# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1250 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1251 --- ## [How to assign \_score value to some other field using script\_fields](https://discuss.elastic.co/t/how-to-assign-score-value-to-some-other-field-using-script-fields/283531)
**Author:** [@voldemort02](https://discuss.elastic.co/u/voldemort02)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 12:43pm UTC](https://discuss.elastic.co/t/how-to-assign-score-value-to-some-other-field-using-script-fields/283531 "2021-09-07T12:43:45Z")
I would like to inject \_score in my \_source on runtime. I used this script but it is not working "script\_fields": { "\_score": { "script": { "lang": "painless", "source": "\_score.value" }… --- ## [Index Speed Capped but Missing ASA logs](https://discuss.elastic.co/t/index-speed-capped-but-missing-asa-logs/283307)
**Author:** [@Micah\_Barsness](https://discuss.elastic.co/u/Micah_Barsness)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 12:15pm UTC](https://discuss.elastic.co/t/index-speed-capped-but-missing-asa-logs/283307 "2021-09-07T12:15:24Z")
Our current set up is Elasticsearch, Filebeat, and Kibana on the same server for dev purposes (hoping to move to 3 nodes & gold licensing next year) - We are using the cisco.yml module in filebeat to receive ASA … --- ## [Is it possible to have calculation on aggregation](https://discuss.elastic.co/t/is-it-possible-to-have-calculation-on-aggregation/283359)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 12:07pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-calculation-on-aggregation/283359 "2021-09-07T12:07:56Z")
Hi i have a requirement wherein on host metric i want , mount point , total, used\_bytes, used\_pct in tsvb but it is not showing in table timeseries option I did a workaround by having multiple max of metric total, … --- ## [Pulse Secure integration](https://discuss.elastic.co/t/pulse-secure-integration/283501)
**Author:** [@tkarczewski](https://discuss.elastic.co/u/tkarczewski)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 11:24am UTC](https://discuss.elastic.co/t/pulse-secure-integration/283501 "2021-09-07T11:24:56Z")
Hi, How to create integration for Pulse Secure Connect? --- ## [Creating Table Visualization with 3 indices](https://discuss.elastic.co/t/creating-table-visualization-with-3-indices/281571)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 11:16am UTC](https://discuss.elastic.co/t/creating-table-visualization-with-3-indices/281571 "2021-09-07T11:16:03Z")
Hi, I'm trying to create a data table with multiple terms aggregations from each index. I've created an index-pattern that matches against the 3 indices that I want to search across, but whenever I create a terms agg fo… --- ## [Fingerprint duplicate hash for different events](https://discuss.elastic.co/t/fingerprint-duplicate-hash-for-different-events/282462)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 10:51am UTC](https://discuss.elastic.co/t/fingerprint-duplicate-hash-for-different-events/282462 "2021-09-07T10:51:11Z")
Hi, I have a strange issue which came to light after starting to use datastreams (and thus create events instead of updates). The following fingerprint config we have in logstash: ### Add a fingerprint to… --- ## [Is it possible to cumulative\_sum over the metric of a moving interval?](https://discuss.elastic.co/t/is-it-possible-to-cumulative-sum-over-the-metric-of-a-moving-interval/283519)
**Author:** [@di.lu](https://discuss.elastic.co/u/di.lu)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 10:15am UTC](https://discuss.elastic.co/t/is-it-possible-to-cumulative-sum-over-the-metric-of-a-moving-interval/283519 "2021-09-07T10:15:31Z")
Hiii ES community! I've been stuck on a tricky requirement for quite a while.. So I have a time series data capturing when a user has used what feature as which identity, lie this: | feature | is\_free\_trial | trac… --- ## [Upgrade from Basic license to Gold License](https://discuss.elastic.co/t/upgrade-from-basic-license-to-gold-license/283499)
