# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1210 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1211 --- ## [Highlight same field twice with different settings](https://discuss.elastic.co/t/highlight-same-field-twice-with-different-settings/286184)
**Author:** [@Sam\_Gaunt](https://discuss.elastic.co/u/Sam_Gaunt)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 6:44am UTC](https://discuss.elastic.co/t/highlight-same-field-twice-with-different-settings/286184 "2021-10-08T06:44:06Z")
I would like to return multiple highlights of the same field but with different fragment sizes. One would have a smaller fragment size and be used as a preview for the user before they open the document to see the full r… --- ## [Can I limit displayed search results to applicable sentences or paragraphs rather than entire document?](https://discuss.elastic.co/t/can-i-limit-displayed-search-results-to-applicable-sentences-or-paragraphs-rather-than-entire-document/286166)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 5:05am UTC](https://discuss.elastic.co/t/can-i-limit-displayed-search-results-to-applicable-sentences-or-paragraphs-rather-than-entire-document/286166 "2021-10-08T05:05:09Z")
I have indexed 24 Jack Reacher books. Any successful search displays at least one book in its entirety. e.g.: } GET books4/\_search { "query": { "match\_phrase":{ "content": "deerfield nodded" } } } Is … --- ## [No matching indices found: No indices match pattern](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern/286108)
**Author:** [@driveirk](https://discuss.elastic.co/u/driveirk)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 5:25am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern/286108 "2021-10-08T05:25:56Z")
I have a lot of index patterns and not all of them now have an index in the elasticity, after updating the kibana from 7.8.1 to 7.14.0 I cannot go to Management - Index Patterns because of: Heavy load during transition … --- ## [Is it possible to turn off "Elasticsearch built-in security features are not enabled" notifications?](https://discuss.elastic.co/t/is-it-possible-to-turn-off-elasticsearch-built-in-security-features-are-not-enabled-notifications/286167)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 4:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-turn-off-elasticsearch-built-in-security-features-are-not-enabled-notifications/286167 "2021-10-08T04:20:26Z")
I'm using ES on a stand-alone computer, without a wired or wireless network or internet connections. --- ## [ElasticSearch freezes suddenly and unable to respond](https://discuss.elastic.co/t/elasticsearch-freezes-suddenly-and-unable-to-respond/284256)
**Author:** [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Replies:** 11\ **Last updated:** [October 8, 2021, 3:52am UTC](https://discuss.elastic.co/t/elasticsearch-freezes-suddenly-and-unable-to-respond/284256 "2021-10-08T03:52:12Z")
Hi, We have ES OSS 7.0 running for more than couple of months. In last 15 days, ES froze and became very slow. It is almost unable to process any request. Setup: Single Node, Windows VM, 16 cores, 32GB RAM, ES Xmx 4G, … --- ## [Setup Metricbeat only for one module](https://discuss.elastic.co/t/setup-metricbeat-only-for-one-module/286145)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:55am UTC](https://discuss.elastic.co/t/setup-metricbeat-only-for-one-module/286145 "2021-10-08T02:55:03Z")
Hi, Last time i set up metricbeat with two modules enabled. Metricbeat created all possible dashboards for me, even those for disabled modules. How can I ask metricbeat to create dashboards/saved object for only activa… --- ## [\[Filebeat\] Metadata (Content-Type octet-stream) in S3 file - silently ignores 'Publish event'](https://discuss.elastic.co/t/filebeat-metadata-content-type-octet-stream-in-s3-file-silently-ignores-publish-event/286082)
