# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1292 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1293 --- ## [What is the meaning of "hits.total" in an aggregate search query?](https://discuss.elastic.co/t/what-is-the-meaning-of-hits-total-in-an-aggregate-search-query/280600)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 9:42pm UTC](https://discuss.elastic.co/t/what-is-the-meaning-of-hits-total-in-an-aggregate-search-query/280600 "2021-08-05T21:42:45Z")
I found this Is hits.total limited by max\_results\_window? - #3 which says hits shouldnt be limited However, I have the following query # POST /assets/\_search { "size": 0, "query": { "bool": { "must": \[ … --- ## [Daily index not created](https://discuss.elastic.co/t/daily-index-not-created/280315)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 8\ **Last updated:** [August 5, 2021, 9:42pm UTC](https://discuss.elastic.co/t/daily-index-not-created/280315 "2021-08-05T21:42:31Z")
Hi Team, On my single test server with 8G of RAM (1955m to JVM) having es v 7.4, I have 12 application indices + few system indices like (.monitoring-es-7-2021.08.02, .monitoring-logstash-7-2021.08.02, .monitoring-kiba… --- ## [Installing a custom local plugin](https://discuss.elastic.co/t/installing-a-custom-local-plugin/280574)
**Author:** [@gusDuarte](https://discuss.elastic.co/u/gusDuarte)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 8:43pm UTC](https://discuss.elastic.co/t/installing-a-custom-local-plugin/280574 "2021-08-05T20:43:27Z")
Hi all, I want to make a bit modification to http input plugin, so to start with this task, i following steps: Install logstash 7.14 downloading logstash-7.14.0-darwin-x86\_64.tar.gz, and test if installation is ok bi… --- ## [Module:kubernetes / metricset:event fails to gather FailedScheduling events](https://discuss.elastic.co/t/module-kubernetes-metricset-event-fails-to-gather-failedscheduling-events/280597)
**Author:** [@MnrGreg](https://discuss.elastic.co/u/MnrGreg)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 8:37pm UTC](https://discuss.elastic.co/t/module-kubernetes-metricset-event-fails-to-gather-failedscheduling-events/280597 "2021-08-05T20:37:06Z")
When moving from kubernetes 1.19.1 to 1.20.5 metricset:event no longer gathers .reason:FailedScheduling events. Noticed the kubernetes event structure has changed. 1.19.1: { "apiVersion": "v1", … --- ## [Snapshot does not exist during migration](https://discuss.elastic.co/t/snapshot-does-not-exist-during-migration/280596)
**Author:** [@iceman](https://discuss.elastic.co/u/iceman)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 8:19pm UTC](https://discuss.elastic.co/t/snapshot-does-not-exist-during-migration/280596 "2021-08-05T20:19:45Z")
hi all, I want to migrate all the data from one k8s cluster to another , ES ver 7.10.1. So first I created successful snapshot on the first cluster: \[elasticsearch@es backup\]$ curl -X PUT "localhost:9200/\_snapshot/bac… --- ## [Subtract @timestamp between two events in Visualize on kibana](https://discuss.elastic.co/t/subtract-timestamp-between-two-events-in-visualize-on-kibana/280479)
**Author:** [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\ **Replies:** 3\ **Last updated:** [August 5, 2021, 7:44pm UTC](https://discuss.elastic.co/t/subtract-timestamp-between-two-events-in-visualize-on-kibana/280479 "2021-08-05T19:44:26Z")
Hi Elastic Team, I want to be able to subtract the field @timestamp for two events. For exmample, i recieve 1 event by second, so, i would like to subtract the last event to arrive against the penultimate event to arriv… --- ## [Find Out empty field](https://discuss.elastic.co/t/find-out-empty-field/280576)
**Author:** [@YASH\_SHARMA7766](https://discuss.elastic.co/u/YASH_SHARMA7766)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 7:09pm UTC](https://discuss.elastic.co/t/find-out-empty-field/280576 "2021-08-05T19:09:09Z")
I have a data set of 4-5 fields.I want to check if any data field is empty , Iogstash add a field name incomplete data and add value of field name in that.Sample data and code is attached below. As shown in image,ser… --- ## [Query latency increase when upgrading from 7.10.2](https://discuss.elastic.co/t/query-latency-increase-when-upgrading-from-7-10-2/280585)
