# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1231 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1232 --- ## [Translate doesnt work when key in yml dictionary is a number](https://discuss.elastic.co/t/translate-doesnt-work-when-key-in-yml-dictionary-is-a-number/284767)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 10:53pm UTC](https://discuss.elastic.co/t/translate-doesnt-work-when-key-in-yml-dictionary-is-a-number/284767 "2021-09-21T22:53:09Z")
Hi, I have this yml dictionary 1967345056 : "VISACI nodata IIS" and this is the translate: translate { field =\> "\[monitorgroup\]" destination =\> "\[nuevo\_campo\]" dictionary\_path =\> "/etc/logs… --- ## [Directly query ES cluster through .NET without using Client?](https://discuss.elastic.co/t/directly-query-es-cluster-through-net-without-using-client/284772)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:42pm UTC](https://discuss.elastic.co/t/directly-query-es-cluster-through-net-without-using-client/284772 "2021-09-21T22:42:35Z")
I'm trying to run some ElasticSearch queries from my C# code. Is it possible to do this without the low-level or high-level clients? --- ## [Settings for logging.files for reading from dir then delete files once read](https://discuss.elastic.co/t/settings-for-logging-files-for-reading-from-dir-then-delete-files-once-read/284737)
**Author:** [@robnew](https://discuss.elastic.co/u/robnew)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:28pm UTC](https://discuss.elastic.co/t/settings-for-logging-files-for-reading-from-dir-then-delete-files-once-read/284737 "2021-09-21T22:28:54Z")
I want to use Filebeat to read from a directory to ingest the log files, then to delete (sinkhole) the files once read and ingested into Elasticsearch. Is this achievable with Filebeat? --- ## [Downgrade ElasticSearch Nest version?](https://discuss.elastic.co/t/downgrade-elasticsearch-nest-version/284771)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:22pm UTC](https://discuss.elastic.co/t/downgrade-elasticsearch-nest-version/284771 "2021-09-21T22:22:53Z")
I am currently using the Nest client that comes with ElasticSearch. My ES version is 7.14.1. I would like to downgrade to an older version of ElasticSearch so that I can continue to use the client with other ElasticSearc… --- ## [Failed to create snapshot](https://discuss.elastic.co/t/failed-to-create-snapshot/284754)
**Author:** [@X\_T](https://discuss.elastic.co/u/X_T)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 10:20pm UTC](https://discuss.elastic.co/t/failed-to-create-snapshot/284754 "2021-09-21T22:20:08Z")
Hi team, I'm trying to create a snapshot from the cluster and i am getting some errors. ELK Stack: 7.14.1 Elasticsearch Nodes: 4 First i created the snapshot repository: PUT /\_snapshot/backup\_1 { "type": "fs", "… --- ## [Where I can find Journalbeat in Kibana?](https://discuss.elastic.co/t/where-i-can-find-journalbeat-in-kibana/284544)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 8\ **Last updated:** [September 21, 2021, 9:34pm UTC](https://discuss.elastic.co/t/where-i-can-find-journalbeat-in-kibana/284544 "2021-09-21T21:34:38Z")
Hello, I'm trying to identify journalbeat in Kibana. Where I'll get journalbeat information in Kibana dashboard? Can anyone help me ? --- ## [Filebeats does not create custom-named indices and hangs if ILM is disabled](https://discuss.elastic.co/t/filebeats-does-not-create-custom-named-indices-and-hangs-if-ilm-is-disabled/283894)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 8:40pm UTC](https://discuss.elastic.co/t/filebeats-does-not-create-custom-named-indices-and-hangs-if-ilm-is-disabled/283894 "2021-09-21T20:40:51Z")
All details and code snippets are included into the SO post: elasticsearch - Elastic Filebeat does not index into custom indices with mappings - Stack Overflow Below is the summary with the latest updates: I am trying … --- ## [Nested documents Sorting & faceting](https://discuss.elastic.co/t/nested-documents-sorting-faceting/284757)
**Author:** [@jai\_H](https://discuss.elastic.co/u/jai_H)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 6:33pm UTC](https://discuss.elastic.co/t/nested-documents-sorting-faceting/284757 "2021-09-21T18:33:35Z")
I am working on an E-Commerce application. Catalog Data is being served by Elastic Search. I have document's for Product which is already indexed in Elastic Search. Document Looks something like this (Excluded few fiel… --- ## [ES 6.4.0 repository S3 issue](https://discuss.elastic.co/t/es-6-4-0-repository-s3-issue/284238)
**Author:** [@theMike](https://discuss.elastic.co/u/theMike)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 6:32pm UTC](https://discuss.elastic.co/t/es-6-4-0-repository-s3-issue/284238 "2021-09-21T18:32:55Z")
Hi, I'm trying to use repository-s3 to snapshot a single node ELK instance to our StorageGrid via S3 api. { "type": "s3", "settings": { "endpoint": "objectstore.xxxx.xxx:xxxx", "bucket": "our-elk-backup" } } … --- ## [Invalid NEST response built from a unsuccessful () low level call on POST using .NET Nest](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-post-using-net-nest/284583)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 5:16pm UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-post-using-net-nest/284583 "2021-09-21T17:16:47Z")
