# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1221 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1222 --- ## [Use multiple analyzers by field on query](https://discuss.elastic.co/t/use-multiple-analyzers-by-field-on-query/285396)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 5\ **Last updated:** [September 28, 2021, 10:48pm UTC](https://discuss.elastic.co/t/use-multiple-analyzers-by-field-on-query/285396 "2021-09-28T22:48:16Z")
I want to do a multi\_match query for 3 different fields, but I want 2 of those fields (indexed as text using standard analyzer) to use the english language analyzer and the 3rd one to use the standard analyzer. I want to… --- ## [About Kibana Settings](https://discuss.elastic.co/t/about-kibana-settings/285357)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 10:33pm UTC](https://discuss.elastic.co/t/about-kibana-settings/285357 "2021-09-28T22:33:23Z")
Hi, Is there a way to view all of the configuration settings a kibana instance is running without access to the kibana config file? Version is 7.13.1. Thx D --- ## [Shard Relocation||ES expansion](https://discuss.elastic.co/t/shard-relocation-es-expansion/285336)
**Author:** [@Murali\_Thumalapalli](https://discuss.elastic.co/u/Murali_Thumalapalli)\ **Replies:** 3\ **Last updated:** [September 28, 2021, 10:23pm UTC](https://discuss.elastic.co/t/shard-relocation-es-expansion/285336 "2021-09-28T22:23:39Z")
Hi Team, Can someone guide us on this. How to find out the default retention for ES cluster for indices. also how to check the default on what basis the shards relocation happens. is it like cluster tries to bring the… --- ## [YY of XX shards failed - illegal\_argument\_exception](https://discuss.elastic.co/t/yy-of-xx-shards-failed-illegal-argument-exception/285294)
**Author:** [@ehsan001](https://discuss.elastic.co/u/ehsan001)\ **Replies:** 3\ **Last updated:** [September 28, 2021, 9:33pm UTC](https://discuss.elastic.co/t/yy-of-xx-shards-failed-illegal-argument-exception/285294 "2021-09-28T21:33:31Z")
Hi, I am using Kibana version 7.11.1 and when trying to create an Lens visualization for one of painless scripted fields getting the below error. Any recommendation how to resolve the issue? Mapping used to create a ne… --- ## [Alert rule for standard cluster alerts: search\_phase\_execution\_exception \[illegal\_argument\_exception\]](https://discuss.elastic.co/t/alert-rule-for-standard-cluster-alerts-search-phase-execution-exception-illegal-argument-exception/284668)
**Author:** [@jrykowski-huron](https://discuss.elastic.co/u/jrykowski-huron)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 9:03pm UTC](https://discuss.elastic.co/t/alert-rule-for-standard-cluster-alerts-search-phase-execution-exception-illegal-argument-exception/284668 "2021-09-28T21:03:10Z")
7.14.1 Platinum license Setting up brand new cluster, and have configured metricbeat style monitoring of cluster (separate elasticsearch for monitoring). Entered setup mode and did the add of standard alerts. Looks l… --- ## [Filebeats cannot push events to logstash](https://discuss.elastic.co/t/filebeats-cannot-push-events-to-logstash/285249)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 5\ **Last updated:** [September 28, 2021, 8:33pm UTC](https://discuss.elastic.co/t/filebeats-cannot-push-events-to-logstash/285249 "2021-09-28T20:33:22Z")
Dear team, could you please give me a hint what to do? We have all Elasticstack on version 7.9.2 (ELS, Logstash, Filebeats, Kibana). From filebeats towards logstash no TLS is used. Here is the error found in logstash… --- ## [Error with JDBC statement on MaxDB](https://discuss.elastic.co/t/error-with-jdbc-statement-on-maxdb/285392)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 7:43pm UTC](https://discuss.elastic.co/t/error-with-jdbc-statement-on-maxdb/285392 "2021-09-28T19:43:09Z")
Hi, I would like to synchronize a MaxDB table to ES via logstash/JDBC, so in my pipeline i have =\> input { jdbc { jdbc\_driver\_library =\> "\/sapdbc.jar" jdbc\_driver\_class =\> "com.sap.dbtech.jdbc.DriverSa… --- ## [How to proper use wildcard certs ELK Stack?](https://discuss.elastic.co/t/how-to-proper-use-wildcard-certs-elk-stack/285401)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 6:58pm UTC](https://discuss.elastic.co/t/how-to-proper-use-wildcard-certs-elk-stack/285401 "2021-09-28T18:58:41Z")
