# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1201 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1202 --- ## [Index not creating](https://discuss.elastic.co/t/index-not-creating/285232)
**Author:** [@jubin03](https://discuss.elastic.co/u/jubin03)\ **Replies:** 16\ **Last updated:** [October 14, 2021, 6:22pm UTC](https://discuss.elastic.co/t/index-not-creating/285232 "2021-10-14T18:22:40Z")
Following with this topic Index not creating - #17 by jubin03 I have created a new ELK and fetched data and it is working fine and able to create index patter, but the existing one is not working. Could somebody have an… --- ## [Match only N queries in a large boolean query for a single result](https://discuss.elastic.co/t/match-only-n-queries-in-a-large-boolean-query-for-a-single-result/286754)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 4:20pm UTC](https://discuss.elastic.co/t/match-only-n-queries-in-a-large-boolean-query-for-a-single-result/286754 "2021-10-14T16:20:57Z")
I am constructing a query that looks like that: Bool(should=\[Bool(\_name='F002690\_sf3789834989482\_wgs\_hgsc', must=\[Bool(should=\[Terms(samples\_num\_alt\_1=\['S338492778\_HGSC', 'S59=89483927\_HGSC'\]), Terms(samples\_num\_alt\_2=\[… --- ## [Tag Doc if match to List of Text terms Keywords](https://discuss.elastic.co/t/tag-doc-if-match-to-list-of-text-terms-keywords/286662)
**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 5:42pm UTC](https://discuss.elastic.co/t/tag-doc-if-match-to-list-of-text-terms-keywords/286662 "2021-10-14T17:42:18Z")
I have a list of terms about 1000 words and I want to have logstash in a Filter tag the document if there is a match in any of the words in a text field. Example: text : "The big brown dog" My List of 1000 terms has D… --- ## [Log4net to logstash](https://discuss.elastic.co/t/log4net-to-logstash/286250)
**Author:** [@Vinicius\_Mylonas](https://discuss.elastic.co/u/Vinicius_Mylonas)\ **Replies:** 1\ **Last updated:** [October 14, 2021, 5:30pm UTC](https://discuss.elastic.co/t/log4net-to-logstash/286250 "2021-10-14T17:30:39Z")
I'm trying to get a log like this from log4net: \[27\]\[14:08:36.584\] \[{"name":"Vinicius","SerialNumber":"957593196"}\] \[37\]\[14:08:36.584\] \[{"name":"Mylonas","SerialNumber":"957593166"}\] ... How can I get this information… --- ## [What permissions are needed to manage Fleet/Agent Policies/Integrations](https://discuss.elastic.co/t/what-permissions-are-needed-to-manage-fleet-agent-policies-integrations/286650)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [October 14, 2021, 4:59pm UTC](https://discuss.elastic.co/t/what-permissions-are-needed-to-manage-fleet-agent-policies-integrations/286650 "2021-10-14T16:59:48Z")
Hi All, I'm trying to setup RBAC for managing Fleet/Agent Policies/Integrations, but I'm having a hard time finding a list of permissions (Index level and Kibana Space level). Would anyone know where I could find docs f… --- ## [Search returning no results after upgrade from 7.9.3 to 7.15.0](https://discuss.elastic.co/t/search-returning-no-results-after-upgrade-from-7-9-3-to-7-15-0/286739)
**Author:** [@williamhbell](https://discuss.elastic.co/u/williamhbell)\ **Replies:** 5\ **Last updated:** [October 14, 2021, 4:57pm UTC](https://discuss.elastic.co/t/search-returning-no-results-after-upgrade-from-7-9-3-to-7-15-0/286739 "2021-10-14T16:57:33Z")
Hi, Our Elasticsearch installation was recently updated from 7.9.3 to 7.15.0. (The host operating system was updated from Ubuntu LTS 18 to 20 at the same time.) Following this update, the search scripts and programs w… --- ## [Unexpected hits when using n-gram](https://discuss.elastic.co/t/unexpected-hits-when-using-n-gram/286760)
**Author:** [@bsharma](https://discuss.elastic.co/u/bsharma)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 4:45pm UTC](https://discuss.elastic.co/t/unexpected-hits-when-using-n-gram/286760 "2021-10-14T16:45:40Z")
Hi, I am using n-gram filter with my index. Index configuration: PUT dev-dk-ngram-test { "settings": { "index": { "max\_ngram\_diff": 2 }, "analysis": { "analyzer": { "default": { … --- ## [How to configure processor in autodiscover mode?](https://discuss.elastic.co/t/how-to-configure-processor-in-autodiscover-mode/286757)
