# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1171 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1172 --- ## [Elasticsearch filter in logstash = random results](https://discuss.elastic.co/t/elasticsearch-filter-in-logstash-random-results/288718)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-filter-in-logstash-random-results/288718 "2021-11-09T07:52:23Z")
Hi, I'm using Elasticsearch filter plugin in logstash to enrich records and calculate time difference between two events from different logs. It works, but randomly - it returns search results for some records, but not … --- ## [Log on workstation hostname](https://discuss.elastic.co/t/log-on-workstation-hostname/288652)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:46am UTC](https://discuss.elastic.co/t/log-on-workstation-hostname/288652 "2021-11-09T07:46:23Z")
I am using ELK 7.12.1 mainly to log AD events at the minute. I have had a device go missing and I want to track down the last time it was logged on. I have been using user.name.text to locate user logons but I don't thin… --- ## [ML: difference between partition\_field\_name and by\_field\_name in a population job?](https://discuss.elastic.co/t/ml-difference-between-partition-field-name-and-by-field-name-in-a-population-job/287792)
**Author:** [@shabnam](https://discuss.elastic.co/u/shabnam)\ **Replies:** 8\ **Last updated:** [November 9, 2021, 7:29am UTC](https://discuss.elastic.co/t/ml-difference-between-partition-field-name-and-by-field-name-in-a-population-job/287792 "2021-11-09T07:29:35Z")
Hi, I want to know the difference of this two ml advance jobs: a. func(x), by\_field(y), over\_field(z), partition\_field(-) b. func(x), by\_field(-), over\_field(z), partition\_field(y) , two tests performed: I created… --- ## [Likely root cause: ElasticsearchSecurityException\[Cannot find metadata for entity http://xxx.xxx.xx\]](https://discuss.elastic.co/t/likely-root-cause-elasticsearchsecurityexception-cannot-find-metadata-for-entity-http-xxx-xxx-xx/288639)
**Author:** [@slashlinux](https://discuss.elastic.co/u/slashlinux)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:13am UTC](https://discuss.elastic.co/t/likely-root-cause-elasticsearchsecurityexception-cannot-find-metadata-for-entity-http-xxx-xxx-xx/288639 "2021-11-09T07:13:45Z")
Hello, I'm trying to integrate ELK with Keycloak and I've encountered some problems, I'm not expert on elk side so I did some configuration on Kibana/Elasticsearch YML: Elasticsearch.yml xpack.security.enabled: true x… --- ## [Space saving for index=false](https://discuss.elastic.co/t/space-saving-for-index-false/288184)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 5\ **Last updated:** [November 9, 2021, 6:14am UTC](https://discuss.elastic.co/t/space-saving-for-index-false/288184 "2021-11-09T06:14:40Z")
Hi I have an index that is 300gb in size with all 30 fields index=true. I tried setting 15 of the fields with index=false on another index and did a reindexing to compare the size. The end result is that there seems to… --- ## [Python Elasticsearch : Index mapping inconsistencies between 'es.index' and 'es.indices.create'](https://discuss.elastic.co/t/python-elasticsearch-index-mapping-inconsistencies-between-es-index-and-es-indices-create/288584)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 5\ **Last updated:** [November 9, 2021, 5:31am UTC](https://discuss.elastic.co/t/python-elasticsearch-index-mapping-inconsistencies-between-es-index-and-es-indices-create/288584 "2021-11-09T05:31:57Z")
I'm trying to implement a custom index mapping (my\_mapping) in Python, BUT, I do not get the expected index mapping after the python file is run! file.py ---------- my\_mapping = """ { "settings": { "number\_… --- ## [Running cold tier on NFS storage](https://discuss.elastic.co/t/running-cold-tier-on-nfs-storage/288707)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 4:51am UTC](https://discuss.elastic.co/t/running-cold-tier-on-nfs-storage/288707 "2021-11-09T04:51:48Z")
Hi, I understand that NFS storage should be avoided. However, my task was to write fresh data into HOT SSD and potential spill to WARM spin disk. The NFS storage will be used as COLD tier with very minimal write. Does … --- ## [Filebeat running but now showing iis logs in elasticsearch](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 5\ **Last updated:** [November 9, 2021, 4:02am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701 "2021-11-09T04:02:49Z")
