# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1266 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1267 --- ## [Alert on changes](https://discuss.elastic.co/t/alert-on-changes/280790)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 1:56pm UTC](https://discuss.elastic.co/t/alert-on-changes/280790 "2021-08-25T13:56:35Z")
Hello, i have 1 index which is filled once a day with some values. I have to create an alert only if a value is added which was not present in the day before. how to archive this? any ideas? thanks --- ## [Kibana/ES too slow - Discover view](https://discuss.elastic.co/t/kibana-es-too-slow-discover-view/281990)
**Author:** [@Atesrin](https://discuss.elastic.co/u/Atesrin)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 1:53pm UTC](https://discuss.elastic.co/t/kibana-es-too-slow-discover-view/281990 "2021-08-25T13:53:00Z")
Hi everyone, I try since few weeks to optimize my Kibana/ELK because it's really slow, and I really don't know what can I do more now :(. When I update the Discover view, from one date to another by example, it takes m… --- ## [Kibana Actions not working?](https://discuss.elastic.co/t/kibana-actions-not-working/280772)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 1:48pm UTC](https://discuss.elastic.co/t/kibana-actions-not-working/280772 "2021-08-25T13:48:30Z")
Alerts status is changing but its not sending action to the index that I have created. I am using index threshold alert. I am also attaching screen shots. --- ## [Search\_after query doesn't return correct results for pagination](https://discuss.elastic.co/t/search-after-query-doesnt-return-correct-results-for-pagination/281999)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 1:45pm UTC](https://discuss.elastic.co/t/search-after-query-doesnt-return-correct-results-for-pagination/281999 "2021-08-25T13:45:03Z")
I have a process that queries the watcher-history indices for a specified time, and the amount of results is over 10000 docs, which is the limit. So I tried to use the search\_after query, after adding a sort value, but t… --- ## [Transaction error rate threshold alert are not editable filed for kibana 7.14](https://discuss.elastic.co/t/transaction-error-rate-threshold-alert-are-not-editable-filed-for-kibana-7-14/281287)
**Author:** [@prashant.j.singh](https://discuss.elastic.co/u/prashant.j.singh)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 1:38pm UTC](https://discuss.elastic.co/t/transaction-error-rate-threshold-alert-are-not-editable-filed-for-kibana-7-14/281287 "2021-08-25T13:38:39Z")
I am using elasticserch : 7.14 and Kibana 7.14 I am not able edit alert detail in Transaction error rate threshold: these filed are not edit and showing fixed value. -- 30 % , 5 min and ALL. Environment , IS ABOVE 30… --- ## [Alert checking for 0 documents stopped firing](https://discuss.elastic.co/t/alert-checking-for-0-documents-stopped-firing/282312)
**Author:** [@wlbsxnlp22](https://discuss.elastic.co/u/wlbsxnlp22)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 1:28pm UTC](https://discuss.elastic.co/t/alert-checking-for-0-documents-stopped-firing/282312 "2021-08-25T13:28:17Z")
Hi, We have been running an alert that checks for 0 new documents over a specific time and sends an email. This worked fine but seems to have stopped working right after we updated our stack to 7.13.4. The email functi… --- ## [Get all items](https://discuss.elastic.co/t/get-all-items/282386)
**Author:** [@Nastya.JavaScript\_Ko](https://discuss.elastic.co/u/Nastya.JavaScript_Ko)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 1:11pm UTC](https://discuss.elastic.co/t/get-all-items/282386 "2021-08-25T13:11:39Z")
Hey! First time I work with elastic. I have a request like this - but it does not return data after August 10th. { "query": { "bool": { "must\_not": \[ { "term": { … --- ## [ILM template and index pattern](https://discuss.elastic.co/t/ilm-template-and-index-pattern/282385)
**Author:** [@Sherabu](https://discuss.elastic.co/u/Sherabu)\ **Replies:** 5\ **Last updated:** [August 25, 2021, 12:27pm UTC](https://discuss.elastic.co/t/ilm-template-and-index-pattern/282385 "2021-08-25T12:27:05Z")
Hi friend, my architecture is filebeat will send data to logstash. Logstash will send data to Kibana and kibana will visualize. My index is like below Myindex-team1 Myindex-team2 Myindex-team3 Yourindex-team1 Yourindex-… --- ## [Include Exim main log](https://discuss.elastic.co/t/include-exim-main-log/282243)