**Author:** [@David\_Dennis](https://discuss.elastic.co/u/David_Dennis)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 10:10am UTC](https://discuss.elastic.co/t/upgrade-from-basic-license-to-gold-license/283499 "2021-09-07T10:10:34Z")
Hi, I will like to seek guidance here. I have an Elasticsearch cluster and Kibana, currently an On-prem deployment. I want to enable Alerting, but the basic license does not provide connectors like Slack, Pagerduty, etc… --- ## [Fast ingest](https://discuss.elastic.co/t/fast-ingest/283518)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 9:52am UTC](https://discuss.elastic.co/t/fast-ingest/283518 "2021-09-07T09:52:36Z")
Hello, I have a project where we are considering using elasticsearch for some very high amount of data around 150billion documents/day is there a way we can ingest that amount of data in a real life scenario? I underst… --- ## [Using fleet agent with proxy](https://discuss.elastic.co/t/using-fleet-agent-with-proxy/283517)
**Author:** [@hugohendriks](https://discuss.elastic.co/u/hugohendriks)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 9:51am UTC](https://discuss.elastic.co/t/using-fleet-agent-with-proxy/283517 "2021-09-07T09:51:58Z")
Hi, I am trying to install the elastic agent 7.14.0 on linux. I am behind a proxy so we tried setting the proxy by doing: EXPORT HTTPS\_PROXY=ip:port As I saw Elastic Agent (Fleet Deployment) behind a proxy only I dont… --- ## [TSVB - How to use Annotations: display when a count of field LEVEL exceeds 500](https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812)
**Author:** [@MWLonKso](https://discuss.elastic.co/u/MWLonKso)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 9:26am UTC](https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812 "2021-09-07T09:26:47Z")
Hi there. The premise is pretty simple. I'm counting Events that match one of four possible values for a field called Level. In the TSVB I've split the graph using filters. What I'd like to be able to do is to put an Ann… --- ## [Gauge with dynamic Max and Min value](https://discuss.elastic.co/t/gauge-with-dynamic-max-and-min-value/282335)
**Author:** [@LL\_FED](https://discuss.elastic.co/u/LL_FED)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 9:10am UTC](https://discuss.elastic.co/t/gauge-with-dynamic-max-and-min-value/282335 "2021-09-07T09:10:40Z")
I have Data like this: Max = 10; Min = 5; Value = 8; Is it possible to create a Gauge-Visualisation, where I can define the range (max and min) with my data? --- ## [Kibana sum aggregation not showing the correct values when I use divide in Json Input](https://discuss.elastic.co/t/kibana-sum-aggregation-not-showing-the-correct-values-when-i-use-divide-in-json-input/282473)
**Author:** [@im.manoj](https://discuss.elastic.co/u/im.manoj)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 9:04am UTC](https://discuss.elastic.co/t/kibana-sum-aggregation-not-showing-the-correct-values-when-i-use-divide-in-json-input/282473 "2021-09-07T09:04:38Z")
Hi, I am trying to sum all the values in a column and divide them by 3600. I used Sum Aggregation in order to sum the values in column(totaluptime) then in the Advanced section, I replaced this query, { "script": … --- ## [TSVB two Counts division](https://discuss.elastic.co/t/tsvb-two-counts-division/282331)
**Author:** [@Aaron\_Yu](https://discuss.elastic.co/u/Aaron_Yu)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 8:55am UTC](https://discuss.elastic.co/t/tsvb-two-counts-division/282331 "2021-09-07T08:55:52Z")
Can you help me? How can I draw the line that count2/count1 in this TSVB? --- ## [Index stays at massive size after split](https://discuss.elastic.co/t/index-stays-at-massive-size-after-split/283453)
**Author:** [@rcz](https://discuss.elastic.co/u/rcz)\ **Replies:** 5\ **Last updated:** [September 7, 2021, 8:50am UTC](https://discuss.elastic.co/t/index-stays-at-massive-size-after-split/283453 "2021-09-07T08:50:26Z")
Hi, I had mistakenly made a very large index: 1 shard of 406 GB (1.8b documents). Then I split it into 16 shards hoping to get ~25GB sizes. I think the new index triggered a template, since it also got 1 replica shard… --- ## [Client SSL and Server SSL - ES Java Client](https://discuss.elastic.co/t/client-ssl-and-server-ssl-es-java-client/283507)