Hi there, I got this \*.domain wildcard and I wanted to use on the elk servers but I could not find a proper way to configure. Which certs do I need??? .pem ??? .pfx???? Can anyone help me on that? Really appreciate fo… --- ## [Order by length of array properties](https://discuss.elastic.co/t/order-by-length-of-array-properties/285393)
**Author:** [@juancruzdev](https://discuss.elastic.co/u/juancruzdev)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 4:52pm UTC](https://discuss.elastic.co/t/order-by-length-of-array-properties/285393 "2021-09-28T16:52:43Z")
i have an index with objects and an array called "reviews" that inside has properties called positive\_comment, negative\_comment, reviewer\_name and more. There are some reviews that have the field positive\_comment empty … --- ## [Help with setting up postgresql module on metricbeat with elastic cloud](https://discuss.elastic.co/t/help-with-setting-up-postgresql-module-on-metricbeat-with-elastic-cloud/285361)
**Author:** [@idelix](https://discuss.elastic.co/u/idelix)\ **Replies:** 1\ **Last updated:** [September 28, 2021, 4:16pm UTC](https://discuss.elastic.co/t/help-with-setting-up-postgresql-module-on-metricbeat-with-elastic-cloud/285361 "2021-09-28T16:16:54Z")
Hello, I did setup postgresql module using metricbeat on linux machine using following guide: and command sudo metricbeat setup -e everything works fine but I'm sending a huge amount of data to elastic cloud which i… --- ## [Logstash MetricNotFound](https://discuss.elastic.co/t/logstash-metricnotfound/285390)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 1\ **Last updated:** [September 28, 2021, 4:05pm UTC](https://discuss.elastic.co/t/logstash-metricnotfound/285390 "2021-09-28T16:05:01Z")
Please have a look at the error in the logstash-plain.log file: \[2021-09-28T15:51:47,918\]\[DEBUG\]\[logstash.agent \] 2021-09-28 15:51:47 - LogStash::Instrument::MetricStore::MetricNotFound - For path: events. Map… --- ## [Metricbeat examples on ECK not working properly](https://discuss.elastic.co/t/metricbeat-examples-on-eck-not-working-properly/285386)
**Author:** [@CHAVE](https://discuss.elastic.co/u/CHAVE)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 3:42pm UTC](https://discuss.elastic.co/t/metricbeat-examples-on-eck-not-working-properly/285386 "2021-09-28T15:42:07Z")
I'm trying to setup ECK on Google Kubernetes Engine following the quickstart guides on ECK. I'm using the default configuration for Kibana and Metricbeat, and the index metricbeat-\* exists on my Elasticsearch cluster. Ho… --- ## [Insert records for parent/child in same index of elastic search](https://discuss.elastic.co/t/insert-records-for-parent-child-in-same-index-of-elastic-search/285385)
**Author:** [@manjurgani](https://discuss.elastic.co/u/manjurgani)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 3:40pm UTC](https://discuss.elastic.co/t/insert-records-for-parent-child-in-same-index-of-elastic-search/285385 "2021-09-28T15:40:28Z")
I have created a mapping in Elasticsearch like below POST /INDEX { "mappings": { "properties": { "id": { "type": "keyword" }, "join\_field": { "typ… --- ## [Elasticsearch don't remove old shards](https://discuss.elastic.co/t/elasticsearch-dont-remove-old-shards/284272)
**Author:** [@09a9373743777d8430c4](https://discuss.elastic.co/u/09a9373743777d8430c4)\ **Replies:** 8\ **Last updated:** [September 28, 2021, 3:20pm UTC](https://discuss.elastic.co/t/elasticsearch-dont-remove-old-shards/284272 "2021-09-28T15:20:56Z")
Hi. This week after \_forcemerge?only\_expunge\_deletes=true I saw an increase in disk space usage (# 1 in the picture), after that I tried to reduce the number of replicas from 2 to 1 (# 2 in the picture), and also notice… --- ## [Logstash tuning w/ 35 pipelines](https://discuss.elastic.co/t/logstash-tuning-w-35-pipelines/285345)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 11:12am UTC](https://discuss.elastic.co/t/logstash-tuning-w-35-pipelines/285345 "2021-09-28T11:12:39Z")