New to ElasticSearch. I've seen a couple posts with similar titles but didn't seem to apply to me. I'm having trouble querying my ES cluster for the first time. Someone else creaed the cluster and gave me login info. My… --- ## ["Result window is too large" http response depends on the presence of the sort field](https://discuss.elastic.co/t/result-window-is-too-large-http-response-depends-on-the-presence-of-the-sort-field/284738)
**Author:** [@franck.valentin](https://discuss.elastic.co/u/franck.valentin)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 5:14pm UTC](https://discuss.elastic.co/t/result-window-is-too-large-http-response-depends-on-the-presence-of-the-sort-field/284738 "2021-09-21T17:14:04Z")
Hi, I'm facing a strange behaviour on Elasticsearch 7.7 when I perform a search on several indexes and the result window is too large. If the query is: GET /\_search { "size": 500, "from": 10000, "query": { "… --- ## [Reinstall Fleet Integrations](https://discuss.elastic.co/t/reinstall-fleet-integrations/284652)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [September 21, 2021, 4:42pm UTC](https://discuss.elastic.co/t/reinstall-fleet-integrations/284652 "2021-09-21T16:42:35Z")
Elastic/Kibana 7.14.1 How do you forcibly reinstall a system integration? System integration is missing several dashboards and searches so the easy was for most would be to just uninstall reinstall it. Due to system n… --- ## [Correlating Documents Based On Unique Field](https://discuss.elastic.co/t/correlating-documents-based-on-unique-field/283571)
**Author:** [@Nico\_Pampaloni](https://discuss.elastic.co/u/Nico_Pampaloni)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 4:12pm UTC](https://discuss.elastic.co/t/correlating-documents-based-on-unique-field/283571 "2021-09-21T16:12:07Z")
Good Afternoon, I have a question about correlating documents based on a search term that only exists in some of the results. Our data has two unique identifiers. The first one (X) exists throughout the lifetime of the … --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/284747)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 4\ **Last updated:** [September 21, 2021, 3:59pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/284747 "2021-09-21T15:59:29Z")
we upgraded a cluster from 6.8.8 to 7.8.1. ever since this, we are having elastic nodes die with the below error. everything was working fine before the upgrade. i've googled and haven't found anything to really point… --- ## [How to calculate the difference between two web sessions in seconds](https://discuss.elastic.co/t/how-to-calculate-the-difference-between-two-web-sessions-in-seconds/284624)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 3:57pm UTC](https://discuss.elastic.co/t/how-to-calculate-the-difference-between-two-web-sessions-in-seconds/284624 "2021-09-21T15:57:21Z")
Hey I am trying to understand how this transformation work: Getting duration by using bucket script. Before applying it to my use-case I am trying to know how to get the difference between two sessions in seconds? and th… --- ## [TSVB don't work only on Count Aggregation](https://discuss.elastic.co/t/tsvb-dont-work-only-on-count-aggregation/283457)
**Author:** [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\ **Replies:** 17\ **Last updated:** [September 21, 2021, 3:51pm UTC](https://discuss.elastic.co/t/tsvb-dont-work-only-on-count-aggregation/283457 "2021-09-21T15:51:35Z")
I don't know why the TSVB suddenly don't work anymore only for "Count" Aggregation. it show "The request for this panel failed. Failed to compile inline script \[count \*1\] using lang \[expression\]. " But when i use the oth… --- ## [Kibana - Query difficulties in Canvas](https://discuss.elastic.co/t/kibana-query-difficulties-in-canvas/283563)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 14\ **Last updated:** [September 21, 2021, 3:47pm UTC](https://discuss.elastic.co/t/kibana-query-difficulties-in-canvas/283563 "2021-09-21T15:47:08Z")
Hello, Right now I'm facing an issue creating a vertical bar element. The values I'm looking to use are quite simple to obtain through Dev Tools by making a query, however Canvas doesn't allow to query that way, which I… --- ## [Extract a substring and assign to new field](https://discuss.elastic.co/t/extract-a-substring-and-assign-to-new-field/284692)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 3:10pm UTC](https://discuss.elastic.co/t/extract-a-substring-and-assign-to-new-field/284692 "2021-09-21T15:10:18Z")
Hi everyone! Hope everyone's good. in my application, i'm sending a JSON wich has a string field always made of 16 char For example: XXXYYY12Y00K111H Is there a fine way, or do you have any particular hint to extract… --- ## [Needs to add few field from one log to another log](https://discuss.elastic.co/t/needs-to-add-few-field-from-one-log-to-another-log/284600)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 2:57pm UTC](https://discuss.elastic.co/t/needs-to-add-few-field-from-one-log-to-another-log/284600 "2021-09-21T14:57:29Z")
Hi Team, We have a ansible log, One is stream and another one is job status. Now i want to add few field from one log to another, then only i can able to create a table for my requirements. --- ## [Explain the function score of match\_phrase\_prefix](https://discuss.elastic.co/t/explain-the-function-score-of-match-phrase-prefix/283348)