**Author:** [@Maksim](https://discuss.elastic.co/u/Maksim)\ **Replies:** 2\ **Last updated:** [October 7, 2021, 11:15pm UTC](https://discuss.elastic.co/t/filebeat-metadata-content-type-octet-stream-in-s3-file-silently-ignores-publish-event/286082 "2021-10-07T23:15:51Z")
First debug log: If Object-string like: 2021-10-06/2021-10-06T23:13:06.107Z-test@simulator.json filebeat silently drop output 2021-10-06T23:13:08.827Z DEBUG \[input.aws-s3.sqs\] awss3/sqs.go:77 Received 1 SQS messages. … --- ## [Logstash error 403 with a remote elasticsearch instance](https://discuss.elastic.co/t/logstash-error-403-with-a-remote-elasticsearch-instance/286161)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 3\ **Last updated:** [October 7, 2021, 10:42pm UTC](https://discuss.elastic.co/t/logstash-error-403-with-a-remote-elasticsearch-instance/286161 "2021-10-07T22:42:13Z")
Hi, I have a logstash config which works fine with my local Elasticsearch instance but when i try to push to a remote instance config gives error at startup as follows: Using default mapping template \[2021-10-07T13:17… --- ## [Question: Are we going to run into problems using (abusing?) nested at scale](https://discuss.elastic.co/t/question-are-we-going-to-run-into-problems-using-abusing-nested-at-scale/285122)
**Author:** [@huggsboson](https://discuss.elastic.co/u/huggsboson)\ **Replies:** 4\ **Last updated:** [October 7, 2021, 10:31pm UTC](https://discuss.elastic.co/t/question-are-we-going-to-run-into-problems-using-abusing-nested-at-scale/285122 "2021-10-07T22:31:40Z")
We're looking for guidance on any pitfalls in terms of scale / performance we may run into when using the nested field type in Elasticsearch. We have a use-case where we have a 100k+ different customer schemas that we ar… --- ## [Add caracter in logstash custom patterns](https://discuss.elastic.co/t/add-caracter-in-logstash-custom-patterns/286158)
**Author:** [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\ **Replies:** 2\ **Last updated:** [October 7, 2021, 8:45pm UTC](https://discuss.elastic.co/t/add-caracter-in-logstash-custom-patterns/286158 "2021-10-07T20:45:25Z")
Hi comunity, I want to add a caracter when i'm processing data with logstash, for example, add a space or : or -. I mean, i have the next log 2021-07-29122715960 grok custom pattern: FECHACORTA ((?\>\\d\\d){1,2}\[./-\]%{MO… --- ## [Canvas image in data table cell](https://discuss.elastic.co/t/canvas-image-in-data-table-cell/286015)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 5:39pm UTC](https://discuss.elastic.co/t/canvas-image-in-data-table-cell/286015 "2021-10-07T17:39:01Z")
Trying to add image to data table in canvas Already formatted field in index pattern to use url of image -\> still getting the {value} in canvas data cell Trying to replace the {value} with Image html code =\> Canvas d… --- ## [Can't work with object's properties for aggregations](https://discuss.elastic.co/t/cant-work-with-objects-properties-for-aggregations/285939)
**Author:** [@Thomas\_DRABO](https://discuss.elastic.co/u/Thomas_DRABO)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:59pm UTC](https://discuss.elastic.co/t/cant-work-with-objects-properties-for-aggregations/285939 "2021-10-07T15:59:39Z")
Hello everyone, I'm trying to work with a property containing an array of objects in my index. You can find the index's mapping behind. This is my index mapping. PUT test-index { "mappings": { "properties": { … --- ## [Getting error while importing csv file to logstash](https://discuss.elastic.co/t/getting-error-while-importing-csv-file-to-logstash/285954)
**Author:** [@SSirurmath](https://discuss.elastic.co/u/SSirurmath)\ **Replies:** 6\ **Last updated:** [October 7, 2021, 3:56pm UTC](https://discuss.elastic.co/t/getting-error-while-importing-csv-file-to-logstash/285954 "2021-10-07T15:56:27Z")
\[2021-10-05T16:59:04,940\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\… --- ## [Logstash.conf error](https://discuss.elastic.co/t/logstash-conf-error/286088)
**Author:** [@Johnny\_Cash\_Cow](https://discuss.elastic.co/u/Johnny_Cash_Cow)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:54pm UTC](https://discuss.elastic.co/t/logstash-conf-error/286088 "2021-10-07T15:54:02Z")
Here is the error: "LogStash::ConfigurationError", :message=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"input\\", \\"filter\\", \\"output\\" at line 6, column 1 (byte 132) after ", and here is the logstash.conf file itself in… --- ## [Rules and connectors examples?](https://discuss.elastic.co/t/rules-and-connectors-examples/286061)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:51pm UTC](https://discuss.elastic.co/t/rules-and-connectors-examples/286061 "2021-10-07T15:51:26Z")