filebeat and elasticsearch running but now showing iis logs in in browser url http://172.xx.x.xxx:9200/filebeat-\*/\_count?pretty below is my config files { "count" : 0, "\_shards" : { "total" : 0, "successful" : 0, … --- ## [How to manage large messages with a few memory?](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677)
**Author:** [@Jesus\_Alberto\_Carril](https://discuss.elastic.co/u/Jesus_Alberto_Carril)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 3:55am UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677 "2021-11-09T03:55:17Z")
I have a problem. My JVM logstash only has 512M in it configurations: -Xms256m -Xmx512m Logstash read messages from mylog.json and send them to my broker. BUT when a super large message is written in my mylog.json the… --- ## [Esrally will hang if I use elasticsearch 8.0.0-alpha1](https://discuss.elastic.co/t/esrally-will-hang-if-i-use-elasticsearch-8-0-0-alpha1/288082)
**Author:** [@shankang](https://discuss.elastic.co/u/shankang)\ **Replies:** 11\ **Last updated:** [November 9, 2021, 3:39am UTC](https://discuss.elastic.co/t/esrally-will-hang-if-i-use-elasticsearch-8-0-0-alpha1/288082 "2021-11-09T03:39:10Z")
Hi, My OS is Ubuntu 21.04. esrally will hang when I tried the following command. esrally --pipeline=from-distribution --distribution-version=8.0.0-alpha1 --track=geonames --challenge=append-no-conflicts --include-tasks… --- ## [JVM setting](https://discuss.elastic.co/t/jvm-setting/287954)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 5\ **Last updated:** [November 9, 2021, 1:49am UTC](https://discuss.elastic.co/t/jvm-setting/287954 "2021-11-09T01:49:56Z")
What should be prefer jvm option for cluster? using elasicsearch java three node x 100gig ram each, 20core each host -Xms24g -Xmx24g -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 or follo… --- ## [Catenate\_numbers - way to avoid joining on space and comma?](https://discuss.elastic.co/t/catenate-numbers-way-to-avoid-joining-on-space-and-comma/288690)
**Author:** [@fcntl](https://discuss.elastic.co/u/fcntl)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 1:19am UTC](https://discuss.elastic.co/t/catenate-numbers-way-to-avoid-joining-on-space-and-comma/288690 "2021-11-09T01:19:24Z")
catenate\_numbers is useful for joining numbers separated by hyphen, as it allows a non-segmented search term to match against segmented numbers in the document, e.g. Document: 02 6287-1455 Search term: 0262871455 (wil… --- ## [Increased latency with query cache](https://discuss.elastic.co/t/increased-latency-with-query-cache/288619)
**Author:** [@Ain\_Ryushika](https://discuss.elastic.co/u/Ain_Ryushika)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 12:34am UTC](https://discuss.elastic.co/t/increased-latency-with-query-cache/288619 "2021-11-09T00:34:59Z")
Cluster stats: Version: OpenDistro 6.8.17 Elasticsearch: 6 data nodes, 202 primary shards, 412 total shards CPU model: Intel(R) Xeon(R) Gold 6248 CPU @ 2.50GHz CPU total logical cores: 8 Memory : 32GB (16gb heap) H… --- ## [\[ES 2.4\] cluster ignores docker-compose variables](https://discuss.elastic.co/t/es-2-4-cluster-ignores-docker-compose-variables/288530)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 6\ **Last updated:** [November 8, 2021, 11:44pm UTC](https://discuss.elastic.co/t/es-2-4-cluster-ignores-docker-compose-variables/288530 "2021-11-08T23:44:45Z")
Hey there, Is it possible to set environment variables using docker-compose on Elasticsearch 2.4.4? I am trying to set cluster-name with classic method environment: - cluster-name=test but the cluster is ignoring … --- ## [How to load dashboard when Kibana starts](https://discuss.elastic.co/t/how-to-load-dashboard-when-kibana-starts/288596)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 11:31pm UTC](https://discuss.elastic.co/t/how-to-load-dashboard-when-kibana-starts/288596 "2021-11-08T23:31:43Z")
Hi team, Please help me on this. I want to load some dashboard when Kibana starts. I have created a dashboard, but I want to provide the dashboard along with build. I'm not supposed to touch the Kibana. Elastic mappin… --- ## [OIDC SocketTimeoutException](https://discuss.elastic.co/t/oidc-sockettimeoutexception/288685)
