# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1195 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1196 --- ## [Last value of each interface in the match phrase query](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 1:49am UTC](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135 "2021-10-20T01:49:18Z")
Hi, How can I get the last value of each interface in the match phrase query? I have tried with max timestamp, but I get a time out error GET /metrics-inf-\*/\_search { "query": { "bool": { "filter": \[ … --- ## [How to aggregate log transactions based on field value in logstash](https://discuss.elastic.co/t/how-to-aggregate-log-transactions-based-on-field-value-in-logstash/287134)
**Author:** [@venkataraman](https://discuss.elastic.co/u/venkataraman)\ **Replies:** 1\ **Last updated:** [October 20, 2021, 1:40am UTC](https://discuss.elastic.co/t/how-to-aggregate-log-transactions-based-on-field-value-in-logstash/287134 "2021-10-20T01:40:20Z")
My log file looks like this: start time: 2021-10-11T13:54:34Z category: commercial status: started end time: start time: 2021-10-11T13:54:34Z category: commercial status: Running end time: start time: 2021-10-11T… --- ## [Importing .evtx files to ELK using WinLogBeat](https://discuss.elastic.co/t/importing-evtx-files-to-elk-using-winlogbeat/287141)
**Author:** [@ThePurple5merf](https://discuss.elastic.co/u/ThePurple5merf)\ **Replies:** 1\ **Last updated:** [October 20, 2021, 12:15am UTC](https://discuss.elastic.co/t/importing-evtx-files-to-elk-using-winlogbeat/287141 "2021-10-20T00:15:02Z")
I'm trying to upload a set of .evtx files to my ELK Stack environment using WinLogBeat. I haven't been able to find any online resources that really help me out in doing this. I was hoping someone here could help point m… --- ## [Cross Cluster Replication Issue](https://discuss.elastic.co/t/cross-cluster-replication-issue/286943)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 11\ **Last updated:** [October 19, 2021, 10:28pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-issue/286943 "2021-10-19T22:28:45Z")
We are using Elasticsearch open source 7.13. We are trying to perform Cross Cluster Replication. We followed below steps. Created Index (Leader Index) on Cluster 1. Created cluster 1 as a remote cluster for cluster 2 … --- ## [Aggregate nested arrays](https://discuss.elastic.co/t/aggregate-nested-arrays/285934)
**Author:** [@Lyes\_Ouchene](https://discuss.elastic.co/u/Lyes_Ouchene)\ **Replies:** 6\ **Last updated:** [October 19, 2021, 9:17pm UTC](https://discuss.elastic.co/t/aggregate-nested-arrays/285934 "2021-10-19T21:17:33Z")
Hello everyone i am new to Elasticsearch, i need help with a use case, I want to create an array inside an array using the aggregate option The desired result is to have a list of services, for each service there will… --- ## [Looking for the best way to manage a somewhat "hot" and "warm" environment for indices](https://discuss.elastic.co/t/looking-for-the-best-way-to-manage-a-somewhat-hot-and-warm-environment-for-indices/287124)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 9:11pm UTC](https://discuss.elastic.co/t/looking-for-the-best-way-to-manage-a-somewhat-hot-and-warm-environment-for-indices/287124 "2021-10-19T21:11:49Z")
Hello, First, thank you for your patience while I attempt to illustrate my issue. I hope I'm being coherent enough. I am using Apache NiFi to route data into Elasticsearch. Data being ingested into Elasticsearch has … --- ## [Question on Vega "Zoomable Scatter Plot Example"](https://discuss.elastic.co/t/question-on-vega-zoomable-scatter-plot-example/287033)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 9:10pm UTC](https://discuss.elastic.co/t/question-on-vega-zoomable-scatter-plot-example/287033 "2021-10-19T21:10:15Z")
Hello All, I was looking at this example to try to understand how to make my visualization zoomable and panable and in doing that when I try to work with the example in my instance it complains about "xext" and I can't … --- ## [Copy as cURL is gray out](https://discuss.elastic.co/t/copy-as-curl-is-gray-out/287028)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 12\ **Last updated:** [October 19, 2021, 8:28pm UTC](https://discuss.elastic.co/t/copy-as-curl-is-gray-out/287028 "2021-10-19T20:28:09Z")
