# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1236 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1237 --- ## [Searching for null value in kibana](https://discuss.elastic.co/t/searching-for-null-value-in-kibana/284270)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 4\ **Last updated:** [September 17, 2021, 5:51am UTC](https://discuss.elastic.co/t/searching-for-null-value-in-kibana/284270 "2021-09-17T05:51:14Z")
Hi Team, I am trying to search a field with null value which is inside a list. my search filed data ex: doc 1: "response": {"AttrList":\[{},{"Id":"DUE\_DATE","value":"10.05.2021"}\]} doc2: "response": {"AttrList":\[{},… --- ## [How do I combine multiple filters with OR without affecting the score?](https://discuss.elastic.co/t/how-do-i-combine-multiple-filters-with-or-without-affecting-the-score/284349)
**Author:** [@chm](https://discuss.elastic.co/u/chm)\ **Replies:** 2\ **Last updated:** [September 17, 2021, 4:22am UTC](https://discuss.elastic.co/t/how-do-i-combine-multiple-filters-with-or-without-affecting-the-score/284349 "2021-09-17T04:22:18Z")
I want to filter my results with two different clauses aggregated with OR e.g. return documents with PropertyA=true OR PropertyB=true. I've been trying to do this using a bool query. My base query is just a text search … --- ## [QueryContainer is not populated from json passed in to WebApi via \[FromBody\]](https://discuss.elastic.co/t/querycontainer-is-not-populated-from-json-passed-in-to-webapi-via-frombody/283723)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 1\ **Last updated:** [September 17, 2021, 2:16am UTC](https://discuss.elastic.co/t/querycontainer-is-not-populated-from-json-passed-in-to-webapi-via-frombody/283723 "2021-09-17T02:16:18Z")
We are in the process of upgrading Elasticsearch from v 5.0 to v.6.8. We have a webApi that uses Nest (which we also just upgraded). We have an API that has this: \[HttpPost\] \[Route("\_cluster/{indices}")\]… --- ## [Elasticsearch not starting on Cuckoo](https://discuss.elastic.co/t/elasticsearch-not-starting-on-cuckoo/284392)
**Author:** [@brendon04](https://discuss.elastic.co/u/brendon04)\ **Replies:** 1\ **Last updated:** [September 17, 2021, 12:57am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-on-cuckoo/284392 "2021-09-17T00:57:31Z")
Running elasticsearch on Cuckoo Sandbox. After the installation elastic search not able to start. curl -X GET 'http://localhost:9200' returns with connection refused. Firewall is already off. This are the errors appe… --- ## [Filebeat add\_docker\_metadata incompatible](https://discuss.elastic.co/t/filebeat-add-docker-metadata-incompatible/284375)
**Author:** [@Bndlr](https://discuss.elastic.co/u/Bndlr)\ **Replies:** 1\ **Last updated:** [September 17, 2021, 12:35am UTC](https://discuss.elastic.co/t/filebeat-add-docker-metadata-incompatible/284375 "2021-09-17T00:35:44Z")
Hey, i had an Issue with different docker-compose Versions and parse the Metadata. (Infrastructure is: Filebeat -\> Logstash -\> Elasticsearch) First the Error Message from logstash: failed to parse field \[docker.cont… --- ## [Alert for derivative on accumulative value](https://discuss.elastic.co/t/alert-for-derivative-on-accumulative-value/284352)
**Author:** [@NightSpark](https://discuss.elastic.co/u/NightSpark)\ **Replies:** 0\ **Last updated:** [September 16, 2021, 4:12am UTC](https://discuss.elastic.co/t/alert-for-derivative-on-accumulative-value/284352 "2021-09-16T04:12:10Z")
Hi all, I would like to create an alert if the garbage collection time on a JVM takes longer then 20 seconds over any given minute. I have created the below query to work out the derivative however I am struggling to w… --- ## [How to convert elasticsearch index creation date to normal date format](https://discuss.elastic.co/t/how-to-convert-elasticsearch-index-creation-date-to-normal-date-format/284417)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 1\ **Last updated:** [September 16, 2021, 9:14pm UTC](https://discuss.elastic.co/t/how-to-convert-elasticsearch-index-creation-date-to-normal-date-format/284417 "2021-09-16T21:14:39Z")
Hi, Index creation date: 'creation\_date': '1631169602514' how to convert this into a readable format?using python? What is this datetime format? Thank You! --- ## [Logstash with snmp does not run for multiple 'GET' requests](https://discuss.elastic.co/t/logstash-with-snmp-does-not-run-for-multiple-get-requests/284300)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 10\ **Last updated:** [September 16, 2021, 7:42pm UTC](https://discuss.elastic.co/t/logstash-with-snmp-does-not-run-for-multiple-get-requests/284300 "2021-09-16T19:42:53Z")
