderID with Exit came after 30 min of… --- ## [Calculate size of top hit in elasticsearch based on number of buckets](https://discuss.elastic.co/t/calculate-size-of-top-hit-in-elasticsearch-based-on-number-of-buckets/289577)
**Author:** [@Nebojsa](https://discuss.elastic.co/u/Nebojsa)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/calculate-size-of-top-hit-in-elasticsearch-based-on-number-of-buckets/289577 "2021-11-18T10:39:07Z")
I'm filtering documents based on top left and bottom right coordinates and after that using geohash forming buckets. Each bucket has fixed number of top documents in it. I want to always show for example 60 documents, eq… --- ## [Elasticsearch SLM retention](https://discuss.elastic.co/t/elasticsearch-slm-retention/289559)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 2\ **Last updated:** [November 18, 2021, 10:21am UTC](https://discuss.elastic.co/t/elasticsearch-slm-retention/289559 "2021-11-18T10:21:15Z")
Hi All, I have a question about the retention at SLM. If I set a retention period for an SLM Policy, the SLM will deletes all the snapshots older then the retention period. Since Elasticsearch is dealing with incremen… --- ## [Duplication data in the event](https://discuss.elastic.co/t/duplication-data-in-the-event/289567)
**Author:** [@EugeneZ](https://discuss.elastic.co/u/EugeneZ)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 10:09am UTC](https://discuss.elastic.co/t/duplication-data-in-the-event/289567 "2021-11-18T10:09:41Z")
Hi guys I have some log from filebeat--logstash--\> elastic I see logs in kibana and it is strange in JSON for example: { "\_index": "test-fbt-2021.11", "\_type": "\_doc", "\_id": "dvMV\_3wBOQF85F2Xl-Y4", "\_score"… --- ## [Java Client for Spring Boot Reactive Application](https://discuss.elastic.co/t/java-client-for-spring-boot-reactive-application/289540)
**Author:** [@yash\_mahajan](https://discuss.elastic.co/u/yash_mahajan)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 10:05am UTC](https://discuss.elastic.co/t/java-client-for-spring-boot-reactive-application/289540 "2021-11-18T10:05:09Z")
Hi team! Which client do you recommend for Elasticsearch for spring boot reactive app? The documentation says 7.15 high level rest client is deprecated in favour of Java API. 7.16 Java API documentation mentions that i… --- ## [Date histogram aggregation returns a wrong number of buckets and wrong start date of each bucket](https://discuss.elastic.co/t/date-histogram-aggregation-returns-a-wrong-number-of-buckets-and-wrong-start-date-of-each-bucket/289324)
**Author:** [@Helmi\_Akermi](https://discuss.elastic.co/u/Helmi_Akermi)\ **Replies:** 2\ **Last updated:** [November 18, 2021, 10:04am UTC](https://discuss.elastic.co/t/date-histogram-aggregation-returns-a-wrong-number-of-buckets-and-wrong-start-date-of-each-bucket/289324 "2021-11-18T10:04:06Z")
Elasticsearch version is 7 Code : GET /my\_alias/\_search { "from": 0, "size": 10, "query": { "bool": { "must": \[ { "range": { "timestamp": { "gte": 16364160000… --- ## [Filebeat not sending data consistently](https://discuss.elastic.co/t/filebeat-not-sending-data-consistently/289561)
**Author:** [@likhith1995](https://discuss.elastic.co/u/likhith1995)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 9:34am UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-consistently/289561 "2021-11-18T09:34:56Z")
Hi Team, Filebeat is not sending data to logstash continuously. Please find the screenshot in attachment. I see every 30 min a spike in the data, and the data goes to 0 events. After multiple restarts the same is repeat… --- ## [Split messages coming from the same port to different indexes](https://discuss.elastic.co/t/split-messages-coming-from-the-same-port-to-different-indexes/289548)
**Author:** [@Sederfo](https://discuss.elastic.co/u/Sederfo)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 9:34am UTC](https://discuss.elastic.co/t/split-messages-coming-from-the-same-port-to-different-indexes/289548 "2021-11-18T09:34:25Z")
Hi! We use Filebeat and we receive messages from different sources with the same port. Is the a way to send these messages that come from the same port to different indexes? For example, switch messages should only be se… --- ## [Accessing gzipped response with RestClient or RestHighLevelClient](https://discuss.elastic.co/t/accessing-gzipped-response-with-restclient-or-resthighlevelclient/289538)
**Author:** [@soren.nohr](https://discuss.elastic.co/u/soren.nohr)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 9:01am UTC](https://discuss.elastic.co/t/accessing-gzipped-response-with-restclient-or-resthighlevelclient/289538 "2021-11-18T09:01:39Z")
Hi All, I am using the Java RestClient to do a search against an Elasticsearch cluster, requesting a gzipped response by setting the 'Accept-Encoding' header to 'gzip'. Using Wireshark I can see that the Elastic cluster… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1157) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1159)