# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=131 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 132 --- ## [When I query 15 minutes of data, it takes 7 seconds, but when I adjust the query time range to 7 days, the query times out. How can I improve the efficiency of the query? The query size=10 is all used. Why does the commissioning time range affect the quer](https://discuss.elastic.co/t/when-i-query-15-minutes-of-data-it-takes-7-seconds-but-when-i-adjust-the-query-time-range-to-7-days-the-query-times-out-how-can-i-improve-the-efficiency-of-the-query-the-query-size-10-is-all-used-why-does-the-commissioning-time-range-affect-the-quer/371108)
**Author:** [@canli12138](https://discuss.elastic.co/u/canli12138)\ **Replies:** 1\ **Last updated:** [November 27, 2024, 11:25am UTC](https://discuss.elastic.co/t/when-i-query-15-minutes-of-data-it-takes-7-seconds-but-when-i-adjust-the-query-time-range-to-7-days-the-query-times-out-how-can-i-improve-the-efficiency-of-the-query-the-query-size-10-is-all-used-why-does-the-commissioning-time-range-affect-the-quer/371108 "2024-11-27T11:25:17Z")
{ "highlight": { "fields": { "\*": { "pre\_tags": " \[\\"\\\"\],", "post\_tags": "\[\\"\<\\/span\>\\"\]" } }, "fragment\_size": 2147483647 }, … --- ## [Elastic auto-complete vs normal querying](https://discuss.elastic.co/t/elastic-auto-complete-vs-normal-querying/371119)
**Author:** [@prempatell](https://discuss.elastic.co/u/prempatell)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 7:16am UTC](https://discuss.elastic.co/t/elastic-auto-complete-vs-normal-querying/371119 "2024-11-27T07:16:44Z")
Hi, I am maintaining a separate index for auto-complete suggestions, while using type "completion" of Elasticsearch I faced certain limitations like it only worked for prefix, I tried tokenizing input by n-gram analyze… --- ## [Kibana canvas with query and shape circle](https://discuss.elastic.co/t/kibana-canvas-with-query-and-shape-circle/371107)
**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 12:20am UTC](https://discuss.elastic.co/t/kibana-canvas-with-query-and-shape-circle/371107 "2024-11-27T00:20:32Z")
Hello, I would like to create a few dynamic circles based on the number of years that a user can input via filters esql for example - 2018, 2019, 2020, 2021, 2022 etc. Each of these years have values coming from elastic… --- ## [Filebeat inserting extra Unicode characters](https://discuss.elastic.co/t/filebeat-inserting-extra-unicode-characters/371048)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 2\ **Last updated:** [November 26, 2024, 10:18pm UTC](https://discuss.elastic.co/t/filebeat-inserting-extra-unicode-characters/371048 "2024-11-26T22:18:29Z")
This is the original entry in the log file: 2024-11-25 23:14:27,671 INFO o.s.w.s.c.WebSocketMessageBrokerStats \[MessageBroker-1\] WebSocketSession\[0 current WS(0)-HttpStream(0)-HttpPoll(0), 0 total, 0 closed abnormally (… --- ## [Tenable Integration](https://discuss.elastic.co/t/tenable-integration/371098)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 4\ **Last updated:** [November 26, 2024, 9:56pm UTC](https://discuss.elastic.co/t/tenable-integration/371098 "2024-11-26T21:56:21Z")
Hello everyone, I have installed the tenable integration which asks me to generate an API key to be able to use it and perform the ingest. When I noticed that the logs were not arriving I proceeded to review the log… --- ## [Manually specifing java heap size breaks elasticsearch service](https://discuss.elastic.co/t/manually-specifing-java-heap-size-breaks-elasticsearch-service/371101)