**Author:** [@BaseSL](https://discuss.elastic.co/u/BaseSL)\ **Replies:** 7\ **Last updated:** [August 25, 2021, 9:01am UTC](https://discuss.elastic.co/t/include-exim-main-log/282243 "2021-08-25T09:01:22Z")
Hello, how can I, in the current version, include the Exim log and search entries via Kibana ? About Filebeat I can transfer the log into Kibana, but there the assignment is not correct. So what do I have to set, that … --- ## [Fields, keywords and text](https://discuss.elastic.co/t/fields-keywords-and-text/282422)
**Author:** [@iLemming](https://discuss.elastic.co/u/iLemming)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 11:37am UTC](https://discuss.elastic.co/t/fields-keywords-and-text/282422 "2021-08-25T11:37:40Z")
I'm dealing with a headache where it seems I can't find the correct set of parameters for the analyzer. So here's the problem: I have an index where some fields are type of text and some fields are "type": "keyword". L… --- ## [Problem with if statement in GROK filter](https://discuss.elastic.co/t/problem-with-if-statement-in-grok-filter/282466)
**Author:** [@vp096](https://discuss.elastic.co/u/vp096)\ **Replies:** 4\ **Last updated:** [August 25, 2021, 11:27am UTC](https://discuss.elastic.co/t/problem-with-if-statement-in-grok-filter/282466 "2021-08-25T11:27:13Z")
Hello, I send syslog data from a WiFi controller to ElasticSearch. This controller sends me different types of packets and I want to keep only the packets of this type: Aug 25 11:19:50 2021 MC72-WI-AS1-06-B authmgr\[364… --- ## [Metricbeat 401 error after enabling TLS](https://discuss.elastic.co/t/metricbeat-401-error-after-enabling-tls/281986)
**Author:** [@Greg\_R](https://discuss.elastic.co/u/Greg_R)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 11:14am UTC](https://discuss.elastic.co/t/metricbeat-401-error-after-enabling-tls/281986 "2021-08-25T11:14:44Z")
Greetings I've setup ElasticSearch, Kibana and Metricbeat on http and it's working. Now I want to enable API keys, so I have to enable TLS (although I don't understand why). So I got ES and Kibana working together, bu… --- ## [Config validation of \[xpack.security\].authc.providers](https://discuss.elastic.co/t/config-validation-of-xpack-security-authc-providers/282258)
**Author:** [@etrpchevska](https://discuss.elastic.co/u/etrpchevska)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 10:54am UTC](https://discuss.elastic.co/t/config-validation-of-xpack-security-authc-providers/282258 "2021-08-25T10:54:45Z")
I am trying to setup SSO authentication with Azure AD. elasticsearch.yml: | cluster.name: dev-observability network.host: "0.0.0.0" bootstrap.memory\_lock: false discovery.zen.ping.unicast.hosts: es-clust… --- ## [Limiting the number of documents for each bucket in term aggregation](https://discuss.elastic.co/t/limiting-the-number-of-documents-for-each-bucket-in-term-aggregation/281818)
**Author:** [@menshenin](https://discuss.elastic.co/u/menshenin)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 10:37am UTC](https://discuss.elastic.co/t/limiting-the-number-of-documents-for-each-bucket-in-term-aggregation/281818 "2021-08-25T10:37:34Z")
Hi, There is a set of terms. I want to know which ones are present in the search results and I use term aggregation for this purpose. Is there some way to limit the number of documents for each bucket in term aggregati… --- ## [How can I disable or uninstall x-pack in Elasticsearch 7.14](https://discuss.elastic.co/t/how-can-i-disable-or-uninstall-x-pack-in-elasticsearch-7-14/282472)
**Author:** [@peterhajdu](https://discuss.elastic.co/u/peterhajdu)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 10:34am UTC](https://discuss.elastic.co/t/how-can-i-disable-or-uninstall-x-pack-in-elasticsearch-7-14/282472 "2021-08-25T10:34:06Z")
Hi, we are about to switch from elasticsearch-oss 7.7 to elasticsearch 7.14. Elasticsearch 7.14 contains x-pack by default but we do not intend to use any functionality that the oss version did not contain. Is it poss… --- ## [Logstash Monitoring and AWS PrivateLink (Elastic Cloud)](https://discuss.elastic.co/t/logstash-monitoring-and-aws-privatelink-elastic-cloud/282338)
