# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1159 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1160 --- ## [Retrieve each filter response in one result](https://discuss.elastic.co/t/retrieve-each-filter-response-in-one-result/289467)
**Author:** [@uedemir](https://discuss.elastic.co/u/uedemir)\ **Replies:** 2\ **Last updated:** [November 18, 2021, 8:36am UTC](https://discuss.elastic.co/t/retrieve-each-filter-response-in-one-result/289467 "2021-11-18T08:36:37Z")
Hi, Is it possible to combine three or more filter query with each wished size and get ids of document separately in result? For example; size parameter in query is 100 and I need to get 10 documents from first of my f… --- ## [Problems in outputting files to shared unit with Logstash in Windows](https://discuss.elastic.co/t/problems-in-outputting-files-to-shared-unit-with-logstash-in-windows/289423)
**Author:** [@rrodrmal\_everis](https://discuss.elastic.co/u/rrodrmal_everis)\ **Replies:** 2\ **Last updated:** [November 18, 2021, 8:05am UTC](https://discuss.elastic.co/t/problems-in-outputting-files-to-shared-unit-with-logstash-in-windows/289423 "2021-11-18T08:05:51Z")
Hello all: First publication in this forum for me. I hope I'm not breaking a bunch of guidelines. We have a Logstash 7.11.1 installed over a Windows Server 2016 ingesting log files via filebeat. As output, both an Ela… --- ## [Could not index event to Elasticsearch - object mapping for customersegment\_age\_classe tried to parse field customersegment\_age\_classe as object, but found a concrete value](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-object-mapping-for-customersegment-age-classe-tried-to-parse-field-customersegment-age-classe-as-object-but-found-a-concrete-value/289433)
**Author:** [@Maksonsse](https://discuss.elastic.co/u/Maksonsse)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 7:45am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-object-mapping-for-customersegment-age-classe-tried-to-parse-field-customersegment-age-classe-as-object-but-found-a-concrete-value/289433 "2021-11-18T07:45:19Z")
Hello everyone and thanks for passing by ! I'm actually trying to import data into Elasticsearch (with ELK stack) from a view in a dockerized mysql with Logstash but i'm failing miserably for some weeks now as i'm a com… --- ## [How to re configure a data stream for lowering the usage of shards](https://discuss.elastic.co/t/how-to-re-configure-a-data-stream-for-lowering-the-usage-of-shards/289530)
**Author:** [@vijayebpzr](https://discuss.elastic.co/u/vijayebpzr)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 7:13am UTC](https://discuss.elastic.co/t/how-to-re-configure-a-data-stream-for-lowering-the-usage-of-shards/289530 "2021-11-18T07:13:36Z")
I have a data stream which is associated with an index template which create 3 shards per index daily. This is a time based indices which creates new index daily. We are approaching the maximum number of allowed shards i… --- ## [X-pack for "read only accounts" in Kibana](https://discuss.elastic.co/t/x-pack-for-read-only-accounts-in-kibana/289429)
**Author:** [@cf4455](https://discuss.elastic.co/u/cf4455)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 7:11am UTC](https://discuss.elastic.co/t/x-pack-for-read-only-accounts-in-kibana/289429 "2021-11-18T07:11:06Z")
Hi, at the moment we only use Kibana with accounts that can create, edit and view dashboards and visualizations. Can we use x-pack, for example, to create additional users who can only read certain dashboards / visualiz… --- ## [Urgent Help Required :: Need to sync specific Feilds from three different indexes to single Index using Logstash pipeline](https://discuss.elastic.co/t/urgent-help-required-need-to-sync-specific-feilds-from-three-different-indexes-to-single-index-using-logstash-pipeline/289535)
**Author:** [@BASHEER\_DS](https://discuss.elastic.co/u/BASHEER_DS)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 6:59am UTC](https://discuss.elastic.co/t/urgent-help-required-need-to-sync-specific-feilds-from-three-different-indexes-to-single-index-using-logstash-pipeline/289535 "2021-11-18T06:59:20Z")
Hi, I am trying to sync specific fields from three different index in to single index using Logstash pipeline. Am using Elasticsearch as input, filter and output plugins, But while creating Pipeline am getting error(No … --- ## [How to sync specific fields based on common values of three different collections in MongoDB to ElasticSearch using logstash pipeline](https://discuss.elastic.co/t/how-to-sync-specific-fields-based-on-common-values-of-three-different-collections-in-mongodb-to-elasticsearch-using-logstash-pipeline/289532)