**Author:** [@ahsan0331](https://discuss.elastic.co/u/ahsan0331)\ **Replies:** 1\ **Last updated:** [November 26, 2024, 8:53pm UTC](https://discuss.elastic.co/t/manually-specifing-java-heap-size-breaks-elasticsearch-service/371101 "2024-11-26T20:53:11Z")
hi I have a vm wiht 16gb. i need to reduce its memory consumption. for some reasons manually specifying Xmx1g and Xms1g (or any other value) breaks the elasticsearch. the service wont start. commenting this setting in /… --- ## [GeoIP stopped working after upgrade](https://discuss.elastic.co/t/geoip-stopped-working-after-upgrade/371046)
**Author:** [@Leb\_Cryptos](https://discuss.elastic.co/u/Leb_Cryptos)\ **Replies:** 7\ **Last updated:** [November 26, 2024, 7:17pm UTC](https://discuss.elastic.co/t/geoip-stopped-working-after-upgrade/371046 "2024-11-26T19:17:06Z")
After Upgrading my elasticsearch and kibana to the latest version, geoip stopped working, everything else is working. --- ## [Ctrl+F search behavior in elastic](https://discuss.elastic.co/t/ctrl-f-search-behavior-in-elastic/371028)
**Author:** [@Arie\_Youlus](https://discuss.elastic.co/u/Arie_Youlus)\ **Replies:** 17\ **Last updated:** [November 26, 2024, 5:24pm UTC](https://discuss.elastic.co/t/ctrl-f-search-behavior-in-elastic/371028 "2024-11-26T17:24:55Z")
We are aiming to implement a naive search in Elasticsearch that functions exactly like a Ctrl+F search. Specifically, a query like "rd1 wo" should match "word1 word2" because it is a partial match in sequence. The searc… --- ## [Elastick - alerting](https://discuss.elastic.co/t/elastick-alerting/364536)
**Author:** [@Martin\_Stepanik](https://discuss.elastic.co/u/Martin_Stepanik)\ **Replies:** 1\ **Last updated:** [November 26, 2024, 5:19pm UTC](https://discuss.elastic.co/t/elastick-alerting/364536 "2024-11-26T17:19:45Z")
Hello, I have an enterprise license within elastic. I have an O365 agent deployed that collects logs. I can view them using dashboards. How do I please set up the logs from O365 to go through the connector to Mail? If… --- ## [Error with same mappings on all indices](https://discuss.elastic.co/t/error-with-same-mappings-on-all-indices/371035)
**Author:** [@danmera-ingenes](https://discuss.elastic.co/u/danmera-ingenes)\ **Replies:** 5\ **Last updated:** [November 26, 2024, 3:52pm UTC](https://discuss.elastic.co/t/error-with-same-mappings-on-all-indices/371035 "2024-11-26T15:52:51Z")
I've been having a big issue with my elastic stack, I am sending information from sql server to elasticsearch using logstash, and each index for each table gets created with the table columns as mappings in the index in … --- ## [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/371065)
**Author:** [@shubham21101997](https://discuss.elastic.co/u/shubham21101997)\ **Replies:** 1\ **Last updated:** [November 26, 2024, 12:07pm UTC](https://discuss.elastic.co/t/illegal-argument-exception/371065 "2024-11-26T12:07:54Z")
I am getting these error messaage , how to reslove it and also want to know if if i can skip for those document which exceeds the limit { "took": 382, "timed\_out": false, "\_shards": { "total": 16, "success… --- ## [Elastic Agent integration for Microsoft SQL Server](https://discuss.elastic.co/t/elastic-agent-integration-for-microsoft-sql-server/371077)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 0\ **Last updated:** [November 26, 2024, 11:06am UTC](https://discuss.elastic.co/t/elastic-agent-integration-for-microsoft-sql-server/371077 "2024-11-26T11:06:41Z")