**Author:** [@nick\_cgi](https://discuss.elastic.co/u/nick_cgi)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 10:16am UTC](https://discuss.elastic.co/t/logstash-monitoring-and-aws-privatelink-elastic-cloud/282338 "2021-08-25T10:16:24Z")
I have an Elastic Cloud instance, set to deploy in AWS (v7.13.x). Additionally, I have Logstash (v7.13.4) running within an AWS account, which is in the same region as the Elastic Cloud instance. In order to get Logsta… --- ## [Restful API query string has http 500 error code](https://discuss.elastic.co/t/restful-api-query-string-has-http-500-error-code/281808)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:15am UTC](https://discuss.elastic.co/t/restful-api-query-string-has-http-500-error-code/281808 "2021-08-25T10:15:17Z")
The query String in Kibana is : system:APC AND host: F12\*R2R\* AND message:"Turn to Phase \[F12P7\]", and I want to query through Restful API like below: String bodycontent="{" +" \\"\_source\\": \[\\"@timestamp\\",\\"eqp… --- ## [Routing with Java Client UpdateRequests not working](https://discuss.elastic.co/t/routing-with-java-client-updaterequests-not-working/281819)
**Author:** [@redbow](https://discuss.elastic.co/u/redbow)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:09am UTC](https://discuss.elastic.co/t/routing-with-java-client-updaterequests-not-working/281819 "2021-08-25T10:09:10Z")
Hey dear Elasticsearch community, I would like to send an UpdateRequest with the Java REST Client (7.13) to Elasticsearch using the .routing() request parameter, because I am updating a join field. It seems, using this … --- ## [Elasticsearch.Net, search gets really slow when one of three nodes are shut down](https://discuss.elastic.co/t/elasticsearch-net-search-gets-really-slow-when-one-of-three-nodes-are-shut-down/281855)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-net-search-gets-really-slow-when-one-of-three-nodes-are-shut-down/281855 "2021-08-18T15:52:09Z")
Hi! I have a three node cluster on a 7.11.1 Elastic and then I have a .net website doing searches against the index. Everything works just fine but when I shut down one node the search takes about 60 seconds. It feels l… --- ## [Date Histogram Aggregation with predefined number of buckets possible?](https://discuss.elastic.co/t/date-histogram-aggregation-with-predefined-number-of-buckets-possible/281880)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:03am UTC](https://discuss.elastic.co/t/date-histogram-aggregation-with-predefined-number-of-buckets-possible/281880 "2021-08-25T10:03:22Z")
I would like to get an aggregation to build a histogram off of a date field, but I would like to predefine the EXACT number of buckets to use. So for example if I have data indexed for June 1st and I ask for 10 buckets … --- ## [Wordpress installation with elasticsearch](https://discuss.elastic.co/t/wordpress-installation-with-elasticsearch/281907)
**Author:** [@Arman\_Ali\_Fokir](https://discuss.elastic.co/u/Arman_Ali_Fokir)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:02am UTC](https://discuss.elastic.co/t/wordpress-installation-with-elasticsearch/281907 "2021-08-25T10:02:20Z")
Sir, I create an elastic search cluster using three nodes. There I set up a master node. Now my question is where do I install the WordPress website? Should I install websites on master nodes or data nodes or all nodes… --- ## [Create an index if not exist and add a document to it](https://discuss.elastic.co/t/create-an-index-if-not-exist-and-add-a-document-to-it/281945)
**Author:** [@ChenChuang](https://discuss.elastic.co/u/ChenChuang)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:00am UTC](https://discuss.elastic.co/t/create-an-index-if-not-exist-and-add-a-document-to-it/281945 "2021-08-25T10:00:15Z")
I tried to dynamically create an index (if not exist) with static mapping, then added a document to it immediately. After that, I checked mapping of the index and found that the mapping is not what I described in request… --- ## [Isochrone visualization in kibana](https://discuss.elastic.co/t/isochrone-visualization-in-kibana/282455)
**Author:** [@marrel](https://discuss.elastic.co/u/marrel)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 9:55am UTC](https://discuss.elastic.co/t/isochrone-visualization-in-kibana/282455 "2021-08-25T09:55:10Z")
Hi! I am wondering if there is any way to create isochrone visualization in Kibana as the following screenshot: I want to use traveltime data and plot them like the above visualization. Any advice would be valuable.… --- ## [Filter on 2 indices](https://discuss.elastic.co/t/filter-on-2-indices/282098)