Good morning everyone, I have a problem when running my configuration file in logstash, it does not show me the metrics that I am requesting with the GET method, I've been doing some tests and I realized that when I try… --- ## [Outputting to Kafka is failing with obscure error](https://discuss.elastic.co/t/outputting-to-kafka-is-failing-with-obscure-error/284429)
**Author:** [@bgingras](https://discuss.elastic.co/u/bgingras)\ **Replies:** 0\ **Last updated:** [September 16, 2021, 7:18pm UTC](https://discuss.elastic.co/t/outputting-to-kafka-is-failing-with-obscure-error/284429 "2021-09-16T19:18:41Z")
I am using a Kafka output plugin to send syslogs to a topic but am encountering errors: \[org.apache.kafka.common.protocol.Errors\]\[main\] Unexpected error code: 87. As well as the following: KafkaProducer.send() failed… --- ## [SQSSNSS3 plugin error queue not valid for endpoint](https://discuss.elastic.co/t/sqssnss3-plugin-error-queue-not-valid-for-endpoint/282685)
**Author:** [@afoster](https://discuss.elastic.co/u/afoster)\ **Replies:** 39\ **Last updated:** [September 16, 2021, 6:14pm UTC](https://discuss.elastic.co/t/sqssnss3-plugin-error-queue-not-valid-for-endpoint/282685 "2021-09-16T18:14:13Z")
cannot establish connection to amazon SQS the address https://sqs.us-gov-east-1.amazonaws is not valid for this endpoint. is there any options or suggestions to troubleshoot this further --- ## [When do you run the filebeat setup command?](https://discuss.elastic.co/t/when-do-you-run-the-filebeat-setup-command/284419)
**Author:** [@user8753123](https://discuss.elastic.co/u/user8753123)\ **Replies:** 4\ **Last updated:** [September 16, 2021, 5:54pm UTC](https://discuss.elastic.co/t/when-do-you-run-the-filebeat-setup-command/284419 "2021-09-16T17:54:12Z")
This is a general question that is probably more obvious to others than to me, sorry in advance. Question: When do you run the filebeat setup command under the below scenario's? I know based on this great answer (thank… --- ## [ElasticSearch / Solr dis\_max query skipping matching clauses](https://discuss.elastic.co/t/elasticsearch-solr-dis-max-query-skipping-matching-clauses/284427)
**Author:** [@andreaschiffo](https://discuss.elastic.co/u/andreaschiffo)\ **Replies:** 0\ **Last updated:** [September 16, 2021, 5:43pm UTC](https://discuss.elastic.co/t/elasticsearch-solr-dis-max-query-skipping-matching-clauses/284427 "2021-09-16T17:43:22Z")
I have an Elasticsearch index on one shard, for which I'm running a \[dis\_max\]\[4\] query that, given some user details (First Name, Last Name, Date of Birth, Address, Phone, Username, Email etc.) queries users from an in… --- ## [ElasticSearch pick one product from each category with top score](https://discuss.elastic.co/t/elasticsearch-pick-one-product-from-each-category-with-top-score/283977)
**Author:** [@dilkash\_manghani](https://discuss.elastic.co/u/dilkash_manghani)\ **Replies:** 5\ **Last updated:** [September 16, 2021, 5:22pm UTC](https://discuss.elastic.co/t/elasticsearch-pick-one-product-from-each-category-with-top-score/283977 "2021-09-16T17:22:51Z")
I am trying to query ES index which contains product information, having product\_id, category\_id and variant\_id fields. Each product belong to certain category and variant: { "product\_id" : "PRODUCT\_12345", "cat… --- ## [Upgrade Path for very old version](https://discuss.elastic.co/t/upgrade-path-for-very-old-version/284309)
**Author:** [@AlanM](https://discuss.elastic.co/u/AlanM)\ **Replies:** 3\ **Last updated:** [September 16, 2021, 4:56pm UTC](https://discuss.elastic.co/t/upgrade-path-for-very-old-version/284309 "2021-09-16T16:56:57Z")
Hi, I have recently inherited an ELK stack 1.3.2/1.4.2/3.01 which will be moved to new platforms and upgraded at the same time. Is there any documentation around upgrading something so old ? Also, I'd want to remove a… --- ## [Watcher: How can I send email alert only when the difference of actual and typical is greater than X](https://discuss.elastic.co/t/watcher-how-can-i-send-email-alert-only-when-the-difference-of-actual-and-typical-is-greater-than-x/284304)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [September 16, 2021, 4:17pm UTC](https://discuss.elastic.co/t/watcher-how-can-i-send-email-alert-only-when-the-difference-of-actual-and-typical-is-greater-than-x/284304 "2021-09-16T16:17:59Z")