**Author:** [@Muthukumaran\_Kothand](https://discuss.elastic.co/u/Muthukumaran_Kothand)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 8:40am UTC](https://discuss.elastic.co/t/client-ssl-and-server-ssl-es-java-client/283507 "2021-09-07T08:40:59Z")
Initial excuse - we are still using TransportClient ( PreBuiltXPackTransportClient). Migrating to High Level Rest Client is in progress. This question would still be relevant for High Level Rest Client Meta: Elasticse… --- ## [Rate\_1min keeps dropping for my kafka to s3 batching on logstash](https://discuss.elastic.co/t/rate-1min-keeps-dropping-for-my-kafka-to-s3-batching-on-logstash/283508)
**Author:** [@Varsha1](https://discuss.elastic.co/u/Varsha1)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 8:45am UTC](https://discuss.elastic.co/t/rate-1min-keeps-dropping-for-my-kafka-to-s3-batching-on-logstash/283508 "2021-09-07T08:45:22Z")
I'm trying to transfer data from kafka to s3, without any data transformation filters. I added metrics filter plugin to calculate the rate of transfer, which keeps falling from ~16k to as low as ~3k. Is this expected an… --- ## [How do I use Elasticsearch aggregation using python elasticsearch\_dsl library?](https://discuss.elastic.co/t/how-do-i-use-elasticsearch-aggregation-using-python-elasticsearch-dsl-library/283345)
**Author:** [@rafiqul](https://discuss.elastic.co/u/rafiqul)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 8:42am UTC](https://discuss.elastic.co/t/how-do-i-use-elasticsearch-aggregation-using-python-elasticsearch-dsl-library/283345 "2021-09-07T08:42:13Z")
I have a python model that creates the index as class Telemetry(DocType): id = Keyword() imei = Keyword() location = field.GeoPoint() timestamp = Date() I would like to query distinct count of imei. Wha… --- ## [Kibana 7.10 searching with special characters and wildcard](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 8:40am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397 "2021-09-07T08:40:48Z")
I want to use \* with some special characters. e.g. url.path: "/apis/aa.bb.io/v1/checking"\* and user: "system"\* keep getting the error messages: KQLSyntaxError: Expected AND, OR, end of input, whitespace but "" found. … --- ## [Compare/Merge 2 type of dataset](https://discuss.elastic.co/t/compare-merge-2-type-of-dataset/282624)
**Author:** [@Peter\_Ch](https://discuss.elastic.co/u/Peter_Ch)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 8:22am UTC](https://discuss.elastic.co/t/compare-merge-2-type-of-dataset/282624 "2021-09-07T08:22:37Z")
Dear All, I user winlogbeat to collet my window log which include username. And I have a csv file which contain the username and user department. May I know is it possible to compare those datasets username field, if th… --- ## [MIgrate ELK setup from cloud to on-prem](https://discuss.elastic.co/t/migrate-elk-setup-from-cloud-to-on-prem/283503)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 8:09am UTC](https://discuss.elastic.co/t/migrate-elk-setup-from-cloud-to-on-prem/283503 "2021-09-07T08:09:33Z")
Hi, I currently have elk setup on cloud and want to replicate it on onprem and remove cloud setup. I want to migrate development part like dashboards, index-patterns, users created etc. Will vm snapshot backup restore… --- ## [Logstash udp input listen on port 5044 but doesn't receive syslog messages](https://discuss.elastic.co/t/logstash-udp-input-listen-on-port-5044-but-doesnt-receive-syslog-messages/283496)
**Author:** [@kiran80511](https://discuss.elastic.co/u/kiran80511)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 7:17am UTC](https://discuss.elastic.co/t/logstash-udp-input-listen-on-port-5044-but-doesnt-receive-syslog-messages/283496 "2021-09-07T07:17:57Z")
I have tried with this command tcpdump -vvv -A -i any port 5044 It receive the syslog messages 12:41:34.438831 IP (tos 0x0, ttl 128, id 37582, offset 0, flags \[none\], proto UDP (17), length 374) gateway.lxi-evntsv… --- ## [Search performance difference between from&size and search&after](https://discuss.elastic.co/t/search-performance-difference-between-from-size-and-search-after/283400)