Hi, I have an Elasticsearch cluster with 24 data nodes. I have about 35 logstash pipelines on a single server that has 4 CPUs and 16 GB RAM. Each Logstash pipeline has 18 filters w/ two of them being Elasticsearch filte… --- ## [How can I define a runtime field which shows the time elapsed since the value of a date field](https://discuss.elastic.co/t/how-can-i-define-a-runtime-field-which-shows-the-time-elapsed-since-the-value-of-a-date-field/285339)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 2:35pm UTC](https://discuss.elastic.co/t/how-can-i-define-a-runtime-field-which-shows-the-time-elapsed-since-the-value-of-a-date-field/285339 "2021-09-28T14:35:59Z")
I have an index and I want a field called durationv2. If the field command\_details.endTime exists, I want durationv2 to be the difference between command\_details.startTime and command\_details.endTime. Otherwise, I want i… --- ## [Label alignment with two layers (7.15.0)](https://discuss.elastic.co/t/label-alignment-with-two-layers-7-15-0/285334)
**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 2:34pm UTC](https://discuss.elastic.co/t/label-alignment-with-two-layers-7-15-0/285334 "2021-09-28T14:34:19Z")
I have a lens visualization (in version 7.15.0) where I want bar chart showing "Closed" vs "Not closed" where I color "Closed" with green and "Not closed" with red. To be able to set different colors for the bars I use t… --- ## [Logstash crashes at startup when custom codec is used in the config](https://discuss.elastic.co/t/logstash-crashes-at-startup-when-custom-codec-is-used-in-the-config/285078)
**Author:** [@Rara](https://discuss.elastic.co/u/Rara)\ **Replies:** 1\ **Last updated:** [September 28, 2021, 2:23pm UTC](https://discuss.elastic.co/t/logstash-crashes-at-startup-when-custom-codec-is-used-in-the-config/285078 "2021-09-28T14:23:45Z")
Hi Team I'm participating in the migration of a project from Logstash 6.4.3 to Logstash 7.10.2. The problem is that the new Logstash crashes at startup when one of our custom codecs is used in the configuration. The er… --- ## [ILM - Alias inheritance](https://discuss.elastic.co/t/ilm-alias-inheritance/285058)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 2:19pm UTC](https://discuss.elastic.co/t/ilm-alias-inheritance/285058 "2021-09-28T14:19:21Z")
Dear experts, here is my ILM managed mongodb index in hot lifecycle phase { "fbeat-7.10.2-mongodb-2021.08.23-000009" : { "aliases" : { "fbeat-7.10.2-mongodb" : { "is\_write\_index" : true }, … --- ## [Regex not working with painless](https://discuss.elastic.co/t/regex-not-working-with-painless/284221)
**Author:** [@forst](https://discuss.elastic.co/u/forst)\ **Replies:** 9\ **Last updated:** [September 28, 2021, 2:19pm UTC](https://discuss.elastic.co/t/regex-not-working-with-painless/284221 "2021-09-28T14:19:03Z")
I'm trying to write a regex query for a java log error as following \[Poolthread\] com.xxxx.content.core-bundle com.xxxxx.content.model.impl.RegisterTypeInternal(3179)\] The activate method has thrown an exception (com.xxx… --- ## [Shrink ES Cluster size from 3 to 1 in ES 7.62](https://discuss.elastic.co/t/shrink-es-cluster-size-from-3-to-1-in-es-7-62/285369)
**Author:** [@hello5346](https://discuss.elastic.co/u/hello5346)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 2:03pm UTC](https://discuss.elastic.co/t/shrink-es-cluster-size-from-3-to-1-in-es-7-62/285369 "2021-09-28T14:03:33Z")
We are Running an Elasticsearch cluster with 3 nodes and we want to downsize the current cluster to run with only 1 node. my cluster configs look like this. node.master and node.data is true on all 3 nodes and cluster… --- ## [Get an CORS error When requested elastic search rest API](https://discuss.elastic.co/t/get-an-cors-error-when-requested-elastic-search-rest-api/285331)
**Author:** [@MB\_KING](https://discuss.elastic.co/u/MB_KING)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 1:11pm UTC](https://discuss.elastic.co/t/get-an-cors-error-when-requested-elastic-search-rest-api/285331 "2021-09-28T13:11:37Z")
hi Im working on React Project and using Axios package for requested Elasticsearch rest API . after call I receive CORS error how can fix this error and get data ? error : Access to XMLHttpRequest at '\ **Author:** [@Jomy](https://discuss.elastic.co/u/Jomy)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 12:40pm UTC](https://discuss.elastic.co/t/values-changing-when-ordering-by-metric/285055 "2021-09-28T12:40:37Z") Hi, I am facing an issue with "order by". I have an Y axis with an "average" aggregation. I have an X axis with a "Term" aggregation (where my terms are street names) =\> I have an average value for each street. I would… --- ## [Node Query Cache with keyword](https://discuss.elastic.co/t/node-query-cache-with-keyword/285314)
