# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1281 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1282 --- ## [Most efficient mapping for a chat search engine](https://discuss.elastic.co/t/most-efficient-mapping-for-a-chat-search-engine/281434)
**Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 0\ **Last updated:** [August 14, 2021, 10:36am UTC](https://discuss.elastic.co/t/most-efficient-mapping-for-a-chat-search-engine/281434 "2021-08-14T10:36:49Z")
Hi, I'm building a new cluster to allow search on our internal chat system. Given the volume of data to index, and the budget for it, storage efficiency is a key here. Message structure: channel\_id: integer user\_id: i… --- ## [Fatal CLI Error cannot find module to-regex while starting Kibana](https://discuss.elastic.co/t/fatal-cli-error-cannot-find-module-to-regex-while-starting-kibana/279972)
**Author:** [@Ashutosh](https://discuss.elastic.co/u/Ashutosh)\ **Replies:** 2\ **Last updated:** [August 14, 2021, 8:37am UTC](https://discuss.elastic.co/t/fatal-cli-error-cannot-find-module-to-regex-while-starting-kibana/279972 "2021-08-14T08:37:52Z")
Hi All, I have installed Kibana 7.13. I am not able to start Kibana using "systemctl start kibana". I keep seeing the following errors when I run journalctl -u kibana -f fatal CLI Error cannot find module to-regex I a… --- ## [Elasticsearch start failed after the reboot the server](https://discuss.elastic.co/t/elasticsearch-start-failed-after-the-reboot-the-server/281416)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 2\ **Last updated:** [August 14, 2021, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch-start-failed-after-the-reboot-the-server/281416 "2021-08-14T07:23:52Z")
Hi, I couldn't start the elasticsearch service after reboot the server. How can i fix it? I have 3 Mater, 2 Hot, 2 Warm, 2 Cold nodes (Totaly 9 nodes) Elasticsearch version: 7.7.0 OS: CentOS Linux release 8.1.1911 (C… --- ## [Kibana 7.12.0 Index fields are summed by day](https://discuss.elastic.co/t/kibana-7-12-0-index-fields-are-summed-by-day/280860)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 2\ **Last updated:** [August 14, 2021, 7:06am UTC](https://discuss.elastic.co/t/kibana-7-12-0-index-fields-are-summed-by-day/280860 "2021-08-14T07:06:16Z")
Hi I have an index. Its structure is as follows: Date Hour time Number of hours Number of dates I want the number of dates to automatically add up by day. Calculation formula: Number of dates = Number of… --- ## [How to use @elastic/ecs-winston-format with winston-elasticsearch](https://discuss.elastic.co/t/how-to-use-elastic-ecs-winston-format-with-winston-elasticsearch/281418)
**Author:** [@kkireyev](https://discuss.elastic.co/u/kkireyev)\ **Replies:** 0\ **Last updated:** [August 14, 2021, 2:03am UTC](https://discuss.elastic.co/t/how-to-use-elastic-ecs-winston-format-with-winston-elasticsearch/281418 "2021-08-14T02:03:52Z")
Hi! I'm trying to long events from Javascript (especially from express application) to ELK. I can write to console just fine: const ecsFormat = require('@elastic/ecs-winston-format'); const myLogger = winston.createLogg… --- ## [Parsing an existing field further](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 5\ **Last updated:** [August 13, 2021, 11:53pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389 "2021-08-13T23:53:05Z")
Hi, Is there way to parse the data from a single filed into 2 different fields? I have a field that contains a username and an ID that I would like to break out. So I want to assign to keep the username in the usernam… --- ## [Logstash Indexing Questions](https://discuss.elastic.co/t/logstash-indexing-questions/281415)
**Author:** [@timtom935](https://discuss.elastic.co/u/timtom935)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 11:15pm UTC](https://discuss.elastic.co/t/logstash-indexing-questions/281415 "2021-08-13T23:15:23Z")
Hello I have been setting up a proof of concept elastic stack for our company. We had data flowing through the elastic stack without errors when we were just shipping the Winlogbeat data directly to Kibana. All of the W… --- ## [Getting issue while installing Kibana](https://discuss.elastic.co/t/getting-issue-while-installing-kibana/280916)
