# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1181

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1182

---

## [Fleet server Installation error](https://discuss.elastic.co/t/fleet-server-installation-error/287443)

<div class="topic-metadata">

**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\
**Replies:** 3\
**Last updated:** [October 29, 2021, 7:27pm UTC](https://discuss.elastic.co/t/fleet-server-installation-error/287443 "2021-10-29T19:27:00Z")

</div>

How do I trouble shoot this error? localhost:~/elastic-agent-7.15.0-linux-x86\_64 # sudo ./elastic-agent install --url=https://172.16.12.18:8220 \\ \> -f \\ \> --fleet-server-es=https://172.16.12.11:9200 \\ \> --fleet-serve…

---

## [Filebeat to rsyslog, it's possible?](https://discuss.elastic.co/t/filebeat-to-rsyslog-its-possible/288030)

<div class="topic-metadata">

**Author:** [@pi314](https://discuss.elastic.co/u/pi314)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 7:05pm UTC](https://discuss.elastic.co/t/filebeat-to-rsyslog-its-possible/288030 "2021-10-29T19:05:25Z")

</div>

I need to know if it is possible to send a log from filebeat to rsyslog, if possible, can you tell me how? Regards,

---

## [Logstash not able to start with multiple pipelines](https://discuss.elastic.co/t/logstash-not-able-to-start-with-multiple-pipelines/288029)

<div class="topic-metadata">

**Author:** [@dyadav](https://discuss.elastic.co/u/dyadav)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 6:04pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-start-with-multiple-pipelines/288029 "2021-10-29T18:04:28Z")

</div>

I have setup logstash on EKS in AWS. Now, I am trying to setup multiple pipelines in it but it is not able to pick up my pipeline or just picks the main pipeline. Below are my configurations: ConfigMap apiVersion: v1 …

---

## [Unable to view Reporting section in Kibana Privileges](https://discuss.elastic.co/t/unable-to-view-reporting-section-in-kibana-privileges/287932)

<div class="topic-metadata">

**Author:** [@nate\_d](https://discuss.elastic.co/u/nate_d)\
**Replies:** 3\
**Last updated:** [October 29, 2021, 4:56pm UTC](https://discuss.elastic.co/t/unable-to-view-reporting-section-in-kibana-privileges/287932 "2021-10-29T16:56:58Z")

</div>

I'm having an issue where I want to provide reporting access to a role. I followed the steps given here - Configure reporting in Kibana | Kibana Guide \[7.15\] | Elastic - which says to disable reporting roles But then I…

---

## [How can I use query\_string to match both nested and non-nested fields at the same time?](https://discuss.elastic.co/t/how-can-i-use-query-string-to-match-both-nested-and-non-nested-fields-at-the-same-time/288023)

<div class="topic-metadata">

**Author:** [@Max\_Carey](https://discuss.elastic.co/u/Max_Carey)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 4:43pm UTC](https://discuss.elastic.co/t/how-can-i-use-query-string-to-match-both-nested-and-non-nested-fields-at-the-same-time/288023 "2021-10-29T16:43:43Z")

</div>

I have an index with a mapping something like this: "email" : { "type" : "nested", "properties" : { "from" : { "type" : "text", "analyzer" : "lowercase\_keyword", "fielddata" : true }, "…

---

## [Version of elastic db and elastic API are different](https://discuss.elastic.co/t/version-of-elastic-db-and-elastic-api-are-different/288020)

<div class="topic-metadata">

**Author:** [@kathirnk2](https://discuss.elastic.co/u/kathirnk2)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 4:38pm UTC](https://discuss.elastic.co/t/version-of-elastic-db-and-elastic-api-are-different/288020 "2021-10-29T16:38:56Z")

</div>

We are using elastic db version 6.3.1. In our spring boot application also, we have put the elastic api version as 6.3.1 in our build.gradle file. We recently upgraded our spring boot version from 2.1 to 2.4 We remove…

---

## [Adding a synthetic field to documents generated by Transforms](https://discuss.elastic.co/t/adding-a-synthetic-field-to-documents-generated-by-transforms/288014)

<div class="topic-metadata">

**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 3:29pm UTC](https://discuss.elastic.co/t/adding-a-synthetic-field-to-documents-generated-by-transforms/288014 "2021-10-29T15:29:36Z")

</div>

Hello, I'm playing with Elastic Transforms (Create transform API | Elasticsearch Guide \[7.15\] | Elastic) I have questions about those: I've created a transform like this: PUT \_transform/transform\_test\_2s { "source"…