How can I send email alert only when the difference of actual and typical is greater than X? this is my watch: { "trigger": { "schedule": { "interval": "5m" } }, "input": { "search… --- ## [How beats behave during agent upgradation and installation failed?](https://discuss.elastic.co/t/how-beats-behave-during-agent-upgradation-and-installation-failed/284058)
**Author:** [@Nehal\_Mahida](https://discuss.elastic.co/u/Nehal_Mahida)\ **Replies:** 4\ **Last updated:** [September 16, 2021, 4:03pm UTC](https://discuss.elastic.co/t/how-beats-behave-during-agent-upgradation-and-installation-failed/284058 "2021-09-16T16:03:11Z")
Hi all, I am new to elastic agents and beats. I wish to know how beats support rollback or do it support? Here are my questions. What happens when agent installation failed in between (suppose filebeat is installed a… --- ## [Encryption between filebeat and Elastic Service?](https://discuss.elastic.co/t/encryption-between-filebeat-and-elastic-service/284060)
**Author:** [@Chinnu](https://discuss.elastic.co/u/Chinnu)\ **Replies:** 10\ **Last updated:** [September 16, 2021, 2:33pm UTC](https://discuss.elastic.co/t/encryption-between-filebeat-and-elastic-service/284060 "2021-09-16T14:33:32Z")
Hello, When filebeat uses cloud.id and api\_key fields, is the connection between filebeat and ElasticCloud encrypted ? Has anyone already checked this before ? It would be helpful if you can point me to related documen… --- ## [Vega scrollbar](https://discuss.elastic.co/t/vega-scrollbar/283941)
**Author:** [@prkd](https://discuss.elastic.co/u/prkd)\ **Replies:** 1\ **Last updated:** [September 16, 2021, 2:41pm UTC](https://discuss.elastic.co/t/vega-scrollbar/283941 "2021-09-16T14:41:40Z")
Do we still not have a scrollbar on Vega Visualizations ? Is there some other way I can achieve to view the whole tree that I am trying to visualize on Kibana? I am trying to build this Tree Layout Example | Vega on Ki… --- ## [Where can find doc for winlogbeat processor](https://discuss.elastic.co/t/where-can-find-doc-for-winlogbeat-processor/284344)
**Author:** [@xizhimen](https://discuss.elastic.co/u/xizhimen)\ **Replies:** 1\ **Last updated:** [September 16, 2021, 2:39pm UTC](https://discuss.elastic.co/t/where-can-find-doc-for-winlogbeat-processor/284344 "2021-09-16T14:39:58Z")
background: winlogbeat 7.3.2 I see follows code in winlogbeat's security.js (winlogbeat-7.3.2\\module\\security\\config\\security.js) var security = (function () { var path = require("path"); var processor = requ… --- ## [Connect via SSH with client through PuTTy](https://discuss.elastic.co/t/connect-via-ssh-with-client-through-putty/284339)
**Author:** [@twang](https://discuss.elastic.co/u/twang)\ **Replies:** 2\ **Last updated:** [September 16, 2021, 2:21pm UTC](https://discuss.elastic.co/t/connect-via-ssh-with-client-through-putty/284339 "2021-09-16T14:21:10Z")
I am new to Elasticsearch. I have Elasticsearch (Self-Managed) deployed on Azure. esdata0 and esdata1 Azure Linux VM. I am able to connect esdata0 via SSH through PuTTy on my pc. Because esdata0 has a public IP. I cannot… --- ## [Exclusão de Index no elasticsearch via logstash](https://discuss.elastic.co/t/exclusao-de-index-no-elasticsearch-via-logstash/283302)
**Author:** [@lucianojr](https://discuss.elastic.co/u/lucianojr)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 3:57pm UTC](https://discuss.elastic.co/t/exclusao-de-index-no-elasticsearch-via-logstash/283302 "2021-09-03T15:57:07Z")
Olá a todos. Estamos iniciando o uso da elastic. Estou precisando saber como faço para fazer a exclusão de um index no elasticsearch, porém, via logstash, e após fazer a nova carga das informações. Caso não seja possível… --- ## [Error: fail to enroll: fail to execute request to fleet-server: status code: 400](https://discuss.elastic.co/t/error-fail-to-enroll-fail-to-execute-request-to-fleet-server-status-code-400/284406)
**Author:** [@b0r1s](https://discuss.elastic.co/u/b0r1s)\ **Replies:** 0\ **Last updated:** [September 16, 2021, 1:23pm UTC](https://discuss.elastic.co/t/error-fail-to-enroll-fail-to-execute-request-to-fleet-server-status-code-400/284406 "2021-09-16T13:23:49Z")
I'm trying to install Elastic Agent 7.14.1 on Fleet Server 7.14.1 with the following commands: On Windows 10: .\\elastic-agent.exe install -f --url=https://myfleetserver:8220 --enrollment-token=longapitoken --insecure O… --- ## [Cluster Health status is Red](https://discuss.elastic.co/t/cluster-health-status-is-red/284320)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 3\ **Last updated:** [September 16, 2021, 1:19pm UTC](https://discuss.elastic.co/t/cluster-health-status-is-red/284320 "2021-09-16T13:19:40Z")