**Author:** [@MKYash](https://discuss.elastic.co/u/MKYash)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:48pm UTC](https://discuss.elastic.co/t/getting-issue-while-installing-kibana/280916 "2021-08-13T22:48:59Z")
Kibana Versions : 7.14.0 Node Version : v14.17.4 Kibana installation issue. While running yarn start getting below error. Also tried to install yarn add @kbn/apm-config-loader --- ## [Add term filter query](https://discuss.elastic.co/t/add-term-filter-query/281012)
**Author:** [@Jose\_Manuel\_Tirado](https://discuss.elastic.co/u/Jose_Manuel_Tirado)\ **Replies:** 0\ **Last updated:** [August 11, 2021, 8:17am UTC](https://discuss.elastic.co/t/add-term-filter-query/281012 "2021-08-11T08:17:07Z")
HI: I am using this query to fetch elastic data through python connector: { "query": {"range": {"nuanceTimestamp": {"gte": f"{date1}T{str(hour\_in).zfill(2)}:00:00Z", … --- ## [Need ELK REST API for view alerts which meet threshold value](https://discuss.elastic.co/t/need-elk-rest-api-for-view-alerts-which-meet-threshold-value/281289)
**Author:** [@prashant.j.singh](https://discuss.elastic.co/u/prashant.j.singh)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:37pm UTC](https://discuss.elastic.co/t/need-elk-rest-api-for-view-alerts-which-meet-threshold-value/281289 "2021-08-13T22:37:38Z")
MY ELK APM version is 7.14 - licence Free basics . please suggest or help me how can view all alert or any API those alert meet threshold value. using alert connector : server log and index --- ## [Kibana Enhanced Table Plugin - Computed columns issue](https://discuss.elastic.co/t/kibana-enhanced-table-plugin-computed-columns-issue/281351)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:29pm UTC](https://discuss.elastic.co/t/kibana-enhanced-table-plugin-computed-columns-issue/281351 "2021-08-13T22:29:16Z")
Hi , I'm using Kibana - Elasticsearch Plugin - Enhanced Table. Issue is I can create computed columns for fields in buckets like terms, filters etc. I cannot create computed columns for fields in metrics aggregation l… --- ## [Turn off Alert during night](https://discuss.elastic.co/t/turn-off-alert-during-night/281156)
**Author:** [@wlbsxnlp22](https://discuss.elastic.co/u/wlbsxnlp22)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:21pm UTC](https://discuss.elastic.co/t/turn-off-alert-during-night/281156 "2021-08-13T22:21:22Z")
Hi, Is there a way to use the Elasticsearch Query Alert type to only run an alert during business hours? If so does anyone have an example script? Any help would be very appreciated. --- ## [ELK APM : Select a connector type "Index" - where can view these alert](https://discuss.elastic.co/t/elk-apm-select-a-connector-type-index-where-can-view-these-alert/281288)
**Author:** [@prashant.j.singh](https://discuss.elastic.co/u/prashant.j.singh)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:10pm UTC](https://discuss.elastic.co/t/elk-apm-select-a-connector-type-index-where-can-view-these-alert/281288 "2021-08-13T22:10:33Z")
I have enabled connector Type "index" in kibana 7.14 and apply index connector. please help where can view these alert for index connector . Any have API or log ? ELK APM Detail : Kibaban 7.14 , Elasticserach 7.14 --- ## [Significant Terms with multi word results](https://discuss.elastic.co/t/significant-terms-with-multi-word-results/281394)
**Author:** [@Barrett\_Jones](https://discuss.elastic.co/u/Barrett_Jones)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:07pm UTC](https://discuss.elastic.co/t/significant-terms-with-multi-word-results/281394 "2021-08-13T22:07:02Z")
I have an ElasticSearch index that includes a "text" field that I would like to do ElasticSearch significant\_terms aggregation on to determine meaningful terms and phrases from the "text" field. The problem I am facing, … --- ## [Exclude duplicate data](https://discuss.elastic.co/t/exclude-duplicate-data/281226)
**Author:** [@dcarpio080](https://discuss.elastic.co/u/dcarpio080)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:02pm UTC](https://discuss.elastic.co/t/exclude-duplicate-data/281226 "2021-08-13T22:02:31Z")
Hello, Could you please help me to exclude the duplicate data from some charts that I'm creating for our executive team, basically I want to count the last update for each ticket, but It seems It is counting all the tic… --- ## [DLQ pipeline not showing fields added in the filter section of the Logstash pipeline in the datastream](https://discuss.elastic.co/t/dlq-pipeline-not-showing-fields-added-in-the-filter-section-of-the-logstash-pipeline-in-the-datastream/281383)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 2\ **Last updated:** [August 13, 2021, 10:02pm UTC](https://discuss.elastic.co/t/dlq-pipeline-not-showing-fields-added-in-the-filter-section-of-the-logstash-pipeline-in-the-datastream/281383 "2021-08-13T22:02:25Z")