**Author:** [@BS1](https://discuss.elastic.co/u/BS1)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 7:02pm UTC](https://discuss.elastic.co/t/query-latency-increase-when-upgrading-from-7-10-2/280585 "2021-08-05T19:02:21Z")
We have been running Elasticsearch 7.10.2 for a while in a production setting now, serving thousands of requests per second across 10 separate clusters. Our clusters are all in AWS on ec2 hosts. A coupe of months back we… --- ## [Suggestion for wildcard field type](https://discuss.elastic.co/t/suggestion-for-wildcard-field-type/280553)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [August 5, 2021, 6:14pm UTC](https://discuss.elastic.co/t/suggestion-for-wildcard-field-type/280553 "2021-08-05T18:14:22Z")
Hello, We need to do a lot of (front) wildcard queries on certain fields. One such field is url.original. Currently this is mapped in ECS as keyword. I'm wondering if this could be changed to wildcard field type? For e… --- ## [Unknown field 'DisablePAFXFAST' in struct literal of type sarama.GSSAPIConfig](https://discuss.elastic.co/t/unknown-field-disablepafxfast-in-struct-literal-of-type-sarama-gssapiconfig/280579)
**Author:** [@jpfreyen](https://discuss.elastic.co/u/jpfreyen)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 6:11pm UTC](https://discuss.elastic.co/t/unknown-field-disablepafxfast-in-struct-literal-of-type-sarama-gssapiconfig/280579 "2021-08-05T18:11:27Z")
I inherited a fairly old beats plugin project using filebeat 7.10. Its import() in main is defined as: package main import ( "os" "github.com/elastic/beats/v7/filebeat/beater" inputs "github.c… --- ## [Enhanced Table Plugin Installation Error](https://discuss.elastic.co/t/enhanced-table-plugin-installation-error/280481)
**Author:** [@marija.timovska.iw](https://discuss.elastic.co/u/marija.timovska.iw)\ **Replies:** 3\ **Last updated:** [August 5, 2021, 6:03pm UTC](https://discuss.elastic.co/t/enhanced-table-plugin-installation-error/280481 "2021-08-05T18:03:10Z")
@fbaligand Hello I am in need of your assistance regarding the run of enhanced-table plugin in development mode. When I use the to yarn kbn bootstrap command I get this error. --- ## [Loading Vega-lite schema + data from local](https://discuss.elastic.co/t/loading-vega-lite-schema-data-from-local/280249)
**Author:** [@sohenrane](https://discuss.elastic.co/u/sohenrane)\ **Replies:** 6\ **Last updated:** [August 5, 2021, 5:22pm UTC](https://discuss.elastic.co/t/loading-vega-lite-schema-data-from-local/280249 "2021-08-05T17:22:31Z")
{ "$schema": "file:///C:/Users/custom4me/Downloads/ELK/v5.json", "title": "Event counts from MAIN index", "data": { "url": "file:///C:/Users/custom4me/Downloads/ELK/seattle-weather.csv" } } How to load from local … --- ## [Making nested , flattened fields searchable](https://discuss.elastic.co/t/making-nested-flattened-fields-searchable/280570)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 5:21pm UTC](https://discuss.elastic.co/t/making-nested-flattened-fields-searchable/280570 "2021-08-05T17:21:54Z")
Kibana version : 7.13 Elasticsearch version : 7.13 APM Server version : 7.13 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your se… --- ## [Dynamic index name with ILM](https://discuss.elastic.co/t/dynamic-index-name-with-ilm/280563)
**Author:** [@DoctorRobot](https://discuss.elastic.co/u/DoctorRobot)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 4:48pm UTC](https://discuss.elastic.co/t/dynamic-index-name-with-ilm/280563 "2021-08-05T16:48:24Z")
Hi, I currently have this setup which works fine: --- apiVersion: beat.k8s.elastic.co/v1beta1 kind: Beat metadata: name: filebeat namespace: elasticsearch ... setup: ilm: enabled: false template: name: … --- ## [Getting Issue while query Elasticsearch having kstem with edge gram in filter](https://discuss.elastic.co/t/getting-issue-while-query-elasticsearch-having-kstem-with-edge-gram-in-filter/280555)
**Author:** [@rai](https://discuss.elastic.co/u/rai)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 4:04pm UTC](https://discuss.elastic.co/t/getting-issue-while-query-elasticsearch-having-kstem-with-edge-gram-in-filter/280555 "2021-08-05T16:04:43Z")
Pass complete addressline1 as input with match query unable to find the record because of kstem. We have kstem, lower, edge gram and synonym filter applied on addressline1 field, While creating the index. for an exampl… --- ## [Can you put Logstash behind Nginx proxy?](https://discuss.elastic.co/t/can-you-put-logstash-behind-nginx-proxy/279665)