---

## [Bug when aggregating histogram fields](https://discuss.elastic.co/t/bug-when-aggregating-histogram-fields/288013)

<div class="topic-metadata">

**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 3:24pm UTC](https://discuss.elastic.co/t/bug-when-aggregating-histogram-fields/288013 "2021-10-29T15:24:43Z")

</div>

Hello, I encounter an issue with some particular values using histogram aggregations: Here's a reproducer: PUT test-index { "mappings" : { "properties" : { "my\_histogram" : { "type" : "histogram" …

---

## [Kafka-logstash-elastic disaster resistant](https://discuss.elastic.co/t/kafka-logstash-elastic-disaster-resistant/287994)

<div class="topic-metadata">

**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 2:45pm UTC](https://discuss.elastic.co/t/kafka-logstash-elastic-disaster-resistant/287994 "2021-10-29T14:45:47Z")

</div>

Hi! I am testing disaster resistant of pipeline kafka-\>logstash-\>elastic Logstash config input { kafka { bootstrap\_servers =\> "172.29.39.115:9093, 172.29.39.116:9093" topics =\> "test-test" #consumer\_thre…

---

## [Failed to parse a date field in Logstash](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008)

<div class="topic-metadata">

**Author:** [@dedi27](https://discuss.elastic.co/u/dedi27)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 2:36pm UTC](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008 "2021-10-29T14:36:00Z")

</div>

Fail to parse a date field in Logstash Hello, I'm trying to parse a date field from a log file coming from an Exim Mail Server where I have a date string like this "2021-10-28 15:44:40". In my filter in Logstash, firs…

---

## [Logstash performance and jdbc\_streaming](https://discuss.elastic.co/t/logstash-performance-and-jdbc-streaming/288009)

<div class="topic-metadata">

**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 2:00pm UTC](https://discuss.elastic.co/t/logstash-performance-and-jdbc-streaming/288009 "2021-10-29T14:00:16Z")

</div>

Hi all, i'm using in this days Logstash (I love logstash if I could I would use it to make coffee too :upside\_down\_face: ), like an ETL get the data from mysql transform it enriching the data with multiple jdbc\_stream…

---

## [Kibana date format mapping](https://discuss.elastic.co/t/kibana-date-format-mapping/287597)

<div class="topic-metadata">

**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Replies:** 5\
**Last updated:** [October 29, 2021, 1:58pm UTC](https://discuss.elastic.co/t/kibana-date-format-mapping/287597 "2021-10-29T13:58:54Z")

</div>

Hi, I'm trying to configure a template inside Kibana for a date field but I don't see a date format that matches it. My date field looks like this: 2021-05-05 09:38:47 +0000 UTC If I map the date field as "text" insid…

---

## [Elastic Search Aggregations Slow](https://discuss.elastic.co/t/elastic-search-aggregations-slow/286701)

<div class="topic-metadata">

**Author:** [@Srini12](https://discuss.elastic.co/u/Srini12)\
**Replies:** 20\
**Last updated:** [October 29, 2021, 1:55pm UTC](https://discuss.elastic.co/t/elastic-search-aggregations-slow/286701 "2021-10-29T13:55:16Z")

</div>

Good day I have an Elasticsearch index with 50 million records in it. This is working as expected. If I add aggregations to my query it is taking quite a long time to get the results. Any advise ? Thanks in advance. K…

---

## [Transform API update documents already inserted](https://discuss.elastic.co/t/transform-api-update-documents-already-inserted/288006)

<div class="topic-metadata">

**Author:** [@marone](https://discuss.elastic.co/u/marone)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 1:40pm UTC](https://discuss.elastic.co/t/transform-api-update-documents-already-inserted/288006 "2021-10-29T13:40:56Z")

</div>

Hey I am facing a big issue as we are going to production using Transform API. What we are facing is the aggregation calculated with a transform API are updated once a term aggregation already exist in the destination in…

---

## [How to boost results on the basis of fields values](https://discuss.elastic.co/t/how-to-boost-results-on-the-basis-of-fields-values/287826)

<div class="topic-metadata">

**Author:** [@Ashutosh\_Dwivedi](https://discuss.elastic.co/u/Ashutosh_Dwivedi)\
**Replies:** 7\
**Last updated:** [October 29, 2021, 1:10pm UTC](https://discuss.elastic.co/t/how-to-boost-results-on-the-basis-of-fields-values/287826 "2021-10-29T13:10:12Z")

</div>

Hi Everyone, I have stuck into creating query for a specific problem. Can anyone please help me ? I have these list of products \[ { "name":"pro", "clickCount":110, "bookingCount":57, "isPromoted":0 }, { "na…