I upgraded to 7.15 and I can't use copy as cURL in kabana How do I get that back.. using Google chrome as browser if it helps It was working fine on 7.12 --- ## [Dynamic input (file hashes) for HTTP JSON data collection](https://discuss.elastic.co/t/dynamic-input-file-hashes-for-http-json-data-collection/287016)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 5\ **Last updated:** [October 19, 2021, 7:20pm UTC](https://discuss.elastic.co/t/dynamic-input-file-hashes-for-http-json-data-collection/287016 "2021-10-19T19:20:47Z")
Hello, I hope you and your loved ones are safe and healthy. I want to ingest data from an API endpoint that uses JSON for both request and response. (https://developers.virustotal.com/reference) I am aware that filebe… --- ## [Received plaintext http traffic on an https channel](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel/286987)
**Author:** [@armughan](https://discuss.elastic.co/u/armughan)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 6:54pm UTC](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel/286987 "2021-10-19T18:54:24Z")
I'm configuring a single node Elasticsearch & Kibana (7.15.1) set up with FQDN behind Nginx Proxy on a single EC2 instance. Everything is correctly set up when I tried to turn on Alerts in heartbeat (Observability) it s… --- ## [Packetbeat Missing fields in tls protocol](https://discuss.elastic.co/t/packetbeat-missing-fields-in-tls-protocol/285598)
**Author:** [@franpom](https://discuss.elastic.co/u/franpom)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 6:46pm UTC](https://discuss.elastic.co/t/packetbeat-missing-fields-in-tls-protocol/285598 "2021-10-19T18:46:02Z")
Hello, everyone, In the fields that packetbeat 7.15.0 captures on the tls protocol, at least the random and ocsp fields are missing Is it possible to add the fields: Handshake Protocol Random Handshake Protocol Exten… --- ## [How to use watcher to send the alert using teams connector](https://discuss.elastic.co/t/how-to-use-watcher-to-send-the-alert-using-teams-connector/286771)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 6\ **Last updated:** [October 19, 2021, 6:19pm UTC](https://discuss.elastic.co/t/how-to-use-watcher-to-send-the-alert-using-teams-connector/286771 "2021-10-19T18:19:29Z")
Hello, I have a watcher which is working as expected if I use the email action in it. I need to know how can I use that watcher to send the alerts using the teams connector that I created in alerts and actions tab. Tha… --- ## [POST api using watcher](https://discuss.elastic.co/t/post-api-using-watcher/286803)
**Author:** [@vicky\_rock](https://discuss.elastic.co/u/vicky_rock)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 6:07pm UTC](https://discuss.elastic.co/t/post-api-using-watcher/286803 "2021-10-19T18:07:24Z")
Hi Experts, I am using 7.9.3 Elasticsearch with searchguard authentication. I want to create a index daily with POST. I want to schedule this POST api . Is any chance to fo that. And I am new for this so please send m… --- ## [Translate error not working](https://discuss.elastic.co/t/translate-error-not-working/287118)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 5:22pm UTC](https://discuss.elastic.co/t/translate-error-not-working/287118 "2021-10-19T17:22:43Z")
Hello .. i am trying to use translate filter in my logstash config file but im getting below error here's is my logstash config file input { tcp { port =\> 9563 codec =\> plain { charset=\>"UTF-8" } } } fil… --- ## [How do I change the field of a scale based on a signal?](https://discuss.elastic.co/t/how-do-i-change-the-field-of-a-scale-based-on-a-signal/287029)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 6\ **Last updated:** [October 19, 2021, 4:44pm UTC](https://discuss.elastic.co/t/how-do-i-change-the-field-of-a-scale-based-on-a-signal/287029 "2021-10-19T16:44:59Z")
Hello All, I have a visualization with a select signal, and I want to change what field my scale looks at to colorize things based on the value of the select signal. I assume this can be done I tried the following, but … --- ## [Issues with Logstash reading csv file](https://discuss.elastic.co/t/issues-with-logstash-reading-csv-file/287117)