This seems pretty simple but I haven't found a way to get it accomplished. For rules and alerts I'm looking to send an email triggered from a windows event id. For example EventID 4740. The elastic query works it trigge… --- ## [How to convert kubernetes cpu usage and memory usage of metricbeat fields to percentage IN METRICBEAT index elasticsearch](https://discuss.elastic.co/t/how-to-convert-kubernetes-cpu-usage-and-memory-usage-of-metricbeat-fields-to-percentage-in-metricbeat-index-elasticsearch/285727)
**Author:** [@Jay\_Gajjar](https://discuss.elastic.co/u/Jay_Gajjar)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:27pm UTC](https://discuss.elastic.co/t/how-to-convert-kubernetes-cpu-usage-and-memory-usage-of-metricbeat-fields-to-percentage-in-metricbeat-index-elasticsearch/285727 "2021-10-07T15:27:08Z")
Hello, how can i get the percentage of Kubernetes node CPU usage and Kubernetes node memory usage from metricbeat, as i am making a custom plugin where I wanted to show it in percentage. moreover i'm making Elasticsearch… --- ## [Cannot Transform with Watcher's For Each Functionality](https://discuss.elastic.co/t/cannot-transform-with-watchers-for-each-functionality/283868)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:10pm UTC](https://discuss.elastic.co/t/cannot-transform-with-watchers-for-each-functionality/283868 "2021-10-07T15:10:20Z")
I am trying to develop a complex watcher. The beginning is a chain input that uses aggregations and a bucket selector to narrow down my payload to a list of actionable ID's. At that point, I need to query the original in… --- ## [Watcher alert with specific field](https://discuss.elastic.co/t/watcher-alert-with-specific-field/284302)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:08pm UTC](https://discuss.elastic.co/t/watcher-alert-with-specific-field/284302 "2021-10-07T15:08:40Z")
Hi, I have set a watcher alert that is trigger when a field inside my index is over a threshold. How can I integrate in my mail alert the value of another field in the index. For example, a mail like: The documen… --- ## [Is there a soon update for transforms API](https://discuss.elastic.co/t/is-there-a-soon-update-for-transforms-api/285685)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 5\ **Last updated:** [October 7, 2021, 3:03pm UTC](https://discuss.elastic.co/t/is-there-a-soon-update-for-transforms-api/285685 "2021-10-07T15:03:32Z")
I'm using transforms API for a use-case, where I have to run it continuously, the limitation described here list that the max frequency I can set is every 1h. But I'm planning to run it at night for documents indexed las… --- ## [Filebeat setup error](https://discuss.elastic.co/t/filebeat-setup-error/286147)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-setup-error/286147 "2021-10-07T14:44:09Z")
Hi there. After upgrading to Filebeat 7.15 i get this error on filebeat setup root@suricata:~# sudo filebeat setup Overwriting ILM policy is disabled. Set \`setup.ilm.overwrite: true\` for enabling. Index setup finished… --- ## [Field definition in logstash and elastic search](https://discuss.elastic.co/t/field-definition-in-logstash-and-elastic-search/286144)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 2:32pm UTC](https://discuss.elastic.co/t/field-definition-in-logstash-and-elastic-search/286144 "2021-10-07T14:32:59Z")
I have created three fields one index-number according to path and two static as mentioned in config file grok { match =\> {"path" =\> "indexer-(?\\[0-9\]\*)"} } mutate{ convert =\> {"index-number" =\> "int… --- ## [Multiple query with nested](https://discuss.elastic.co/t/multiple-query-with-nested/286020)
**Author:** [@elastic\_dev](https://discuss.elastic.co/u/elastic_dev)\ **Replies:** 5\ **Last updated:** [October 7, 2021, 2:24pm UTC](https://discuss.elastic.co/t/multiple-query-with-nested/286020 "2021-10-07T14:24:26Z")
Hi Below is my data. { "took" : 5, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 2, "relation… --- ## [Elasticsearch Angular](https://discuss.elastic.co/t/elasticsearch-angular/286042)