Elastic stack 7.13 version. Winlogbeat messages are ingested into Elasticsearch cluster and the dead letter queue is filling up and causing "/var/log/messages" to fill up as well with messages containing "cannot write ev… --- ## [Issue with 7.14 ES query failed: java.io.IOException: ElasticsearchException\[Invalid or missing build flavor \[oss\]\]](https://discuss.elastic.co/t/issue-with-7-14-es-query-failed-java-io-ioexception-elasticsearchexception-invalid-or-missing-build-flavor-oss/281396)
**Author:** [@elastic-sss](https://discuss.elastic.co/u/elastic-sss)\ **Replies:** 3\ **Last updated:** [August 13, 2021, 10:01pm UTC](https://discuss.elastic.co/t/issue-with-7-14-es-query-failed-java-io-ioexception-elasticsearchexception-invalid-or-missing-build-flavor-oss/281396 "2021-08-13T22:01:03Z")
Hi, My queries are working fine with ES 7.13.4 but when I upgraded to 7.14.0 I get this error ""class java.lang.IllegalStateException:ES query failed: java.io.IOException: ElasticsearchException\[Invalid or missing build… --- ## [7.14.0 no cURL disable](https://discuss.elastic.co/t/7-14-0-no-curl-disable/281381)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [August 13, 2021, 9:56pm UTC](https://discuss.elastic.co/t/7-14-0-no-curl-disable/281381 "2021-08-13T21:56:10Z")
I upgraded 7.14.0 and now I don't have option to copy my sql that I test on dev tool to copy as cURL is there a switch or it is disable due to license issue. I have basic free license --- ## ["Could not index event" due to "field already exists"](https://discuss.elastic.co/t/could-not-index-event-due-to-field-already-exists/281229)
**Author:** [@looknleap](https://discuss.elastic.co/u/looknleap)\ **Replies:** 8\ **Last updated:** [August 13, 2021, 9:24pm UTC](https://discuss.elastic.co/t/could-not-index-event-due-to-field-already-exists/281229 "2021-08-13T21:24:22Z")
Data path: Windows Sysmon --\> Winlogbeat --\> Logstash --\> Elasticsearch Problem: Certain new events are unable to be indexed: "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"field \[process.pe.… --- ## [Logstash filter for varying number of disks info in the logs](https://discuss.elastic.co/t/logstash-filter-for-varying-number-of-disks-info-in-the-logs/281400)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 9:16pm UTC](https://discuss.elastic.co/t/logstash-filter-for-varying-number-of-disks-info-in-the-logs/281400 "2021-08-13T21:16:38Z")
Hello, i have a couple of log lines which go like this , that have varying number of disks 1628868082.953|7ec93a454940| disk-usage: \[1\]=46% \[2\]=44% \[3\]=52% \[4\]=52% \[5\]=46% \[6\]=40% \[7\]=45% \[8\]=48% 1628868082.953|7ec93a… --- ## [Like to apply sorting on given search query param](https://discuss.elastic.co/t/like-to-apply-sorting-on-given-search-query-param/277669)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 7:24pm UTC](https://discuss.elastic.co/t/like-to-apply-sorting-on-given-search-query-param/277669 "2021-08-13T19:24:52Z")
I have product id list in terms query. I like to get result in same order as provide ids in terms query. Below is my query. { "size": 24, "from": 0, "sort": \[\], "query": { "bool": { … --- ## [Unexpected error with Beats input plugin](https://discuss.elastic.co/t/unexpected-error-with-beats-input-plugin/281255)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 8\ **Last updated:** [August 13, 2021, 7:10pm UTC](https://discuss.elastic.co/t/unexpected-error-with-beats-input-plugin/281255 "2021-08-13T19:10:40Z")
Previously i used JSON data from a file (that were previously taken by beats) to test my logstash conf and filtering. I had no problems, but when i try to read straight from auditbeat with the Beats input plugin, Logstas… --- ## [How to pass date in Elastic co billing API](https://discuss.elastic.co/t/how-to-pass-date-in-elastic-co-billing-api/281376)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 3:23pm UTC](https://discuss.elastic.co/t/how-to-pass-date-in-elastic-co-billing-api/281376 "2021-08-13T15:23:00Z")