**Author:** [@Jfree](https://discuss.elastic.co/u/Jfree)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 4:35pm UTC](https://discuss.elastic.co/t/how-to-configure-processor-in-autodiscover-mode/286757 "2021-10-14T16:35:27Z")
Hi, We have k8s cluster with filebeat configured in autodiscover mode with hints: filebeat.yml: | logging.level: debug filebeat.autodiscover: providers: - type: kubernetes node: ${NODE\_NAME} … --- ## [Filter Elasticsearch results based on the number of 'matched\_queries'](https://discuss.elastic.co/t/filter-elasticsearch-results-based-on-the-number-of-matched-queries/286741)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 1\ **Last updated:** [October 14, 2021, 2:59pm UTC](https://discuss.elastic.co/t/filter-elasticsearch-results-based-on-the-number-of-matched-queries/286741 "2021-10-14T14:59:33Z")
There is such a thing in elasticsearch as named queries : When we use it, we get matched\_queries array together with each matched document in each elasticsearch hit. Now, I want to get only documents that matched \> n … --- ## [Visualize Library - Pie chart](https://discuss.elastic.co/t/visualize-library-pie-chart/286690)
**Author:** [@Emin\_Cevikol](https://discuss.elastic.co/u/Emin_Cevikol)\ **Replies:** 3\ **Last updated:** [October 14, 2021, 3:53pm UTC](https://discuss.elastic.co/t/visualize-library-pie-chart/286690 "2021-10-14T15:53:03Z")
Hi everyone, I have a pie chart which shows percentage of two values (Success or Failure) count. I want to filter for example If sum of count greater then 1000, Then show me the pie chart otherwise not. How can I provid… --- ## [Shard allocation fails during rebalancing](https://discuss.elastic.co/t/shard-allocation-fails-during-rebalancing/286706)
**Author:** [@bunste](https://discuss.elastic.co/u/bunste)\ **Replies:** 8\ **Last updated:** [October 14, 2021, 3:40pm UTC](https://discuss.elastic.co/t/shard-allocation-fails-during-rebalancing/286706 "2021-10-14T15:40:27Z")
We recently ran into a problem with our Elasticseach Cluster. We took a Data Node out of the cluster and completely reinstalled it with Debian 11. When the node was done and rejoined the cluster, Elasticsearch started r… --- ## [Can't install Fleet Server on Ubuntu instance](https://discuss.elastic.co/t/cant-install-fleet-server-on-ubuntu-instance/286736)
**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 2:22pm UTC](https://discuss.elastic.co/t/cant-install-fleet-server-on-ubuntu-instance/286736 "2021-10-14T14:22:34Z")
Hi all! Unfortunately, I didn't find suitable topics! I have these configs: Fleet settings Tried to enroll and install elastic agent two ways: sudo ./elastic-agent install -f --url=https://10.2.5.2:8220 --f… --- ## [Logstash can't finde the certificate](https://discuss.elastic.co/t/logstash-cant-finde-the-certificate/286476)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 15\ **Last updated:** [October 14, 2021, 2:17pm UTC](https://discuss.elastic.co/t/logstash-cant-finde-the-certificate/286476 "2021-10-14T14:17:03Z")
Hello, I am trying to set up Logstash but I am failing for a week and now ask for your help. ( Using: /usr/share/logstash/bin/logstash ) I have a certificate chain, which contains the certificate for the webserver and t… --- ## [Elastic - flattening multiple fields](https://discuss.elastic.co/t/elastic-flattening-multiple-fields/286246)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 5\ **Last updated:** [October 14, 2021, 2:01pm UTC](https://discuss.elastic.co/t/elastic-flattening-multiple-fields/286246 "2021-10-14T14:01:04Z")
Hi everybody, In one of the Elastic indices, I have a problem with some documents. I receive JSON from filebeat and parse them with the json plugin. But some of them contain a lot of fields. Example response.0.field1… --- ## [Save redis channel name inside document](https://discuss.elastic.co/t/save-redis-channel-name-inside-document/286633)
**Author:** [@Metehan\_Tagizade](https://discuss.elastic.co/u/Metehan_Tagizade)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 1:55pm UTC](https://discuss.elastic.co/t/save-redis-channel-name-inside-document/286633 "2021-10-14T13:55:54Z")
Hi, I have logstash pipeline like: input { redis { host=\> "redis-endpoint.com" port =\> "6379" key =\> "\*" data\_type =\> "pattern\_channel" batch\_count =\> 100 codec =\> "… --- ## [Oracle Data into Elastic](https://discuss.elastic.co/t/oracle-data-into-elastic/286719)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 3\ **Last updated:** [October 14, 2021, 1:12pm UTC](https://discuss.elastic.co/t/oracle-data-into-elastic/286719 "2021-10-14T13:12:56Z")