**Author:** [@droplet](https://discuss.elastic.co/u/droplet)\ **Replies:** 12\ **Last updated:** [August 5, 2021, 3:51pm UTC](https://discuss.elastic.co/t/can-you-put-logstash-behind-nginx-proxy/279665 "2021-08-05T15:51:25Z")
Hello, Can you put Logstash behind Nginx proxy the same way you put Kibana behind an nginx proxy to use a custom domain with SSL? All this while also using HTTP Basic authentication with Nginx? ElasticSearch, Kibana, a… --- ## [How to create Hyperlinked visualization in kibana](https://discuss.elastic.co/t/how-to-create-hyperlinked-visualization-in-kibana/279053)
**Author:** [@Rana\_M\_Zubair](https://discuss.elastic.co/u/Rana_M_Zubair)\ **Replies:** 3\ **Last updated:** [August 5, 2021, 3:31pm UTC](https://discuss.elastic.co/t/how-to-create-hyperlinked-visualization-in-kibana/279053 "2021-08-05T15:31:50Z")
I want to create a type of drilled down dashboard. Like a main dashboard in which I want to create hyperlinked visualization, the link of which will take me to the more detailed dashboard. My Findings: There is a markd… --- ## [Debugging elasticsearch plugins](https://discuss.elastic.co/t/debugging-elasticsearch-plugins/280550)
**Author:** [@alinux](https://discuss.elastic.co/u/alinux)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 3:23pm UTC](https://discuss.elastic.co/t/debugging-elasticsearch-plugins/280550 "2021-08-05T15:23:16Z")
Hi, i need to made some custom changes on repository-s3 plugin. In Intellij I started elasticsearch in debug mode with gradle command ./gradlew run --debug-jvm after elasticsearch is runnig there no plugins are loaded… --- ## [Extract Day, Month and year from Today using painless script](https://discuss.elastic.co/t/extract-day-month-and-year-from-today-using-painless-script/280431)
**Author:** [@hiteshmakky](https://discuss.elastic.co/u/hiteshmakky)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 2:45pm UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-today-using-painless-script/280431 "2021-08-05T14:45:32Z")
Hi Friends, I am new to the EKL stack. I am trying to calculate MTD sales from data set. We have three columns Product Code Date (dd-MM-yyyy format) Sales All I am trying to do is calculate MTD sales for e.g. If tod… --- ## [Issue setting up minimal security for elasticsearch](https://discuss.elastic.co/t/issue-setting-up-minimal-security-for-elasticsearch/280341)
**Author:** [@Aztal-Samoht](https://discuss.elastic.co/u/Aztal-Samoht)\ **Replies:** 3\ **Last updated:** [August 5, 2021, 3:05pm UTC](https://discuss.elastic.co/t/issue-setting-up-minimal-security-for-elasticsearch/280341 "2021-08-05T15:05:52Z")
I have been following the instruction for setting up the minimal security features on ELK stack and keep running into the same problem. when I try to run the command ./kibana-keystore.bat add elasticsearch.password I … --- ## [Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/280423)
**Author:** [@Gotze\_des\_Pobels](https://discuss.elastic.co/u/Gotze_des_Pobels)\ **Replies:** 4\ **Last updated:** [August 5, 2021, 2:31pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/280423 "2021-08-05T14:31:08Z")
Im not able to connect Kibana with elasticsearch. Both running in seperate docker containers in plesk obsidian. Elasticsearch is running and a GET request to "mydomain.com:9200/\_cluster/health?pretty" is giving me foll… --- ## [Map Tile Server and Authentication](https://discuss.elastic.co/t/map-tile-server-and-authentication/280321)
**Author:** [@nick\_cgi](https://discuss.elastic.co/u/nick_cgi)\ **Replies:** 3\ **Last updated:** [August 5, 2021, 2:23pm UTC](https://discuss.elastic.co/t/map-tile-server-and-authentication/280321 "2021-08-05T14:23:36Z")
Is it possible to utilise any sort of authentication with an external map tile server? The end goal is simply: Kibana, with a custom tile server The tile server to be protected in some fashion I have evaluated multip… --- ## [Conditions with environment variables](https://discuss.elastic.co/t/conditions-with-environment-variables/280462)
**Author:** [@Loulou](https://discuss.elastic.co/u/Loulou)\ **Replies:** 3\ **Last updated:** [August 5, 2021, 12:39pm UTC](https://discuss.elastic.co/t/conditions-with-environment-variables/280462 "2021-08-05T12:39:02Z")
Hi, I am trying to have a different input for filebeat if a certain environment variable is set: - type: log enabled: ${VAR} paths: - MyPath1 - type: log enabled: not ${VAR} paths: - MyPath2 I know the… --- ## [LOGSTASH - MULTILINE XML IN LOG](https://discuss.elastic.co/t/logstash-multiline-xml-in-log/280528)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 11:37am UTC](https://discuss.elastic.co/t/logstash-multiline-xml-in-log/280528 "2021-08-05T11:37:32Z")