---

## [Distance\_feature and optimal pagination?](https://discuss.elastic.co/t/distance-feature-and-optimal-pagination/287949)

<div class="topic-metadata">

**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\
**Replies:** 0\
**Last updated:** [October 28, 2021, 5:44pm UTC](https://discuss.elastic.co/t/distance-feature-and-optimal-pagination/287949 "2021-10-28T17:44:52Z")

</div>

I want to implement pagination over a search query that uses the distance\_feature using location and time and implement pagination. Now because each request is unique in terms of it's location and time the sorting will …

---

## [Store time lapsed between two events](https://discuss.elastic.co/t/store-time-lapsed-between-two-events/287991)

<div class="topic-metadata">

**Author:** [@Frederick\_Faria](https://discuss.elastic.co/u/Frederick_Faria)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 12:15pm UTC](https://discuss.elastic.co/t/store-time-lapsed-between-two-events/287991 "2021-10-29T12:15:24Z")

</div>

I need to store a time duration two events and have as in HH:mm:ss.SSS. I tried using Date type with basic\_time format but it do now allows me to save more than 23 hours. How would you recommend to proceed in this case? …

---

## [Multi\_match to return exact results for single word criteria](https://discuss.elastic.co/t/multi-match-to-return-exact-results-for-single-word-criteria/287995)

<div class="topic-metadata">

**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 11:59am UTC](https://discuss.elastic.co/t/multi-match-to-return-exact-results-for-single-word-criteria/287995 "2021-10-29T11:59:36Z")

</div>

Hello, have simple use-case: find certain word in any field of a document (through whole index). However, getting back (many!) false positive documents, also? Documents don't contain the word submitted in multi\_match cr…

---

## [Bulk Upsert isn't Importing All Records](https://discuss.elastic.co/t/bulk-upsert-isnt-importing-all-records/287011)

<div class="topic-metadata">

**Author:** [@selectedpixel](https://discuss.elastic.co/u/selectedpixel)\
**Replies:** 3\
**Last updated:** [October 29, 2021, 11:44am UTC](https://discuss.elastic.co/t/bulk-upsert-isnt-importing-all-records/287011 "2021-10-29T11:44:17Z")

</div>

I'm doing a bulk upsert using the Elasticsearch NodeJS library Helper classes. const response = await ELSClient.helpers.bulk({ concurrency: 20, datasource: data, onDocument (doc) { return \[{ up…

---

## [Aggregate filter plugin - timeout function bug](https://discuss.elastic.co/t/aggregate-filter-plugin-timeout-function-bug/286383)

<div class="topic-metadata">

**Author:** [@MarcelOs](https://discuss.elastic.co/u/MarcelOs)\
**Replies:** 6\
**Last updated:** [October 29, 2021, 7:22am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-timeout-function-bug/286383 "2021-10-29T07:22:44Z")

</div>

Hello everyone, I have some problems with the Timeout command from the aggregate filter plugin. I want to create a script that calculates the meantime between two log entries. There are examples of such a function (http…

---

## [Java OutOfMemory when synchronizing initially huge resultsets from Oracle via logstash jdbc to Elastic](https://discuss.elastic.co/t/java-outofmemory-when-synchronizing-initially-huge-resultsets-from-oracle-via-logstash-jdbc-to-elastic/287984)

<div class="topic-metadata">

**Author:** [@di.loh](https://discuss.elastic.co/u/di.loh)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 9:40am UTC](https://discuss.elastic.co/t/java-outofmemory-when-synchronizing-initially-huge-resultsets-from-oracle-via-logstash-jdbc-to-elastic/287984 "2021-10-29T09:40:54Z")

</div>

We are getting Java OutOfMemory during initial loading a huge dataset of ~70 Mio records with Logstash and jdbc into Elastic. It seems, the problem starts when using use\_prepared\_statements =\> true. Java Heapsize is 4GB…

---

## [Failed to initialize SSL TrustManager](https://discuss.elastic.co/t/failed-to-initialize-ssl-trustmanager/287667)

<div class="topic-metadata">

**Author:** [@porscheme](https://discuss.elastic.co/u/porscheme)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/failed-to-initialize-ssl-trustmanager/287667 "2021-10-29T09:52:48Z")

</div>

ES Version 7.12 AKS: 1:20.7 Certificate passwords added elastic keystore and value verified xpack.security.transport.ssl.keystore.secure\_password xpack.security.transport.ssl.truststore.secure\_password xpack settings …

---

## [CircuitBreakingException (Heap size issue)](https://discuss.elastic.co/t/circuitbreakingexception-heap-size-issue/287985)