I have application that is saving logs to SQL database. Now I'm using Logstash to read data from DB and send it to Elasticsearch and it's working fine. We are now taking Elastic Agent with Fleet into use and it would be … --- ## [After upgrade to 8.15.2 - csv export not working](https://discuss.elastic.co/t/after-upgrade-to-8-15-2-csv-export-not-working/368902)
**Author:** [@miiroslavkardos](https://discuss.elastic.co/u/miiroslavkardos)\ **Replies:** 8\ **Last updated:** [November 26, 2024, 10:42am UTC](https://discuss.elastic.co/t/after-upgrade-to-8-15-2-csv-export-not-working/368902 "2024-11-26T10:42:09Z")
Hello All, I have saved search which i am trying to export to csv. But i got error: document\_parsing\_exception Caused by: illegal\_argument\_exception: Expected text at 1:623 but found START\_OBJECT Root causes: document… --- ## [Filebeat-7.14.2 cannot automatically create index aliases](https://discuss.elastic.co/t/filebeat-7-14-2-cannot-automatically-create-index-aliases/371073)
**Author:** [@Archer-Tao](https://discuss.elastic.co/u/Archer-Tao)\ **Replies:** 0\ **Last updated:** [November 26, 2024, 9:31am UTC](https://discuss.elastic.co/t/filebeat-7-14-2-cannot-automatically-create-index-aliases/371073 "2024-11-26T09:31:52Z")
output.elasticsearch: hosts: \["http://:9200"\] indices: - index: "ai-service-log-test-%{+yyyy.MM}" when.contains: tags: "ai-service" username: "XXXX" password: "XXXXXXX!" setup.ilm.enabled: true setup.ilm.rollove… --- ## [Fleet / APM-server Panic with Jenkins OpenTelemetry plugin](https://discuss.elastic.co/t/fleet-apm-server-panic-with-jenkins-opentelemetry-plugin/371068)
**Author:** [@chntatxt](https://discuss.elastic.co/u/chntatxt)\ **Replies:** 0\ **Last updated:** [November 26, 2024, 8:42am UTC](https://discuss.elastic.co/t/fleet-apm-server-panic-with-jenkins-opentelemetry-plugin/371068 "2024-11-26T08:42:53Z")
Hi everyone, I have set a jenkins Opentelemetry output to a local apm-server deployed by fleet. Most of the time it works well, but sometime apm-server panic, and i really don't know how to deal with it. Unfortunatly,… --- ## [I am trying to list all the spaces, dashboards and watchers present on the entire elasticsearch cluster](https://discuss.elastic.co/t/i-am-trying-to-list-all-the-spaces-dashboards-and-watchers-present-on-the-entire-elasticsearch-cluster/371052)
**Author:** [@Johnson\_will](https://discuss.elastic.co/u/Johnson_will)\ **Replies:** 2\ **Last updated:** [November 26, 2024, 3:28am UTC](https://discuss.elastic.co/t/i-am-trying-to-list-all-the-spaces-dashboards-and-watchers-present-on-the-entire-elasticsearch-cluster/371052 "2024-11-26T03:28:20Z")
I am using the below apis to get them GET /api/spaces/space POST /api/saved\_objects/\_bulk\_get All the above are giving 400, are they deprecated in v8.13.4 ? --- ## [Purpose of Time filter in Kibana](https://discuss.elastic.co/t/purpose-of-time-filter-in-kibana/370986)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 5\ **Last updated:** [November 25, 2024, 9:16pm UTC](https://discuss.elastic.co/t/purpose-of-time-filter-in-kibana/370986 "2024-11-25T21:16:49Z")
Hi All, What is the significance of "Time filter" when setting up an index pattern or Data view? When setting it up it says Select a primary time field for use with the global time filter Thanks --- ## [Azure Service Health](https://discuss.elastic.co/t/azure-service-health/371039)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [November 25, 2024, 7:25pm UTC](https://discuss.elastic.co/t/azure-service-health/371039 "2024-11-25T19:25:25Z")
Is there a way to capture Azure Service Health data and ingest into Elastic? --- ## [Watcher Trigger Running on Sunday although cron set for MON-FRI](https://discuss.elastic.co/t/watcher-trigger-running-on-sunday-although-cron-set-for-mon-fri/371030)