**Author:** [@yukai](https://discuss.elastic.co/u/yukai)\ **Replies:** 3\ **Last updated:** [September 28, 2021, 12:18pm UTC](https://discuss.elastic.co/t/node-query-cache-with-keyword/285314 "2021-09-28T12:18:23Z")
For search performance, changing field type of integer/long to keywords for term querys might increase search speed. However, I recently found that doing this change would no longer getting benefit from node query cach… --- ## [Creating an ILM policy using python](https://discuss.elastic.co/t/creating-an-ilm-policy-using-python/285340)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 11:53am UTC](https://discuss.elastic.co/t/creating-an-ilm-policy-using-python/285340 "2021-09-28T11:53:03Z")
I have been trying to create an ILM policy using the python client. But I get an error when running the python script. This is my code: from datetime import datetime from elasticsearch import Elasticsearch from elastic… --- ## [Kuromoji analyzer filters out text in Arabic](https://discuss.elastic.co/t/kuromoji-analyzer-filters-out-text-in-arabic/285350)
**Author:** [@anatoly21](https://discuss.elastic.co/u/anatoly21)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 11:51am UTC](https://discuss.elastic.co/t/kuromoji-analyzer-filters-out-text-in-arabic/285350 "2021-09-28T11:51:34Z")
We have faced the issue with indexing and searching multilanguage Japanese/Arabic documents using kuromoji analyzer. The problem is that the analyzer filters out all tokens in Arabic, while tokens in other scripts are p… --- ## [Can Transforms output to a log index such that events can be streamed?](https://discuss.elastic.co/t/can-transforms-output-to-a-log-index-such-that-events-can-be-streamed/285337)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 1\ **Last updated:** [September 28, 2021, 11:40am UTC](https://discuss.elastic.co/t/can-transforms-output-to-a-log-index-such-that-events-can-be-streamed/285337 "2021-09-28T11:40:59Z")
I recently wrote a Transform to aggregate my log events (see previous post if curious). I would like to be able to stream the results of this transform using the Observability \> Logs \> Stream feature. However, if I try t… --- ## [7.15 metric visualization percentile bucket\[agg.parentId\] is undefined](https://discuss.elastic.co/t/7-15-metric-visualization-percentile-bucket-agg-parentid-is-undefined/285125)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 11:16am UTC](https://discuss.elastic.co/t/7-15-metric-visualization-percentile-bucket-agg-parentid-is-undefined/285125 "2021-09-28T11:16:54Z")
After upgrading from 7.14.2 to 7.15, some existing metric visualizations that use percentiles have stopped working. Search Error bucket\[agg.parentId\] is undefined getPercentileValue@https://.../44040/bundles/plugin/d… --- ## [Configure Elasticsearch to use SSO by OIDC - Groups claim is not mapped correctly](https://discuss.elastic.co/t/configure-elasticsearch-to-use-sso-by-oidc-groups-claim-is-not-mapped-correctly/285134)
**Author:** [@Ismaeel\_Enjreny](https://discuss.elastic.co/u/Ismaeel_Enjreny)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 10:51am UTC](https://discuss.elastic.co/t/configure-elasticsearch-to-use-sso-by-oidc-groups-claim-is-not-mapped-correctly/285134 "2021-09-28T10:51:49Z")
We are trying to configure Elasticsearch so uses can login using SSO feature based on oidc protocol, everything is working fine till we tried to map claims.groups. The Identity Provider send groups as JSON array but it … --- ## [Load balancing Kibana](https://discuss.elastic.co/t/load-balancing-kibana/284932)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 5\ **Last updated:** [September 28, 2021, 9:50am UTC](https://discuss.elastic.co/t/load-balancing-kibana/284932 "2021-09-28T09:50:24Z")
Hi - we have 3 clusters in our prod spread across three diff Data centers. Each cluster setup: One instance of Kibana -\> 2 client nodes for load balancing -\> data nodes Since dashboards and visualizations are local to… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1220) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1222)