<div class="topic-metadata">

**Author:** [@Balaji\_Arun](https://discuss.elastic.co/u/Balaji_Arun)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 9:43am UTC](https://discuss.elastic.co/t/circuitbreakingexception-heap-size-issue/287985 "2021-10-29T09:43:10Z")

</div>

Hi everyone, I'm facing a issue with heap size don't know how to increase it tried changing the env var in the kube config (using Kubernetes for deployment ) but it struck at applying changes phase thanks in advance …

---

## [JDBC Logstash with SystemD](https://discuss.elastic.co/t/jdbc-logstash-with-systemd/287979)

<div class="topic-metadata">

**Author:** [@sastorsl](https://discuss.elastic.co/u/sastorsl)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 8:52am UTC](https://discuss.elastic.co/t/jdbc-logstash-with-systemd/287979 "2021-10-29T08:52:35Z")

</div>

Setup logstash jdbc-input, and wanted to use the default Oracle TNS Names lookup instead of storing the JDBC connect string directly in the logstash configuration. Basically the JDBC connect string can be very long, and…

---

## [How to scale up the cache file size when we scale up the disk size?](https://discuss.elastic.co/t/how-to-scale-up-the-cache-file-size-when-we-scale-up-the-disk-size/287747)

<div class="topic-metadata">

**Author:** [@gaobinlong](https://discuss.elastic.co/u/gaobinlong)\
**Replies:** 5\
**Last updated:** [October 29, 2021, 8:40am UTC](https://discuss.elastic.co/t/how-to-scale-up-the-cache-file-size-when-we-scale-up-the-disk-size/287747 "2021-10-29T08:40:09Z")

</div>

Our es clusters are deployed in cloud, and the cloud disk is very easy to scale up it's size. We found that the size of the local cache file shared\_snapshot\_cache on the dedicated frozen node didn't change when we scale…

---

## [Not able to generate fields.yml files](https://discuss.elastic.co/t/not-able-to-generate-fields-yml-files/287970)

<div class="topic-metadata">

**Author:** [@Paurav\_Thakkar](https://discuss.elastic.co/u/Paurav_Thakkar)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 5:32am UTC](https://discuss.elastic.co/t/not-able-to-generate-fields-yml-files/287970 "2021-10-29T05:32:16Z")

</div>

Hi, I am trying to create a new custom module and I have created a input file that is taking input from an api in json format and in the pipeline.json file I have added the processors that I think are necessary. But when…

---

## [Elasticsearch CPU utilization problem with Logstash](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-problem-with-logstash/287903)

<div class="topic-metadata">

**Author:** [@Hur](https://discuss.elastic.co/u/Hur)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 2:34am UTC](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-problem-with-logstash/287903 "2021-10-29T02:34:19Z")

</div>

I have trouble with using Elasticsearch with Logstash. When inserting data to ES through Logstash (not using Filebeat. Elasticsearch & Logstash only), CPU utilization of ES is over 90%. Also, I expected if I use multip…

---

## [Geo Coordinate Mapping](https://discuss.elastic.co/t/geo-coordinate-mapping/287956)

<div class="topic-metadata">

**Author:** [@workenehg](https://discuss.elastic.co/u/workenehg)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 1:02am UTC](https://discuss.elastic.co/t/geo-coordinate-mapping/287956 "2021-10-29T01:02:41Z")

</div>

Currently in the process of indexing data from Oracle and one of the properties is a "Coordinate" . we would like to be able to do a geo search on the field but since it is currently added as "long" as shown below , we …

---

## [Kibana log](https://discuss.elastic.co/t/kibana-log/287896)

<div class="topic-metadata">

**Author:** [@li\_li](https://discuss.elastic.co/u/li_li)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 12:35am UTC](https://discuss.elastic.co/t/kibana-log/287896 "2021-10-29T00:35:18Z")

</div>

Hello, I am new to Kibana. I would like to know how long this log can be stored and what is the maximum capacity of the Kibana container?

---

## [Elasticsearch slowness and frequently nodes are restarting](https://discuss.elastic.co/t/elasticsearch-slowness-and-frequently-nodes-are-restarting/287909)

<div class="topic-metadata">

**Author:** [@muralikri](https://discuss.elastic.co/u/muralikri)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 12:34am UTC](https://discuss.elastic.co/t/elasticsearch-slowness-and-frequently-nodes-are-restarting/287909 "2021-10-29T00:34:57Z")

</div>

Hi Team, We have recently upgraded Elasticsearch from 6.6.1 to 7.13.2 with platinum licence. After upgraded all looks fine and when 3-4 users try to search logs parallelly we getting 504 error and when i check cluster s…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1180)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1182)