**Author:** [@ibrooes](https://discuss.elastic.co/u/ibrooes)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 11:18pm UTC](https://discuss.elastic.co/t/oidc-sockettimeoutexception/288685 "2021-11-08T23:18:54Z")
Getting this error message in logs. Does anyone have an idea what could this be indicating? I have checked my token endpoint through postman, and it works. \[instance-0000000001\] Authentication to realm oidc1 failed - F… --- ## [ARM64 builds for Elasticsearch 5.6?](https://discuss.elastic.co/t/arm64-builds-for-elasticsearch-5-6/288665)
**Author:** [@cjbottaro](https://discuss.elastic.co/u/cjbottaro)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 10:58pm UTC](https://discuss.elastic.co/t/arm64-builds-for-elasticsearch-5-6/288665 "2021-11-08T22:58:49Z")
We are unfortunately stuck on Es5 for the foreseeable future... and I just got a new M1 MacBook. Neither of these commands work. docker run --rm --platform linux/amd64 elasticsearch:5.6.16 docker run --rm --platform li… --- ## [Daylight saving time impacting only part of the environment](https://discuss.elastic.co/t/daylight-saving-time-impacting-only-part-of-the-environment/288622)
**Author:** [@phdsantos](https://discuss.elastic.co/u/phdsantos)\ **Replies:** 5\ **Last updated:** [November 8, 2021, 9:03pm UTC](https://discuss.elastic.co/t/daylight-saving-time-impacting-only-part-of-the-environment/288622 "2021-11-08T21:03:14Z")
Hello everyone, we are facing a strange behavior in ELK environment related to daylight saving time; the details are below: Platform: kibana 6.7.2 Logstash 5.3.0 Elasticsearch 6.7.2 Scenario: We have Weblogic domai… --- ## [The data table in the dashboard does not support click sorting](https://discuss.elastic.co/t/the-data-table-in-the-dashboard-does-not-support-click-sorting/288479)
**Author:** [@Pad0y](https://discuss.elastic.co/u/Pad0y)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 8:51pm UTC](https://discuss.elastic.co/t/the-data-table-in-the-dashboard-does-not-support-click-sorting/288479 "2021-11-08T20:51:06Z")
In kibana 7.x, the dashboard cannot be sorted by clicking on the table header --- ## [Group by latest Plus Aggregation for Analysis or Delete old records](https://discuss.elastic.co/t/group-by-latest-plus-aggregation-for-analysis-or-delete-old-records/288663)
**Author:** [@Ahmed\_Mousa](https://discuss.elastic.co/u/Ahmed_Mousa)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 6:03pm UTC](https://discuss.elastic.co/t/group-by-latest-plus-aggregation-for-analysis-or-delete-old-records/288663 "2021-11-08T18:03:39Z")
Hello everyone, I am trying to get statistics from my elastic on some filters. I managed to get some using this: GET \/\_search { "query": { "bool": {"must":\[ {"terms":{"type.keyword":\[ "video", "tex… --- ## [Python Client : Receive illegal\_argument\_exception error when trying to create an index template](https://discuss.elastic.co/t/python-client-receive-illegal-argument-exception-error-when-trying-to-create-an-index-template/288457)
**Author:** [@MKH](https://discuss.elastic.co/u/MKH)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 5:55pm UTC](https://discuss.elastic.co/t/python-client-receive-illegal-argument-exception-error-when-trying-to-create-an-index-template/288457 "2021-11-08T17:55:15Z")
Hi, I am trying to create an index template to use it for my data stream. I use this command to create the template: es = client.Elasticsearch(\['\_host\_name'\], http\_auth=('user', 'psw'), port=\_port, scheme='https', tim… --- ## [Elasticsearch cardinality aggregation not returning accurate numbers despite using precision\_threshold](https://discuss.elastic.co/t/elasticsearch-cardinality-aggregation-not-returning-accurate-numbers-despite-using-precision-threshold/288632)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 5:10pm UTC](https://discuss.elastic.co/t/elasticsearch-cardinality-aggregation-not-returning-accurate-numbers-despite-using-precision-threshold/288632 "2021-11-08T17:10:15Z")
Hi folks, I am trying to show unique count in a metric and observed that the numbers are wrong. Setup: I ​used enhanced table visualisation and did a "unique count" of keyword type field. in advanced setting I used {"… --- ## [Multiple data sources over same port](https://discuss.elastic.co/t/multiple-data-sources-over-same-port/288598)