**Author:** [@ThePurple5merf](https://discuss.elastic.co/u/ThePurple5merf)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 3:34pm UTC](https://discuss.elastic.co/t/issues-with-logstash-reading-csv-file/287117 "2021-10-19T15:34:39Z")
Hello! I'm pretty new to the ELK Stack so I'm not sure how to troubleshoot this error. I've set up my Elasticsearch and kibana successfully, but I'm having issues with getting logstash to read in my .csv file to the ELK… --- ## [Enrich Processor: Match Longest](https://discuss.elastic.co/t/enrich-processor-match-longest/287116)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 3:19pm UTC](https://discuss.elastic.co/t/enrich-processor-match-longest/287116 "2021-10-19T15:19:10Z")
We are enriching documents via Ingest pipeline. It looks like the enrichment processor is only able to enrich by exact match. But what I need is that it enriches incoming documents by longest match. Lets assume I'm enric… --- ## [Does sum\_other\_doc\_count include docs without that field?](https://discuss.elastic.co/t/does-sum-other-doc-count-include-docs-without-that-field/286028)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 2:46pm UTC](https://discuss.elastic.co/t/does-sum-other-doc-count-include-docs-without-that-field/286028 "2021-10-19T14:46:21Z")
I'm performing a terms agg that gives me 5 top buckets and a sum\_other\_doc\_count against a specific field. Not every document in my index has that field. Does sum\_other\_doc\_count include a count of documents without th… --- ## [Datastream and indices not rolled over or deleted](https://discuss.elastic.co/t/datastream-and-indices-not-rolled-over-or-deleted/286715)
**Author:** [@koos](https://discuss.elastic.co/u/koos)\ **Replies:** 4\ **Last updated:** [October 19, 2021, 2:17pm UTC](https://discuss.elastic.co/t/datastream-and-indices-not-rolled-over-or-deleted/286715 "2021-10-19T14:17:43Z")
Hi, I recently started using datastreams, however, I see that the datastream and indices are not getting deleted according to the lifecycle policy. I can't seem to figure out why they are not getting deleted. Any help o… --- ## [Add new field in Kibana based off condition](https://discuss.elastic.co/t/add-new-field-in-kibana-based-off-condition/287064)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 1:55pm UTC](https://discuss.elastic.co/t/add-new-field-in-kibana-based-off-condition/287064 "2021-10-19T13:55:29Z")
Hi all, Need to have a quick compare of 2 index's , Example: index1 have columns a,b,c index 2 also have same columns a,b,c, now I want to create a new column "d" if the condition index1.a == index2.a, if equal the val… --- ## [Filebeat shipping only WARNINGS of haproxy](https://discuss.elastic.co/t/filebeat-shipping-only-warnings-of-haproxy/287098)
**Author:** [@10acc](https://discuss.elastic.co/u/10acc)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-shipping-only-warnings-of-haproxy/287098 "2021-10-19T13:55:14Z")
Hello, I am trying to ship my haproxy logs with filebeat to elk cloud This is my /etc/filebeat/modules.d/haproxy.yml - module: haproxy log: enabled: true var.paths: \["/var/log/haproxy.log"\] var.input: "fi… --- ## [Perform a pipelines aggregation over the full set of potential buckets](https://discuss.elastic.co/t/perform-a-pipelines-aggregation-over-the-full-set-of-potential-buckets/287097)
**Author:** [@seanletendre](https://discuss.elastic.co/u/seanletendre)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 1:38pm UTC](https://discuss.elastic.co/t/perform-a-pipelines-aggregation-over-the-full-set-of-potential-buckets/287097 "2021-10-19T13:38:58Z")
When using the \_search API of Elasticsearch, if you set size to 10, and perform an avg metric aggregation, the average will be of all values across the dataset matching the query, not just the average of the 10 items ret… --- ## [What is the best way to get the average number of documents per bucket in Elasticsearch](https://discuss.elastic.co/t/what-is-the-best-way-to-get-the-average-number-of-documents-per-bucket-in-elasticsearch/287096)
**Author:** [@seanletendre](https://discuss.elastic.co/u/seanletendre)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 1:31pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-get-the-average-number-of-documents-per-bucket-in-elasticsearch/287096 "2021-10-19T13:31:43Z")
Suppose that we are hat maker and have an Elasticsearch index where each document corresponds to the sale of one hat. Part of the sales record is the name of the store at which the hat was sold. I want to find out the n… --- ## [Unable to get values after searching for a Special Character](https://discuss.elastic.co/t/unable-to-get-values-after-searching-for-a-special-character/287095)