**Author:** [@LazyMonster](https://discuss.elastic.co/u/LazyMonster)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 2:37pm UTC](https://discuss.elastic.co/t/explain-the-function-score-of-match-phrase-prefix/283348 "2021-09-21T14:37:59Z")
I have a problem with match\_phrase\_prefix query. Let me elaborate my case: I use a script similarity like this: { "similarity": { "custom\_tfidf": { "type": "scripted", "script": { "sou… --- ## [Keep a concrete character regular expressioon](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:44pm UTC](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696 "2021-09-21T13:44:54Z")
i need to keep only two characters of a field but i dont know how to do it. I would like to keep the second and third character of the server name, which indicates the country code, for example T52EDFS011 (52). i'm new… --- ## [Kv filter usage](https://discuss.elastic.co/t/kv-filter-usage/284718)
**Author:** [@PaoloZhao](https://discuss.elastic.co/u/PaoloZhao)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:40pm UTC](https://discuss.elastic.co/t/kv-filter-usage/284718 "2021-09-21T13:40:27Z")
Hi guys! I am a fresh fish. I have some logs like blow. 15:08:16.2104 Info {"message":"BlankProcess execution started","level":"Information","logType":"Default","timeStamp":"2021-09-21T15:08:16.2015207+08:00","fingerp… --- ## [Limiting axis to only integers](https://discuss.elastic.co/t/limiting-axis-to-only-integers/284296)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 1:10pm UTC](https://discuss.elastic.co/t/limiting-axis-to-only-integers/284296 "2021-09-21T13:10:24Z")
Hello! I'm wondering if it is possible to limit the y-axis in different plots to show only integer values? We're showcasing the number of people doing different actions, therefore it really doesn't make sense to have de… --- ## [Storage size of an event](https://discuss.elastic.co/t/storage-size-of-an-event/284724)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 12:40pm UTC](https://discuss.elastic.co/t/storage-size-of-an-event/284724 "2021-09-21T12:40:54Z")
Hello every body, Is there an estimate of the storage size of an event? Example sshd authentication event. Best regards --- ## [Add existing fields to my logstash](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 8\ **Last updated:** [September 21, 2021, 12:24pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626 "2021-09-21T12:24:49Z")
hello ! I would like to be able to add existing fields in an already stored index and to be able to work with them in logstash. I understand that there are enrichment policies but I would like not to have to use kibana… --- ## [Logstash changing Object events using ruby not working](https://discuss.elastic.co/t/logstash-changing-object-events-using-ruby-not-working/284722)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 12:26pm UTC](https://discuss.elastic.co/t/logstash-changing-object-events-using-ruby-not-working/284722 "2021-09-21T12:26:53Z")
Hello, I am having the below logstash filter ruby code to change the name of an event with Object type but im still getting an error. Am i doing something wrong? if \[body\]\[json\]\[attr\]\[config\] { … --- ## [Filebeat configuration log file path won't load](https://discuss.elastic.co/t/filebeat-configuration-log-file-path-wont-load/284720)
**Author:** [@Vincent001](https://discuss.elastic.co/u/Vincent001)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-configuration-log-file-path-wont-load/284720 "2021-09-21T12:14:21Z")
Hello, I have a custom configuration for filebeat for logging: logging.level: warning logging.to\_files: true logging.files: path: /var/log/filebeat/ name: filebeatVdpQueries keepfiles: 7 permissions: 0644 But … --- ## [Using certificates with ElasticSearch Nest client?](https://discuss.elastic.co/t/using-certificates-with-elasticsearch-nest-client/284656)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 12:14pm UTC](https://discuss.elastic.co/t/using-certificates-with-elasticsearch-nest-client/284656 "2021-09-21T12:14:20Z")
I am attempting to connect to an ElasticSearch cluster using a set of certificates given to me and a username + password. I have ca-chain public certificate private key I started my code out like this: var settings … --- ## [Docker compose error - cannot connect logstash to elastic search](https://discuss.elastic.co/t/docker-compose-error-cannot-connect-logstash-to-elastic-search/284685)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 12:13pm UTC](https://discuss.elastic.co/t/docker-compose-error-cannot-connect-logstash-to-elastic-search/284685 "2021-09-21T12:13:11Z")
I am trying to create a elastic search cluster with logstash and kibana using docker compose. Have been trying for a long time but i am getting an error. My log lines are kib01 | {"type":"log","@timestamp":"2021-… --- ## [Logstash duration management](https://discuss.elastic.co/t/logstash-duration-management/284716)
**Author:** [@simoamarca](https://discuss.elastic.co/u/simoamarca)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 11:57am UTC](https://discuss.elastic.co/t/logstash-duration-management/284716 "2021-09-21T11:57:54Z")
Halloooo, I would like to ask you how to manage, with rubydebug in logstash, durations with format like 07:22:27. I wrote a script.. ruby { # code =\> " # s = event.get('Logon du… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1230) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1232)