**Author:** [@clos012](https://discuss.elastic.co/u/clos012)\ **Replies:** 4\ **Last updated:** [November 25, 2024, 6:27pm UTC](https://discuss.elastic.co/t/watcher-trigger-running-on-sunday-although-cron-set-for-mon-fri/371030 "2024-11-25T18:27:39Z")
Hello - I have setup a watcher to run between MON-FRI from 0600-1900 every 30mins. The cron job is adjusted for the -6 UTC time based on our current system time profile. The job should only run MON-FRI but I am seeing th… --- ## [Networkerror: error when attempting to fetch resource Kibana](https://discuss.elastic.co/t/networkerror-error-when-attempting-to-fetch-resource-kibana/370964)
**Author:** [@Darksin248](https://discuss.elastic.co/u/Darksin248)\ **Replies:** 7\ **Last updated:** [November 25, 2024, 5:32pm UTC](https://discuss.elastic.co/t/networkerror-error-when-attempting-to-fetch-resource-kibana/370964 "2024-11-25T17:32:01Z")
It’s to do with Kibana, I am trying to import three NDJSON files for dashboard visualisation as this is for network intrusion task. But it comes up with a network error, it’s having issues fetching the resources, I’ve ch… --- ## [How to include specific fields (columns) in Kibana Discover links in alert emails?](https://discuss.elastic.co/t/how-to-include-specific-fields-columns-in-kibana-discover-links-in-alert-emails/370958)
**Author:** [@Lapo](https://discuss.elastic.co/u/Lapo)\ **Replies:** 4\ **Last updated:** [November 25, 2024, 1:26pm UTC](https://discuss.elastic.co/t/how-to-include-specific-fields-columns-in-kibana-discover-links-in-alert-emails/370958 "2024-11-25T13:26:59Z")
Hi everyone, I'm using Kibana to set up alerts, and in my alert email templates, I include the {{context.link}} variable to provide a link to the Discover page. However, when clicking this link, I want specific fields l… --- ## [Share dashboards between Spaces issue](https://discuss.elastic.co/t/share-dashboards-between-spaces-issue/371026)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [November 25, 2024, 1:16pm UTC](https://discuss.elastic.co/t/share-dashboards-between-spaces-issue/371026 "2024-11-25T13:16:51Z")
Hey there, I have updated my cluster to latest ES 8.16.1 and I was quite confident to be able to share a Dashboard or anything else between different Spaces. Currently, it seems I can share only Data View saved objects … --- ## [Autodiscover categorizes field as long but discover says it's unknown](https://discuss.elastic.co/t/autodiscover-categorizes-field-as-long-but-discover-says-its-unknown/370948)
**Author:** [@mbby](https://discuss.elastic.co/u/mbby)\ **Replies:** 1\ **Last updated:** [November 25, 2024, 12:40pm UTC](https://discuss.elastic.co/t/autodiscover-categorizes-field-as-long-but-discover-says-its-unknown/370948 "2024-11-25T12:40:24Z")
Hi, I'm trying to ingest data and use auto discovery. When I look at the mappings my field is discovered as long. I guess that this is ok as it's an integer. "ResolveTime": { "type": "long" }, But w… --- ## [ERROR: logstash.licensechecker.licensereader](https://discuss.elastic.co/t/error-logstash-licensechecker-licensereader/371013)
**Author:** [@XiaoYu\_Zhang](https://discuss.elastic.co/u/XiaoYu_Zhang)\ **Replies:** 2\ **Last updated:** [November 25, 2024, 11:38am UTC](https://discuss.elastic.co/t/error-logstash-licensechecker-licensereader/371013 "2024-11-25T11:38:02Z")
\[2024-11-25T09:31:58,481\]\[ERROR\]\[logstash.licensechecker.licensereader\] Unable to retrieve license information from license server {:message=\>"No Available connections"} :cause=\>java.net.UnknownHostException: elasticsea… --- ## [Space in Key Value Pipeline](https://discuss.elastic.co/t/space-in-key-value-pipeline/371018)