**Author:** [@BASHEER\_DS](https://discuss.elastic.co/u/BASHEER_DS)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 6:42am UTC](https://discuss.elastic.co/t/how-to-sync-specific-fields-based-on-common-values-of-three-different-collections-in-mongodb-to-elasticsearch-using-logstash-pipeline/289532 "2021-11-18T06:42:54Z")
In Logstash Pipeline we are using mongoDB as input plugin and we are using three different collection to sync specific Fields in Elasticsearch Index based on common values of different collections. But How to sync specif… --- ## [Reindex api request failing on Elasticsearch 6.6](https://discuss.elastic.co/t/reindex-api-request-failing-on-elasticsearch-6-6/289428)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 5:09am UTC](https://discuss.elastic.co/t/reindex-api-request-failing-on-elasticsearch-6-6/289428 "2021-11-18T05:09:33Z")
Facing issue while running reindex api on ES v6.6. Please refer below shared output: Command: $ curl -XPOST http://\:9200/\_reindex?pretty -H 'Content-Type: application/json' -d' { "source": { "in… --- ## [Overriding filebeat palo alto modules @timestamp](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436)
**Author:** [@Sirrah](https://discuss.elastic.co/u/Sirrah)\ **Replies:** 5\ **Last updated:** [November 18, 2021, 3:20am UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436 "2021-11-18T03:20:56Z")
Recently, I set up a filebeat to receive palo alto and sophos data. Filebeat module parsed the data as the timestamp. Instead of using the timestamp in log, i want to use the received time as @timestamp. Does there any… --- ## [Ingest mixed container logs with text and JSON \[ECK\]\[filebeat\]](https://discuss.elastic.co/t/ingest-mixed-container-logs-with-text-and-json-eck-filebeat/289464)
**Author:** [@Sven\_Eliasson](https://discuss.elastic.co/u/Sven_Eliasson)\ **Replies:** 2\ **Last updated:** [November 18, 2021, 2:54am UTC](https://discuss.elastic.co/t/ingest-mixed-container-logs-with-text-and-json-eck-filebeat/289464 "2021-11-18T02:54:06Z")
Hi, I'm trying to digest logs with Filebeat on our Kubernetes cluster which is using ECK on Kubernetes. We are migrating logs to a JSON format, but many legacy or 3rd party containers use plain logs. So we need to suppo… --- ## [Mssql server data -\> elasticsearch](https://discuss.elastic.co/t/mssql-server-data-elasticsearch/289517)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 1:03am UTC](https://discuss.elastic.co/t/mssql-server-data-elasticsearch/289517 "2021-11-18T01:03:58Z")
We currently have an application that sends it's logs to an mssql server database. I'd like to pull those logs into Elasticsearch directly from sql server similar using filebeat to import file based logs. I've looked a… --- ## [Does an index pattern have a limit to the amount of fields it contains?](https://discuss.elastic.co/t/does-an-index-pattern-have-a-limit-to-the-amount-of-fields-it-contains/289434)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 11:26pm UTC](https://discuss.elastic.co/t/does-an-index-pattern-have-a-limit-to-the-amount-of-fields-it-contains/289434 "2021-11-17T23:26:44Z")
Hi, We have an index pattern that is currently at 1008 fields and when trying to add a new index that would fall into this index pattern the extra fields are not appearing on the index pattern. I have had a look and al… --- ## [Get IP and MAC of host](https://discuss.elastic.co/t/get-ip-and-mac-of-host/289457)
**Author:** [@Markus\_Lindner](https://discuss.elastic.co/u/Markus_Lindner)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 1:20pm UTC](https://discuss.elastic.co/t/get-ip-and-mac-of-host/289457 "2021-11-17T13:20:32Z")
Hey guys, I want to monitor the hosts in my network and track the ip's and mac's. I use a metricbeat with "add\_host\_metadata" and "add\_cloud\_metadata" processors. Now i can see all IP's and Mac's of the host, but they … --- ## [How to avoid memory leak on creating role in huge elastic instance](https://discuss.elastic.co/t/how-to-avoid-memory-leak-on-creating-role-in-huge-elastic-instance/289426)
**Author:** [@Hamidreza\_Ahmadinia](https://discuss.elastic.co/u/Hamidreza_Ahmadinia)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 11:24pm UTC](https://discuss.elastic.co/t/how-to-avoid-memory-leak-on-creating-role-in-huge-elastic-instance/289426 "2021-11-17T23:24:10Z")
hi I have an Elasticsearch instane with 25,612,514,771 documents When i create role in kibana, unassigned\_shards inceases and status turn to yellow. for about 10 minutes Search Latency increases too. --- ## [When do I use unique: true?](https://discuss.elastic.co/t/when-do-i-use-unique-true/289492)