Hi, I have been butting my head against a brick wall for over a week now trying to get the jdbc driver working in logstash, and have rethought the approach for getting data out of Oracle. I am currently trying to protot… --- ## [Out Of Memory crash, few documents & load](https://discuss.elastic.co/t/out-of-memory-crash-few-documents-load/286597)
**Author:** [@cyril.r](https://discuss.elastic.co/u/cyril.r)\ **Replies:** 9\ **Last updated:** [October 14, 2021, 1:05pm UTC](https://discuss.elastic.co/t/out-of-memory-crash-few-documents-load/286597 "2021-10-14T13:05:28Z")
Hi there, I have a small Elasticsearch single node cluster for development purpose that is crashing about one time per month, even when there are no trafic/requests (like in the middle of the night, no one is working on… --- ## [How order aggregations using elasticsearch 7.15](https://discuss.elastic.co/t/how-order-aggregations-using-elasticsearch-7-15/286645)
**Author:** [@acantepie](https://discuss.elastic.co/u/acantepie)\ **Replies:** 4\ **Last updated:** [October 14, 2021, 12:59pm UTC](https://discuss.elastic.co/t/how-order-aggregations-using-elasticsearch-7-15/286645 "2021-10-14T12:59:09Z")
Hello, I have the following mapping : "COLOR": { "properties": { "order": { "type": "long" }, "value": { "type": "text", "fields": { "keyword": { … --- ## [filebeat/Logstash exit](https://discuss.elastic.co/t/filebeat-logstash-exit/286716)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 3\ **Last updated:** [October 14, 2021, 12:48pm UTC](https://discuss.elastic.co/t/filebeat-logstash-exit/286716 "2021-10-14T12:48:53Z")
Hello, I would like to know how: filebeat -e and /usr/share/logstash/bin/logstash should exit? Because they each run for 10 minutes and before not moving further they print: starting.... Logstash start an input lis… --- ## [Kibana export CSV encoding](https://discuss.elastic.co/t/kibana-export-csv-encoding/286656)
**Author:** [@Richard\_Schroeder](https://discuss.elastic.co/u/Richard_Schroeder)\ **Replies:** 1\ **Last updated:** [October 14, 2021, 12:40pm UTC](https://discuss.elastic.co/t/kibana-export-csv-encoding/286656 "2021-10-14T12:40:46Z")
Is there any way to change the default encoding of the CSV file when exporting data from a visualization? --- ## [Okta module causes rate-limit violations](https://discuss.elastic.co/t/okta-module-causes-rate-limit-violations/286721)
**Author:** [@hinchliff](https://discuss.elastic.co/u/hinchliff)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 12:33pm UTC](https://discuss.elastic.co/t/okta-module-causes-rate-limit-violations/286721 "2021-10-14T12:33:46Z")
In the GitHub issue #23023, a bug is fixed in the httpjson module that caused Filebeat to continue requesting data from Okta even after the rate-limit has been reached. However, Okta continues to tag Filebeat behavior a… --- ## [If else return scripted field date field](https://discuss.elastic.co/t/if-else-return-scripted-field-date-field/286646)
**Author:** [@Surya\_Raviraj](https://discuss.elastic.co/u/Surya_Raviraj)\ **Replies:** 1\ **Last updated:** [October 14, 2021, 12:29pm UTC](https://discuss.elastic.co/t/if-else-return-scripted-field-date-field/286646 "2021-10-14T12:29:36Z")
Is it possible to do an if else return statement with dates? For example, if the date in the date column is 1/1/21 I want it to return Week 1. I tried doing that below but I am getting the error shown in the screenshot. … --- ## [Create an index rate alert](https://discuss.elastic.co/t/create-an-index-rate-alert/286564)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 1\ **Last updated:** [October 14, 2021, 12:04pm UTC](https://discuss.elastic.co/t/create-an-index-rate-alert/286564 "2021-10-14T12:04:44Z")
Hi there: I would like to create a rule to send alert if there is an index in the system with index rate in the last 10 min exceeds a threshold value. I can see index rate from stack monitoring for each index, but how … --- ## [Unable to access Kibana in T-Pot](https://discuss.elastic.co/t/unable-to-access-kibana-in-t-pot/286409)