**Author:** [@paramzvik](https://discuss.elastic.co/u/paramzvik)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 1:23pm UTC](https://discuss.elastic.co/t/unable-to-get-values-after-searching-for-a-special-character/287095 "2021-10-19T13:23:11Z")
Hi Fellow Developers, I am using the following query to fetch data for the titles having + as a field in them but not returning any value. Can someone help me out in rectifying the issue. "query\_string":{"query":"\\+",… --- ## [Cannot start Metricbeat after adding keystore secret](https://discuss.elastic.co/t/cannot-start-metricbeat-after-adding-keystore-secret/286703)
**Author:** [@rubic](https://discuss.elastic.co/u/rubic)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 1:18pm UTC](https://discuss.elastic.co/t/cannot-start-metricbeat-after-adding-keystore-secret/286703 "2021-10-19T13:18:44Z")
Hi, I have added a secret from newly created keystore and after this operation mb service is failing to start. I wanted to use only one secret on field, specified in output.kafka: key\_passphrase: "${my\_secret\_pass\_… --- ## [Oralce to elasticsearch Date time issue](https://discuss.elastic.co/t/oralce-to-elasticsearch-date-time-issue/287068)
**Author:** [@bhavin.shah](https://discuss.elastic.co/u/bhavin.shah)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 12:58pm UTC](https://discuss.elastic.co/t/oralce-to-elasticsearch-date-time-issue/287068 "2021-10-19T12:58:27Z")
Dear team, ES Mapping information :- "ord\_trd\_trade\_time" : { "type" : "date", "format" : "yyyy-MM-dd HH:mm:ss||strict\_date\_optional\_time||epoch\_millis" } Logstash Statement :- to\_char(ord\_trd\_trade\_time,'yyyy-MM-… --- ## [\_grokparsefailure on kibana for record through logstash](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073)
**Author:** [@kish2010](https://discuss.elastic.co/u/kish2010)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 12:12pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073 "2021-10-19T12:12:36Z")
Hi All, I have created grok pattern and tested with log on grokdebugger but still it is failing with grokparsefailure error on kibana. PFB Config file:- input { file { path =\> "/tmp/test.csv" } } filter { grok { … --- ## [Number of indices / shards in a cluster](https://discuss.elastic.co/t/number-of-indices-shards-in-a-cluster/287076)
**Author:** [@mmoreram](https://discuss.elastic.co/u/mmoreram)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 12:11pm UTC](https://discuss.elastic.co/t/number-of-indices-shards-in-a-cluster/287076 "2021-10-19T12:11:02Z")
What is the number of indices and shards "allowed" in a cluster? How big should be a cluster to have 1000 indices, having each 1 shard and 1 replica, being each a ~2000 items index? Even a small one is recommended a 1Gb … --- ## [Expose transport 9300 as Openshift route](https://discuss.elastic.co/t/expose-transport-9300-as-openshift-route/287086)
**Author:** [@fabry](https://discuss.elastic.co/u/fabry)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 11:56am UTC](https://discuss.elastic.co/t/expose-transport-9300-as-openshift-route/287086 "2021-10-19T11:56:03Z")
Hi, Is it possible to expose the transport tsl connection (port 9300) as Openshift route? e.g to implement CCR. So far I couldn't get it working, I succeeded to expose it using NodePort and I can add a remote cluster b… --- ## [BitSet.or consumes almost 60% cpu](https://discuss.elastic.co/t/bitset-or-consumes-almost-60-cpu/286763)
**Author:** [@chembohuang](https://discuss.elastic.co/u/chembohuang)\ **Replies:** 23\ **Last updated:** [October 19, 2021, 11:25am UTC](https://discuss.elastic.co/t/bitset-or-consumes-almost-60-cpu/286763 "2021-10-19T11:25:40Z")
ES 7.7.1, jdk 14. We have two nodes with the same hardware(physical machine) under the same cluster which only hosts one index with 1 replica. Each node has the same shard. The weird thing is that, one of the machine'… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1194) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1196)