**Author:** [@Lyes\_Ouchene](https://discuss.elastic.co/u/Lyes_Ouchene)\ **Replies:** 4\ **Last updated:** [October 7, 2021, 2:15pm UTC](https://discuss.elastic.co/t/elasticsearch-angular/286042 "2021-10-07T14:15:21Z")
Hello everyone, i am new to Elasticsearch and want to create an angular search application. do you have any links for me ! --- ## [\[Vega Map\] How to get geoshapes from elasticsearch index coordinates](https://discuss.elastic.co/t/vega-map-how-to-get-geoshapes-from-elasticsearch-index-coordinates/285677)
**Author:** [@lehti](https://discuss.elastic.co/u/lehti)\ **Replies:** 5\ **Last updated:** [October 7, 2021, 2:10pm UTC](https://discuss.elastic.co/t/vega-map-how-to-get-geoshapes-from-elasticsearch-index-coordinates/285677 "2021-10-07T14:10:31Z")
Hi! I need to make a map using Vega-visualization. The coordinates come from an Elasticsearch index. I can load the index into Vega just fine. The issue is that I have no idea how to get Vega to understand the coordinat… --- ## [Logstash keeps restarting itself](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124)
**Author:** [@grigala](https://discuss.elastic.co/u/grigala)\ **Replies:** 3\ **Last updated:** [October 7, 2021, 1:59pm UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124 "2021-10-07T13:59:17Z")
Hello everyone, For some reason my Logstash container keeps restarting itself and every time producing the output below: Using bundled JDK: /usr/share/logstash/jdk warning: no jvm.options file found /usr/share/logstash… --- ## [Not possible to emit List for keyword runtime field](https://discuss.elastic.co/t/not-possible-to-emit-list-for-keyword-runtime-field/285397)
**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 1:53pm UTC](https://discuss.elastic.co/t/not-possible-to-emit-list-for-keyword-runtime-field/285397 "2021-10-07T13:53:37Z")
In Elasticsearch 7.15.0, I am unable to emit a list of strings for a keyword runtime field: PUT warning PUT warning/\_mapping { "dynamic": false, "runtime": { "Warning": { "type": "keyword", "script"… --- ## [Canvas Time Filter not selectable, on edge browser](https://discuss.elastic.co/t/canvas-time-filter-not-selectable-on-edge-browser/286114)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 1:47pm UTC](https://discuss.elastic.co/t/canvas-time-filter-not-selectable-on-edge-browser/286114 "2021-10-07T13:47:15Z")
Time Filter on canvas is working as image, mean its not allowing to click on it to change the time filter. On hover default arrow is displayed Browser Console: canvas#/workpad/workpad-651efed0-bbf4-4ec9-900d-c7eb8cc… --- ## [Batch Process Failed resolution](https://discuss.elastic.co/t/batch-process-failed-resolution/285389)
**Author:** [@2f404140b7ab0f69189f](https://discuss.elastic.co/u/2f404140b7ab0f69189f)\ **Replies:** 3\ **Last updated:** [October 7, 2021, 1:23pm UTC](https://discuss.elastic.co/t/batch-process-failed-resolution/285389 "2021-10-07T13:23:55Z")
I'm using Kibana 7.15.0 and I am constantly experiencing "Batch process failed" when I try to view an index on the Discover section. Can someone explain why this happens and what can be the solution please? --- ## [CEF plugin is not working as expected](https://discuss.elastic.co/t/cef-plugin-is-not-working-as-expected/286024)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 12\ **Last updated:** [October 7, 2021, 1:11pm UTC](https://discuss.elastic.co/t/cef-plugin-is-not-working-as-expected/286024 "2021-10-07T13:11:35Z")
Hi, I'm trying to configure Logstash to work with SentinelOne logs, but it is not working as expected, it looks like it is not separating the fields correctly. I configured the input to be CEF and the output to be json… --- ## [Upgrade Ubuntu 18.04 to 20.04](https://discuss.elastic.co/t/upgrade-ubuntu-18-04-to-20-04/286134)
**Author:** [@franco\_peppino](https://discuss.elastic.co/u/franco_peppino)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 1:00pm UTC](https://discuss.elastic.co/t/upgrade-ubuntu-18-04-to-20-04/286134 "2021-10-07T13:00:11Z")
Hello guys, I have one question. I have a 3 node Elasticsearch cluster running on Ubuntu Server 18.04, and I want to upgrade to Ubuntu 20.04. Should I take care of something related to elastic or a do-release-upgrade sh… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1209) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1211)