**Author:** [@paulap2](https://discuss.elastic.co/u/paulap2)\ **Replies:** 3\ **Last updated:** [October 14, 2021, 11:46am UTC](https://discuss.elastic.co/t/unable-to-access-kibana-in-t-pot/286409 "2021-10-14T11:46:25Z")
Hi, I am setting up T-POT for a uni project. I followed this tutorial step by step: Setup a T-POT Honeypot on Azure in less than 30 minutes - YouTube It worked for me over the weekend but today my kibana was giving me … --- ## [Elasticsearch and Strapi: How to create "geo\_point" type fields using Strapi cms](https://discuss.elastic.co/t/elasticsearch-and-strapi-how-to-create-geo-point-type-fields-using-strapi-cms/286714)
**Author:** [@GuiPerim](https://discuss.elastic.co/u/GuiPerim)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-and-strapi-how-to-create-geo-point-type-fields-using-strapi-cms/286714 "2021-10-14T11:25:12Z")
Hello! I'm pretty new on the React/NodeJs world. That being said, i'm working on an application that is using Strapi (v3.6.7) as the CMS and we are also using Elasticsearch (v7.15). And i'm using the following puglin to… --- ## [Since we moved 7.15 "Pushing flush onto pipeline." and files are not parsed](https://discuss.elastic.co/t/since-we-moved-7-15-pushing-flush-onto-pipeline-and-files-are-not-parsed/286605)
**Author:** [@fabeau](https://discuss.elastic.co/u/fabeau)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 9:14am UTC](https://discuss.elastic.co/t/since-we-moved-7-15-pushing-flush-onto-pipeline-and-files-are-not-parsed/286605 "2021-10-14T09:14:30Z")
We deployed logstash config files on a new server running 7.15 from a 7.11 server working perfectly . We validated .conf files in command line and everything is fine. we parse some log files locally on the server and … --- ## [\[Help\] Display Concurrency between 2 date-type](https://discuss.elastic.co/t/help-display-concurrency-between-2-date-type/286351)
**Author:** [@hoaf13](https://discuss.elastic.co/u/hoaf13)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 8:27am UTC](https://discuss.elastic.co/t/help-display-concurrency-between-2-date-type/286351 "2021-10-14T08:27:07Z")
I have 2 date-type: "timestamp\_pickup\_at" : "2021-09-06T04:10:28.070Z", "timestamp\_hangup\_at" : "2021-09-06T04:10:36.022Z" I want to visualize that as a conccurency date histogram. I refer to this topic but not work. … --- ## [Problems with Shard allocation](https://discuss.elastic.co/t/problems-with-shard-allocation/286687)
**Author:** [@Olakunle\_Oladimeji](https://discuss.elastic.co/u/Olakunle_Oladimeji)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 8:09am UTC](https://discuss.elastic.co/t/problems-with-shard-allocation/286687 "2021-10-14T08:09:25Z")
We currently run Elasticsearch version 7.6.1 on three machines with roles dilm for all. Our index is divided into three shards and 2 replicas. Lately we've noticed that shards are not allocated on one node. When I run … --- ## [Ingest pipeline - processor - can't reuse fieldname after rename of fieldname](https://discuss.elastic.co/t/ingest-pipeline-processor-cant-reuse-fieldname-after-rename-of-fieldname/286677)
**Author:** [@justroll](https://discuss.elastic.co/u/justroll)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 6:58am UTC](https://discuss.elastic.co/t/ingest-pipeline-processor-cant-reuse-fieldname-after-rename-of-fieldname/286677 "2021-10-14T06:58:05Z")
Hi I got a logfeed coming from a black box (aka. i can't change a bit in datastructure) and arriving at me ES. We use in all our logging the field "log" to structure our data to (after grok) like log.level, log.thread,… --- ## [Shards Not Being Allocated To Nodes](https://discuss.elastic.co/t/shards-not-being-allocated-to-nodes/286587)
**Author:** [@vilakazil](https://discuss.elastic.co/u/vilakazil)\ **Replies:** 6\ **Last updated:** [October 14, 2021, 6:54am UTC](https://discuss.elastic.co/t/shards-not-being-allocated-to-nodes/286587 "2021-10-14T06:54:04Z")
Hope to get assistance here as I have been struggling. I have 11 nodes that run Elasticsearch, with 2 master node. 5 shards and 1 replica (default) We recently ran patches on the nodes and upgraded the .Net software, t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1200) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1202)