**Author:** [@Laszlo\_Stahorszki](https://discuss.elastic.co/u/Laszlo_Stahorszki)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 6:10pm UTC](https://discuss.elastic.co/t/when-do-i-use-unique-true/289492 "2021-11-17T18:10:15Z")
Using kubernetes module for my metricbeat config, deployed as DaemonSet. metricbeat.config.modules: # Mounted \`metricbeat-daemonset-modules\` configmap: path: ${path.config}/modules.yml # Reload module config… --- ## [Kibana kql suggestions not working](https://discuss.elastic.co/t/kibana-kql-suggestions-not-working/289240)
**Author:** [@Tingda\_Du](https://discuss.elastic.co/u/Tingda_Du)\ **Replies:** 10\ **Last updated:** [November 17, 2021, 10:32pm UTC](https://discuss.elastic.co/t/kibana-kql-suggestions-not-working/289240 "2021-11-17T22:32:35Z")
Do I need to configure anything to make kibana kql filtering suggestions working? --- ## [Machine Learning for Visualizations](https://discuss.elastic.co/t/machine-learning-for-visualizations/289393)
**Author:** [@pianist\_iris](https://discuss.elastic.co/u/pianist_iris)\ **Replies:** 3\ **Last updated:** [November 17, 2021, 8:43pm UTC](https://discuss.elastic.co/t/machine-learning-for-visualizations/289393 "2021-11-17T20:43:01Z")
We have multiple Kibana visualizations which are traffic volume graph or login count graph. Now we would like to utilize machine learning module to detect anomaly in those graphs. What would be the most efficient way t… --- ## [Understanding extremely slow rewrite\_time due to fuzziness](https://discuss.elastic.co/t/understanding-extremely-slow-rewrite-time-due-to-fuzziness/289502)
**Author:** [@blackmad](https://discuss.elastic.co/u/blackmad)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 7:47pm UTC](https://discuss.elastic.co/t/understanding-extremely-slow-rewrite-time-due-to-fuzziness/289502 "2021-11-17T19:47:00Z")
I'm managing a relatively large ES cluster and I'm struggling to understand why I'm seeing such large rewrite\_time on searches of more than a few tokens. For this nonsense query "djkh hjk hjk hjkh jhkj jhjk jkh jewrh" I… --- ## [Elasticsearch for social networking sites like instagram for user posts and likes,](https://discuss.elastic.co/t/elasticsearch-for-social-networking-sites-like-instagram-for-user-posts-and-likes/289496)
**Author:** [@MOHIT2710](https://discuss.elastic.co/u/MOHIT2710)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 6:53pm UTC](https://discuss.elastic.co/t/elasticsearch-for-social-networking-sites-like-instagram-for-user-posts-and-likes/289496 "2021-11-17T18:53:10Z")
Hi Elastic team, I need your suggestions for using Elasticsearch as a search engine for my application similar to instagram or fb. Use case::If user is searching for any word that could be any post title,username,chann… --- ## [Query with wildcard](https://discuss.elastic.co/t/query-with-wildcard/289372)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 6:47pm UTC](https://discuss.elastic.co/t/query-with-wildcard/289372 "2021-11-17T18:47:53Z")
I want to generate phrase queries with wildcard, but this query returns 0 result: "query": { "bool": { "must": \[ { "query\_string": { "query": "\\"user login authen\*\\"", … --- ## [TSVB ability to use tokens in panel filters that represent global time filter values to adjust viz based on global time selection](https://discuss.elastic.co/t/tsvb-ability-to-use-tokens-in-panel-filters-that-represent-global-time-filter-values-to-adjust-viz-based-on-global-time-selection/287841)
**Author:** [@catchsvix](https://discuss.elastic.co/u/catchsvix)\ **Replies:** 6\ **Last updated:** [November 17, 2021, 6:24pm UTC](https://discuss.elastic.co/t/tsvb-ability-to-use-tokens-in-panel-filters-that-represent-global-time-filter-values-to-adjust-viz-based-on-global-time-selection/287841 "2021-11-17T18:24:11Z")
Apologies if I'm not using the correct terminology for the kibana fields I'm referring to. I have a need to create a day-over-day (or WoW etc) comparison visualization for a given time range. I'm able to do it for a fi… --- ## [Watcher template for terms with no data](https://discuss.elastic.co/t/watcher-template-for-terms-with-no-data/289490)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 5:56pm UTC](https://discuss.elastic.co/t/watcher-template-for-terms-with-no-data/289490 "2021-11-17T17:56:38Z")
Hi, I would like a watcher alert (released as an email) that identifies vehicles with no data, for example: vehicles = \["abc", "def", "ghi"\] show vehicles with no data in past 7 days. I could count those that have occ… --- ## [?refresh or block on the Search API](https://discuss.elastic.co/t/refresh-or-block-on-the-search-api/289382)