Hi to all I'm trying to parse xml info that it is in a log file, I tried with different configs, without luck, the actual one is this, but I tried with TIMESTAMP too, and join lines without sense codec =\> multiline{ c… --- ## [How to connect Neo4j from logstash using JDBC](https://discuss.elastic.co/t/how-to-connect-neo4j-from-logstash-using-jdbc/280524)
**Author:** [@vivek\_Jagadeesan](https://discuss.elastic.co/u/vivek_Jagadeesan)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 11:11am UTC](https://discuss.elastic.co/t/how-to-connect-neo4j-from-logstash-using-jdbc/280524 "2021-08-05T11:11:53Z")
Hi All, Could anyone help me on how to connect the neo4j from logstash using JDBC? My sample config: input { jdbc { jdbc\_driver\_library =\> "/usr/share/java/neo4j-jdbc-driver-4.0.2.jar" jdbc\_driver\_class =\> "org.neo4… --- ## [Slow/Not Indexing in Elasticsearch via Logstash](https://discuss.elastic.co/t/slow-not-indexing-in-elasticsearch-via-logstash/280523)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 11:10am UTC](https://discuss.elastic.co/t/slow-not-indexing-in-elasticsearch-via-logstash/280523 "2021-08-05T11:10:16Z")
We have Elasticsearch 7.11.1 and Logstash 7.11.2. We have a scenario of indexing data from Logstash to ES. We use a java application that does some data processing and posts data to the Logstash HTTP endpoint. Normally e… --- ## [Kibana unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes/278184)
**Author:** [@Trueman](https://discuss.elastic.co/u/Trueman)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 10:12am UTC](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes/278184 "2021-08-05T10:12:24Z")
Hello! Continuing the topic Failed to establish trust communication between es01, es02 and kibana I set just the intermediate certificate in kibana part of the configuration: ELASTICSEARCH\_SSL\_CERTIFICATEAUTHORITIES: $C… --- ## [Failed to establish trust communication between es01, es02 and kibana](https://discuss.elastic.co/t/failed-to-establish-trust-communication-between-es01-es02-and-kibana/277654)
**Author:** [@Trueman](https://discuss.elastic.co/u/Trueman)\ **Replies:** 7\ **Last updated:** [August 5, 2021, 9:58am UTC](https://discuss.elastic.co/t/failed-to-establish-trust-communication-between-es01-es02-and-kibana/277654 "2021-08-05T09:58:29Z")
Hello, I'm trying to configure TLS between es01, es02 and kibana (docker containers) with certificates from certificate chain \[CA\_cert - Intermediate\_cert - Server\_cert\]. Below you can see the excerpt of the yml file whe… --- ## [Syslog date in ingest node pipeline ahead](https://discuss.elastic.co/t/syslog-date-in-ingest-node-pipeline-ahead/279345)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 3\ **Last updated:** [August 5, 2021, 9:39am UTC](https://discuss.elastic.co/t/syslog-date-in-ingest-node-pipeline-ahead/279345 "2021-08-05T09:39:07Z")
Hi, I am experiencing a strange thing with the date in the syslog log in filebeat. I am using the default ingest node pipeline (logs-system.syslog-0.12.7) which creates a new timestamp based on the system.syslog.timesta… --- ## [Filebeat stops sending data to Logstash and hence Elasticsearch after a few hundred thousand documents, works again on restarting Filebeat container](https://discuss.elastic.co/t/filebeat-stops-sending-data-to-logstash-and-hence-elasticsearch-after-a-few-hundred-thousand-documents-works-again-on-restarting-filebeat-container/279984)
**Author:** [@sanjogmehta](https://discuss.elastic.co/u/sanjogmehta)\ **Replies:** 4\ **Last updated:** [August 5, 2021, 9:27am UTC](https://discuss.elastic.co/t/filebeat-stops-sending-data-to-logstash-and-hence-elasticsearch-after-a-few-hundred-thousand-documents-works-again-on-restarting-filebeat-container/279984 "2021-08-05T09:27:15Z")
I am a new to Elastic stack and I am using Filebeat AWS module's vpcflow to fetch data from S3 through SQS. It works fine for a few hundred thousand documents, but after that I don't see any new document in Elasticsearch… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1291) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1293)