Hi, I have generate API key and I am getting data for current month by default using the curl command. I am checking for some format how to add dates in api to retrieve data for last 3 months. I checked documentation … --- ## [Cloudwatch log group stream using logstash to ES](https://discuss.elastic.co/t/cloudwatch-log-group-stream-using-logstash-to-es/281378)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 3:27pm UTC](https://discuss.elastic.co/t/cloudwatch-log-group-stream-using-logstash-to-es/281378 "2021-08-13T15:27:29Z")
Hi I'm using logstash-7.14.0-1.x86\_64 version and would like to stream cloudwatch loggroup to ES. When I'm trying to use plugin bin/logstash-plugin install logstash-input-cloudwatch it doesn't seems to work for log grou… --- ## [Static field - Calculate diffs between date fields with painless](https://discuss.elastic.co/t/static-field-calculate-diffs-between-date-fields-with-painless/281258)
**Author:** [@seadub](https://discuss.elastic.co/u/seadub)\ **Replies:** 5\ **Last updated:** [August 13, 2021, 3:23pm UTC](https://discuss.elastic.co/t/static-field-calculate-diffs-between-date-fields-with-painless/281258 "2021-08-13T15:23:23Z")
I'm attempting to add a new static field on an existing index, and having struggles getting data back in the preview to verify syntax. I've confirmed that both fields are registered as "date" type in the index. Here's … --- ## [Elastic.co account and billing summary dashboard](https://discuss.elastic.co/t/elastic-co-account-and-billing-summary-dashboard/280275)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 15\ **Last updated:** [August 11, 2021, 12:41pm UTC](https://discuss.elastic.co/t/elastic-co-account-and-billing-summary-dashboard/280275 "2021-08-11T12:41:05Z")
Hi All, I am using elastic. co to check account and billing information. Can I make a dashboard in kibana from elastic.co data present in account and billing info. Please let me know if there is a way around to extrac… --- ## [Use logstash to synchronize json files to elactissearch without data](https://discuss.elastic.co/t/use-logstash-to-synchronize-json-files-to-elactissearch-without-data/281138)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 3\ **Last updated:** [August 13, 2021, 2:53pm UTC](https://discuss.elastic.co/t/use-logstash-to-synchronize-json-files-to-elactissearch-without-data/281138 "2021-08-13T14:53:30Z")
There is no data, even when the file is changed, the console does not output changes. This is my conf file, test.conf input { file { path =\> "D:\\logstash\\test\\demo.log" codec =\> "json" } } output { elasticsearc… --- ## [Elasticsearch query and aggregation](https://discuss.elastic.co/t/elasticsearch-query-and-aggregation/281356)
**Author:** [@masakazu.ohtsuka](https://discuss.elastic.co/u/masakazu.ohtsuka)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 12:55pm UTC](https://discuss.elastic.co/t/elasticsearch-query-and-aggregation/281356 "2021-08-13T12:55:01Z")
Elasticsearch responds with buckets that should be filtered out by the query. What's wrong? The request is: curl -kv --max-time 60 -H "Content-Type: application/json" "http://elasticsearch.example.com/jp-2021.0\*/\_searc… --- ## [ERROR - Kibana Canvas email Reporting via Watcher](https://discuss.elastic.co/t/error-kibana-canvas-email-reporting-via-watcher/281234)
**Author:** [@keshara](https://discuss.elastic.co/u/keshara)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 5:18pm UTC](https://discuss.elastic.co/t/error-kibana-canvas-email-reporting-via-watcher/281234 "2021-08-12T17:18:30Z")
Hi, My use case is to automate email report via Watcher from a kibana Canvas report. ELK Stack =\> 7.14.0 I have already build a Canvas report. And from this same Canvas report I copied automatically generated Watcher … --- ## [Характеристики виртуальной машины для logstash](https://discuss.elastic.co/t/logstash/281348)
**Author:** [@111498](https://discuss.elastic.co/u/111498)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 12:12pm UTC](https://discuss.elastic.co/t/logstash/281348 "2021-08-13T12:12:38Z")
Нужна виртуальная машина для logstash. Также будет использоваться плагин lumberjack. Сколько CPU, RAM, и диска надо для этого, если учитывать что: EPS=1000, Bandwidth usage=400kb/s PPS=15 ? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1280) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1282)