**Author:** [@MarvinLiu](https://discuss.elastic.co/u/MarvinLiu)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 7:16am UTC](https://discuss.elastic.co/t/search-performance-difference-between-from-size-and-search-after/283400 "2021-09-07T07:16:43Z")
There are hundreds of millions of documents in my index. When I search, I find that search&after is much slower than from&size。 Use from&size，search is quick，took several ms return，but use search after，it took 20 seconds… --- ## [Misplaced codec footer keystore](https://discuss.elastic.co/t/misplaced-codec-footer-keystore/283493)
**Author:** [@itslogesh](https://discuss.elastic.co/u/itslogesh)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 6:59am UTC](https://discuss.elastic.co/t/misplaced-codec-footer-keystore/283493 "2021-09-07T06:59:12Z")
org.apache.lucene.index.CorruptIndexException: misplaced codec footer (file extended?): remaining=17, expected=16, fp=183 (resource=BufferedChecksumIndexInput(SimpleFSIndexInput(path="/etc/elasticsearch/elasticsearch.key… --- ## [Auditbeat PATH](https://discuss.elastic.co/t/auditbeat-path/283471)
**Author:** [@jam\_mahmoudi](https://discuss.elastic.co/u/jam_mahmoudi)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 5:21am UTC](https://discuss.elastic.co/t/auditbeat-path/283471 "2021-09-07T05:21:22Z")
Hi guys I have installed and configured َAuditbeat to check a series of specific files and folders in Windows َServer Auditbeat works and Running But when I add the D and E drives to Auditbeat.yml file , the servi… --- ## [Elasticsearch data to mysql](https://discuss.elastic.co/t/elasticsearch-data-to-mysql/283488)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 5:13am UTC](https://discuss.elastic.co/t/elasticsearch-data-to-mysql/283488 "2021-09-07T05:13:35Z")
Hi :grinning: My data is in elasticsearch. I want to use logstash to synchronize to MySQL, or use other tools. What can I do to achieve it？ --- ## [How to use api/shorten\_url?](https://discuss.elastic.co/t/how-to-use-api-shorten-url/283423)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 5:06am UTC](https://discuss.elastic.co/t/how-to-use-api-shorten-url/283423 "2021-09-07T05:06:21Z")
Examples in the documentation: # curl -H "kbn-xsrf: reporting" -XPOST http://192.168.10.148:5601/api/shorten\_url -d ' \> { \> "url": "/app/kibana#/dashboard?\_g=()&\_a=(description:'',filters:!(),fullScreenMode:!f,option… --- ## [Add large attachments from S3 to Elastic Search](https://discuss.elastic.co/t/add-large-attachments-from-s3-to-elastic-search/283452)
**Author:** [@Reghu\_Shanker](https://discuss.elastic.co/u/Reghu_Shanker)\ **Replies:** 5\ **Last updated:** [September 7, 2021, 3:37am UTC](https://discuss.elastic.co/t/add-large-attachments-from-s3-to-elastic-search/283452 "2021-09-07T03:37:42Z")
Hi, I have large pdf files which are located in AWS S3 which needs to be indexed and searchable. I want to upload these files to elastic search. The files need to be uploaded as single documents. How can I do this from… --- ## [Mock RestHighLevelClient for elasticsearch](https://discuss.elastic.co/t/mock-resthighlevelclient-for-elasticsearch/283465)
**Author:** [@romeoopk](https://discuss.elastic.co/u/romeoopk)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 3:35am UTC](https://discuss.elastic.co/t/mock-resthighlevelclient-for-elasticsearch/283465 "2021-09-07T03:35:06Z")
HI I would like to test my rest api in quarkus which internally calls elasticsearch using RestHighLevelClient. My problem is that the RestHighLevelClient is not mockable and hence I cannot execute my unit test to test … --- ## [Cannot create ingest pipeline(iis, nginx) \[Filebeat 7.14.0 + Elasticsearch 7.8.1\]](https://discuss.elastic.co/t/cannot-create-ingest-pipeline-iis-nginx-filebeat-7-14-0-elasticsearch-7-8-1/283394)
**Author:** [@Bingu\_Shim](https://discuss.elastic.co/u/Bingu_Shim)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 3:15am UTC](https://discuss.elastic.co/t/cannot-create-ingest-pipeline-iis-nginx-filebeat-7-14-0-elasticsearch-7-8-1/283394 "2021-09-07T03:15:39Z")
Hi I was using filebeat 7.7.1 with Elasticsearch 7.8.1 and had no problem with collecting iis and nginx logs. But, when I upgraded filebeat from 7.7.1 to 7.14.0 I got these errors logs from Elasticsearch. {"type": "se… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1249) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1251)