**Author:** [@Patryk\_Ostrowski](https://discuss.elastic.co/u/Patryk_Ostrowski)\ **Replies:** 0\ **Last updated:** [November 25, 2024, 11:30am UTC](https://discuss.elastic.co/t/space-in-key-value-pipeline/371018 "2024-11-25T11:30:31Z")
Hello, I need to use the Key-Value processor to extract fields using Ingest Pipeline. Unfortunately, there are spaces in the field value. How do they have such a log extract the fields. field=1 field2=2 field3=Nov 25 2… --- ## [Storing string with : and](https://discuss.elastic.co/t/storing-string-with-and/371016)
**Author:** [@dikesGearing](https://discuss.elastic.co/u/dikesGearing)\ **Replies:** 0\ **Last updated:** [November 25, 2024, 10:34am UTC](https://discuss.elastic.co/t/storing-string-with-and/371016 "2024-11-25T10:34:48Z")
So... I a problem with my or no the companies data which can contain : and . and other valid value a-z0-9åäö.:!#$%&''\*+/=?^\_\`{|}~- , in multiple fields and it can look like this sdk:narhalsan:0203:vgregion.se. I'm alread… --- ## [Elastic ML alert](https://discuss.elastic.co/t/elastic-ml-alert/371015)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 0\ **Last updated:** [November 25, 2024, 10:01am UTC](https://discuss.elastic.co/t/elastic-ml-alert/371015 "2024-11-25T10:01:35Z")
Is it possible to use elastic machine learning to get notified if: index size hits a particular value? (or increases by a certain percentage) cluster storage increases by a certain value (or increases by a certain perc… --- ## [Hardware recommendation for vector search](https://discuss.elastic.co/t/hardware-recommendation-for-vector-search/370815)
**Author:** [@sandra\_a](https://discuss.elastic.co/u/sandra_a)\ **Replies:** 7\ **Last updated:** [November 25, 2024, 7:51am UTC](https://discuss.elastic.co/t/hardware-recommendation-for-vector-search/370815 "2024-11-25T07:51:29Z")
Hi; At the moment I have a cluster with 8 nodes, 2TB RAM and 5TB SSD disk. but after indexing vectors (1.2TB for now and will increase by time), search on it took 30 seconds. I've tried quantization , add more nodes a… --- ## [Cannot start elastic on windows](https://discuss.elastic.co/t/cannot-start-elastic-on-windows/371000)
**Author:** [@ahsan0331](https://discuss.elastic.co/u/ahsan0331)\ **Replies:** 3\ **Last updated:** [November 25, 2024, 7:36am UTC](https://discuss.elastic.co/t/cannot-start-elastic-on-windows/371000 "2024-11-25T07:36:05Z")
Hi, I am new to elastic. was trying to run it on windows to lab it for learning purpose. I was first time able to run it . then i deleted both the unziped folders of kibana and elasticsearch. and tried to run the elast… --- ## [Issue with Lifecycle Policy Compatibility in Elasticsearch 8.15.2](https://discuss.elastic.co/t/issue-with-lifecycle-policy-compatibility-in-elasticsearch-8-15-2/371008)
**Author:** [@vikascateina](https://discuss.elastic.co/u/vikascateina)\ **Replies:** 0\ **Last updated:** [November 25, 2024, 6:15am UTC](https://discuss.elastic.co/t/issue-with-lifecycle-policy-compatibility-in-elasticsearch-8-15-2/371008 "2024-11-25T06:15:59Z")
Hi, Below is the lifecycle policy I used with Elasticsearch version 7.17.9, where it was working successfully. However, the same policy is not functioning as expected with Elasticsearch version 8.15.2. I would greatly a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=130) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=132)