**Author:** [@Bryji](https://discuss.elastic.co/u/Bryji)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 1:41am UTC](https://discuss.elastic.co/t/refresh-or-block-on-the-search-api/289382 "2021-11-17T01:41:22Z")
It would be nice if the Search API supported ?refresh like the Index/Update/Delete APIs, so that requests could block until a consistent result could be returned. Has this ever been discussed / proposed? Any other sugges… --- ## [SQL histogram returns unexpected offset](https://discuss.elastic.co/t/sql-histogram-returns-unexpected-offset/289187)
**Author:** [@HarmenB](https://discuss.elastic.co/u/HarmenB)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 5:42pm UTC](https://discuss.elastic.co/t/sql-histogram-returns-unexpected-offset/289187 "2021-11-17T17:42:22Z")
I'm trying to create a Histogram query using the SQL language. My goal is to get 3 buckets covering 30 days each. The following query does work but gives me an unexpected offset: POST \_sql?format=txt { "query": "SELE… --- ## [When using live reloading, why doesn't filebeat trigger live reloading immediately on first start?](https://discuss.elastic.co/t/when-using-live-reloading-why-doesnt-filebeat-trigger-live-reloading-immediately-on-first-start/289482)
**Author:** [@zhiyanglee](https://discuss.elastic.co/u/zhiyanglee)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 5:16pm UTC](https://discuss.elastic.co/t/when-using-live-reloading-why-doesnt-filebeat-trigger-live-reloading-immediately-on-first-start/289482 "2021-11-17T17:16:24Z")
In the example below, "reload.period" specifies that the file is checked for changes once every 30 seconds. however, the first time you start filebeat you still have to wait 30 seconds for the configuration file to load,… --- ## [Failed to start Elasticsearch.7.15.2](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-15-2/289361)
**Author:** [@tranha31](https://discuss.elastic.co/u/tranha31)\ **Replies:** 6\ **Last updated:** [November 17, 2021, 4:52pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-15-2/289361 "2021-11-17T16:52:57Z")
I want to start Elasticsearch v7.12.1. But it is not working. I don't know what is wrong. Someone help me, please!!!!!!!! elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.se… --- ## [Accessing index shard directories via pylucene](https://discuss.elastic.co/t/accessing-index-shard-directories-via-pylucene/289384)
**Author:** [@Ben\_Timby](https://discuss.elastic.co/u/Ben_Timby)\ **Replies:** 4\ **Last updated:** [November 17, 2021, 4:50pm UTC](https://discuss.elastic.co/t/accessing-index-shard-directories-via-pylucene/289384 "2021-11-17T16:50:36Z")
Hi, I have old index files from Elasticsearch 1.7.6. The version of lucene utilized is 4.10.4, I was able to get lucene to open a directory that represents one of the three shards of my index. I can pull the documents fr… --- ## [Delete by query?](https://discuss.elastic.co/t/delete-by-query/289472)
**Author:** [@Saliinger](https://discuss.elastic.co/u/Saliinger)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 4:27pm UTC](https://discuss.elastic.co/t/delete-by-query/289472 "2021-11-17T16:27:25Z")
Hello. :slight\_smile: I'm using delete\_by\_query to remove old data from all index. Looks like that: POST \*/\_delete\_by\_query { "query": { "bool": { "filter": \[ { "range": { "@t… --- ## [Dashboard TSVB panel item url ignores filter when linked to dashboard](https://discuss.elastic.co/t/dashboard-tsvb-panel-item-url-ignores-filter-when-linked-to-dashboard/289431)
**Author:** [@ella.danielsson](https://discuss.elastic.co/u/ella.danielsson)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 4:17pm UTC](https://discuss.elastic.co/t/dashboard-tsvb-panel-item-url-ignores-filter-when-linked-to-dashboard/289431 "2021-11-17T16:17:17Z")
Hi, I have linked the objects in a TSVB data table to another kibana dashboard via the item URL option. In the link I use the value of the data table as input to a query like: meta:(alias:!n,disabled:!f,index:'5beaebb… --- ## [Origin of Recursive Lookup Not Captured](https://discuss.elastic.co/t/origin-of-recursive-lookup-not-captured/289479)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 4:16pm UTC](https://discuss.elastic.co/t/origin-of-recursive-lookup-not-captured/289479 "2021-11-17T16:16:37Z")
I have packetbeat installed on my DNS server. The intent was to capture any DNS traffic from clients on my network. This is working well, I'm seeing client lookups being recorded. However, when my DNS server has to go… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1158) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1160)