**Author:** [@dgastudio](https://discuss.elastic.co/u/dgastudio)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 9:51am UTC](https://discuss.elastic.co/t/filter-on-2-indices/282098 "2021-08-25T09:51:48Z")
Hello! i have 2 indices, users and employee\_shift users "created": "1618153891", "changed": null, "uuid": "", "uid:uuid": "1629cbdf-e7fa-41e6-b3a2-ab29a1a77401", "acc": 57, "name": "spashogolut", "role": "Genera… --- ## [Search by datetime range query](https://discuss.elastic.co/t/search-by-datetime-range-query/282463)
**Author:** [@rehannali](https://discuss.elastic.co/u/rehannali)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 9:51am UTC](https://discuss.elastic.co/t/search-by-datetime-range-query/282463 "2021-08-25T09:51:21Z")
Hi, I have issue related to search through datetime range query. I tried to search some data which is oldest after a certain period. I read documentation and try to make query and I'm unable to get any of the data. GET … --- ## [ElasticSearch adjacent words for nested queries](https://discuss.elastic.co/t/elasticsearch-adjacent-words-for-nested-queries/282242)
**Author:** [@Loreto\_Parisi1](https://discuss.elastic.co/u/Loreto_Parisi1)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 9:46am UTC](https://discuss.elastic.co/t/elasticsearch-adjacent-words-for-nested-queries/282242 "2021-08-25T09:46:17Z")
I'm using ES 7.14/Kibana 7.10, I have to search for adjacent words (any order), hence I'm using this query: { "query":{ "bool":{ "must":\[ { "query\_string":{ "… --- ## [Metricbeat Timeout Errors while scraping state metricset from kube-state-mertics](https://discuss.elastic.co/t/metricbeat-timeout-errors-while-scraping-state-metricset-from-kube-state-mertics/281931)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 9:37am UTC](https://discuss.elastic.co/t/metricbeat-timeout-errors-while-scraping-state-metricset-from-kube-state-mertics/281931 "2021-08-25T09:37:13Z")
I am running metricbeat deployment and daemonset using elasticsearch helm chart. In my metricbeat deployment I am collecting state metrics from the kube-state-metrics API from an openshift cluster and experience followin… --- ## [Failed to add condition to grok processor](https://discuss.elastic.co/t/failed-to-add-condition-to-grok-processor/281017)
**Author:** [@Alaxwora](https://discuss.elastic.co/u/Alaxwora)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 9:25am UTC](https://discuss.elastic.co/t/failed-to-add-condition-to-grok-processor/281017 "2021-08-25T09:25:33Z")
Hello, I was trying to add a condition to grok processor based on 'log.file.path' index if the path contains 'Message Tracking' execute the processor if not exit but it always showing Unable to create Pipeline condit… --- ## [Winlogbeat logs filtering in Logstash for storage management and relevant info to elastic](https://discuss.elastic.co/t/winlogbeat-logs-filtering-in-logstash-for-storage-management-and-relevant-info-to-elastic/282218)
**Author:** [@Rojal\_Paul](https://discuss.elastic.co/u/Rojal_Paul)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 9:25am UTC](https://discuss.elastic.co/t/winlogbeat-logs-filtering-in-logstash-for-storage-management-and-relevant-info-to-elastic/282218 "2021-08-25T09:25:14Z")
I want to know the problem with my configuration. I want to reduce the windows logs saved in Logstash by sending relevant info such as warnings, errors. For now, it's taking a huge amount of data for storing all wind… --- ## [Using aggregation in anomaly detection jobs](https://discuss.elastic.co/t/using-aggregation-in-anomaly-detection-jobs/282237)
**Author:** [@one](https://discuss.elastic.co/u/one)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 9:06am UTC](https://discuss.elastic.co/t/using-aggregation-in-anomaly-detection-jobs/282237 "2021-08-25T09:06:51Z")
I guess I did not understand the use of aggregation in anomaly detection. I was expecting that the same aggregation with different time intervals will not affect the results, however, it seems that this is not the case. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1265) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1267)