I am establishing a cluster: 1 master node + 1 backup node. The cluster health status is red. curl -X GET "localhost:9200/\_cluster/health?pretty" { "cluster\_name" : "Elasticsearch", "status" : "red", "timed\_out" : f… --- ## [Kibana error on migration saved-object](https://discuss.elastic.co/t/kibana-error-on-migration-saved-object/284098)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 23\ **Last updated:** [September 16, 2021, 10:56am UTC](https://discuss.elastic.co/t/kibana-error-on-migration-saved-object/284098 "2021-09-16T10:56:15Z")
How can I add memory on kibana, for solving problem on saved\_object? I create more than one topic but I've not received any response. --- ## [Timeout on Kibana Snapshots](https://discuss.elastic.co/t/timeout-on-kibana-snapshots/283884)
**Author:** [@xacobecm](https://discuss.elastic.co/u/xacobecm)\ **Replies:** 1\ **Last updated:** [September 16, 2021, 10:14am UTC](https://discuss.elastic.co/t/timeout-on-kibana-snapshots/283884 "2021-09-16T10:14:17Z")
When I go to Stack Management \> Snapshot and Restore, this screen is displayed after 30 seconds. The request implicated is app/management/data/snapshot\_restore/snapshots, which returns the following JSON after exactl… --- ## [BIG Url : 25k character reached](https://discuss.elastic.co/t/big-url-25k-character-reached/284259)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 2\ **Last updated:** [September 16, 2021, 8:46am UTC](https://discuss.elastic.co/t/big-url-25k-character-reached/284259 "2021-09-16T08:46:58Z")
Hello, We have a big clickable dashboard on Kibana 7.5. So when we click on one of the parts, we have error : Big url, 25k character reached. How we can increase this limit ? Thanks for help. Best Regards. --- ## [\[heartbeat\]add feature to enable publisher processor or other processors' debug log for just specific targets](https://discuss.elastic.co/t/heartbeat-add-feature-to-enable-publisher-processor-or-other-processors-debug-log-for-just-specific-targets/281374)
**Author:** [@lowry](https://discuss.elastic.co/u/lowry)\ **Replies:** 3\ **Last updated:** [September 16, 2021, 8:26am UTC](https://discuss.elastic.co/t/heartbeat-add-feature-to-enable-publisher-processor-or-other-processors-debug-log-for-just-specific-targets/281374 "2021-09-16T08:26:56Z")
Hey Elastic friends, Obviously, there’s some basic and amazing debug features in Elastic heartbeat, however we met a user case these days that current debug features cannot handle it. Given this example, since we have… --- ## [Filebeat custom plugin](https://discuss.elastic.co/t/filebeat-custom-plugin/284222)
**Author:** [@jpchev](https://discuss.elastic.co/u/jpchev)\ **Replies:** 1\ **Last updated:** [September 16, 2021, 8:23am UTC](https://discuss.elastic.co/t/filebeat-custom-plugin/284222 "2021-09-16T08:23:45Z")
hi there, I'm trying to compile myself filebeat after adding a custom http output plugin: I've followed and then I've added a new folder with my pluing into src/github.com/elastic/beats/libbeat now I can compile fil… --- ## [The default\_operator=AND not working with multi queries in elasticsearch](https://discuss.elastic.co/t/the-default-operator-and-not-working-with-multi-queries-in-elasticsearch/284151)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 11\ **Last updated:** [September 15, 2021, 12:06pm UTC](https://discuss.elastic.co/t/the-default-operator-and-not-working-with-multi-queries-in-elasticsearch/284151 "2021-09-15T12:06:04Z")
I want to search for 2 queries in different fields using elasticsearch like this: http://localhost:9200/ncar\_index/ncar/\_search?q=approvetool:مرسوم ملكي AND category:الأنظمة&size=100&sort=date:desc&default\_operator=AND … --- ## [How to figure what what is using so much CPU and memory in Elastic Search?](https://discuss.elastic.co/t/how-to-figure-what-what-is-using-so-much-cpu-and-memory-in-elastic-search/282202)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 41\ **Last updated:** [September 16, 2021, 7:59am UTC](https://discuss.elastic.co/t/how-to-figure-what-what-is-using-so-much-cpu-and-memory-in-elastic-search/282202 "2021-09-16T07:59:47Z")
Hello Im looking at the logs and such but nothing really calls out why my Elastic is running out of memory and CPU. There is nothing huge size wise and nothing consuming ALL of the CPU. Where would be a good log to vi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1235) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1237)