**Author:** [@IsaacKr](https://discuss.elastic.co/u/IsaacKr)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 5:05pm UTC](https://discuss.elastic.co/t/multiple-data-sources-over-same-port/288598 "2021-11-08T17:05:31Z")
We are ingesting data from multiple data sources over port 514 and using Logstash to ship them out to multiple destinations. Is there a way to tag ingested data based on source IP so that it can be forwarded to the corre… --- ## [Is it possible to ignore documents that exceeds index.mapping.nested\_objects.limit](https://discuss.elastic.co/t/is-it-possible-to-ignore-documents-that-exceeds-index-mapping-nested-objects-limit/288538)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 4:43pm UTC](https://discuss.elastic.co/t/is-it-possible-to-ignore-documents-that-exceeds-index-mapping-nested-objects-limit/288538 "2021-11-08T16:43:27Z")
Hi, we have a transform that writes into a destination index, that includes a nested field. the transform failed because of the index.mapping.nested\_objects.limit. is there a way to ignore/processing/writing/updating … --- ## [Transform and Aggregate Index with an Index Rate of 200k/s](https://discuss.elastic.co/t/transform-and-aggregate-index-with-an-index-rate-of-200k-s/288286)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 4:39pm UTC](https://discuss.elastic.co/t/transform-and-aggregate-index-with-an-index-rate-of-200k-s/288286 "2021-11-08T16:39:23Z")
We are thinking about gathering our DNS traffic via packetbeat and create statistics out of the collected data. Currently we have a query rate of about 200k/s and growing... Because of the tremendous amount of data, we w… --- ## [What are the "Elastic security features" that are referred to in the \_cat/indices doc page?](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578)
**Author:** [@astanton1978](https://discuss.elastic.co/u/astanton1978)\ **Replies:** 6\ **Last updated:** [November 8, 2021, 4:27pm UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578 "2021-11-08T16:27:42Z")
cat indices API | Elasticsearch Guide \[8.11\] | Elastic says If the Elasticsearch security features are enabled, you must have the monitor or manage cluster privilege to use this API. ... but there is no link to what… --- ## [Waiting for a quote (Gold license Elastic Stack on Kubernetes)](https://discuss.elastic.co/t/waiting-for-a-quote-gold-license-elastic-stack-on-kubernetes/288631)
**Author:** [@WookWook](https://discuss.elastic.co/u/WookWook)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 3:59pm UTC](https://discuss.elastic.co/t/waiting-for-a-quote-gold-license-elastic-stack-on-kubernetes/288631 "2021-11-08T15:59:43Z")
Hello there, me and my company are waiting for a quote for many weeks now. We have a self managed Elastic Cloud on Kubernetes cluster running. Want to buy a gold license for a 3 node environment. I started here Offizie… --- ## [Jdbc\_streming and prepared statement](https://discuss.elastic.co/t/jdbc-streming-and-prepared-statement/288647)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 2:56pm UTC](https://discuss.elastic.co/t/jdbc-streming-and-prepared-statement/288647 "2021-11-08T14:56:21Z")
Hi , I'm trying to use a prepared statement in jdbc\_streaming filter, I setuped the prepared statement on mySql instance using this commands: PREPARE lookup\_persone FROM 'SELECT persone.id, persone.nome AS nome\_person… --- ## [TSL configuration](https://discuss.elastic.co/t/tsl-configuration/288548)
**Author:** [@SabriMahmoud](https://discuss.elastic.co/u/SabriMahmoud)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 3:06pm UTC](https://discuss.elastic.co/t/tsl-configuration/288548 "2021-11-08T15:06:54Z")
Note : My version of Elasticsearch is 7.15.0 I'm new to Elasticsearch , I'm trying to use Kibana alerts , to do that I must create a Rule and a Connector but when I've selected that field I've been got informed to en… --- ## [Kibana server not ready yet](https://discuss.elastic.co/t/kibana-server-not-ready-yet/288560)
**Author:** [@dat\_nguyen](https://discuss.elastic.co/u/dat_nguyen)\ **Replies:** 17\ **Last updated:** [November 8, 2021, 2:57pm UTC](https://discuss.elastic.co/t/kibana-server-not-ready-yet/288560 "2021-11-08T14:57:02Z")
Dear everyone, Could you please help me solve a problem "kibana server not ready yet" although Elasticsearch and kibana service is running. Attached is the kibana log file. Thank you so much for your help [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1170) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1172)