# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1327 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1328 --- ## [CompositeAgg DateHistograms - fill empty interval gaps & key\_as\_string like normal DateHistogramAgg](https://discuss.elastic.co/t/compositeagg-datehistograms-fill-empty-interval-gaps-key-as-string-like-normal-datehistogramagg/278271)
**Author:** [@xskerik](https://discuss.elastic.co/u/xskerik)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:40am UTC](https://discuss.elastic.co/t/compositeagg-datehistograms-fill-empty-interval-gaps-key-as-string-like-normal-datehistogramagg/278271 "2021-07-12T08:40:21Z")
This is basically follow up of issue CompositeAgg Histograms - fill empty interval gaps like normal histogramAggregation It would be nice if DateHistogram under Composite agg behaves more like plain DateHistogram. IDK… --- ## [Uploading nested csv giving error- 0: object mapping for \[comments\] tried to parse field \[comments\] as object, but found a concrete value](https://discuss.elastic.co/t/uploading-nested-csv-giving-error-0-object-mapping-for-comments-tried-to-parse-field-comments-as-object-but-found-a-concrete-value/278273)
**Author:** [@anaya](https://discuss.elastic.co/u/anaya)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:39am UTC](https://discuss.elastic.co/t/uploading-nested-csv-giving-error-0-object-mapping-for-comments-tried-to-parse-field-comments-as-object-but-found-a-concrete-value/278273 "2021-07-12T08:39:08Z")
Hi! I am trying to upload some data to elastic through a csv file which has multiple fields, out of which one is a nested field. The mapping i defined is as follows- "comments": { "type": "nested", "properties":{ "n… --- ## [Illegal\_argument\_exception on empty index](https://discuss.elastic.co/t/illegal-argument-exception-on-empty-index/278277)
**Author:** [@vitalismaxim](https://discuss.elastic.co/u/vitalismaxim)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:38am UTC](https://discuss.elastic.co/t/illegal-argument-exception-on-empty-index/278277 "2021-07-12T08:38:19Z")
Hi, I'm trying to index some files to a new and empty index called 'envri' but on the first file I'm getting 'illegal\_argument\_exception' , 'mapper \[spatialCoverage\] cannot be changed from type \[long\] to \[float\]. I unde… --- ## [Privilege issue : opening dashboard always requests the default index pattern](https://discuss.elastic.co/t/privilege-issue-opening-dashboard-always-requests-the-default-index-pattern/278274)
**Author:** [@duc00](https://discuss.elastic.co/u/duc00)\ **Replies:** 5\ **Last updated:** [July 12, 2021, 8:30am UTC](https://discuss.elastic.co/t/privilege-issue-opening-dashboard-always-requests-the-default-index-pattern/278274 "2021-07-12T08:30:53Z")
Hello, I have a user having only privilege to interact with the index pattern pattern-b-\*. Default index pattern is pattern-a-\*. The user is accessing a dashboard with visualisations only requesting pattern-b-\* indexes… --- ## [To use or not to use NodeSelector.SKIP\_DEDICATED\_MASTERS with high level rest client](https://discuss.elastic.co/t/to-use-or-not-to-use-nodeselector-skip-dedicated-masters-with-high-level-rest-client/278310)
**Author:** [@blindwitness](https://discuss.elastic.co/u/blindwitness)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:24am UTC](https://discuss.elastic.co/t/to-use-or-not-to-use-nodeselector-skip-dedicated-masters-with-high-level-rest-client/278310 "2021-07-12T08:24:12Z")
Hello, The documentation is slightly unclear in regards to using NodeSelectors for the rest client. We have a cluster with dedicated master-eligible nodes and dedicated data/ingest nodes. It seems that with this config… --- ## [Elasticsearch reindex then cant add mapping](https://discuss.elastic.co/t/elasticsearch-reindex-then-cant-add-mapping/278345)
**Author:** [@jordanuseselastic](https://discuss.elastic.co/u/jordanuseselastic)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-reindex-then-cant-add-mapping/278345 "2021-07-12T08:16:50Z")
Hi Elasticsearch experts! Wondering if someone can help with a strange thing that is happening: We have an index in which the amount of mappings has grown massive (over 3000) and we want to reduce this by reindexing. In … --- ## [Json\_parse\_exception multisearch](https://discuss.elastic.co/t/json-parse-exception-multisearch/278116)
**Author:** [@draft10](https://discuss.elastic.co/u/draft10)\ **Replies:** 5\ **Last updated:** [July 12, 2021, 8:08am UTC](https://discuss.elastic.co/t/json-parse-exception-multisearch/278116 "2021-07-12T08:08:06Z")
curl -X GET --user user:pass "localhost:port/element1-2021.07.06/\_msearch?pretty" -H 'Content-Type: application/json' -d' { } {"query": {"match" : {"application":"Scanner"}}} {"index": "element1-2021.07.06"} {"query"… --- ## [Restoring data when disabling \_source](https://discuss.elastic.co/t/restoring-data-when-disabling-source/277182)
**Author:** [@Bertg](https://discuss.elastic.co/u/Bertg)\ **Replies:** 6\ **Last updated:** [July 12, 2021, 8:04am UTC](https://discuss.elastic.co/t/restoring-data-when-disabling-source/277182 "2021-07-12T08:04:34Z")
Following up on a StackExchange conversation, I was wondering "how" and "how successful" one could rebuild data from an index without the \_source data. The ES documentation on disabling the \_source field warns about us… --- ## [Multiple condition checking and compare count](https://discuss.elastic.co/t/multiple-condition-checking-and-compare-count/278214)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 3\ **Last updated:** [July 12, 2021, 8:03am UTC](https://discuss.elastic.co/t/multiple-condition-checking-and-compare-count/278214 "2021-07-12T08:03:38Z")
Need to check two conditions with test type, for eg we have two types of test RTPCR and Antigen. we need to get an alert if the count of Antigen tests with positive cases is greater than 70% of RTPCR's positive case cou… --- ## [Use query match only to boost and don't increase the recall set](https://discuss.elastic.co/t/use-query-match-only-to-boost-and-dont-increase-the-recall-set/278385)
**Author:** [@Bikas\_Katwal](https://discuss.elastic.co/u/Bikas_Katwal)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 7:40am UTC](https://discuss.elastic.co/t/use-query-match-only-to-boost-and-dont-increase-the-recall-set/278385 "2021-07-12T07:40:02Z")
I have multiple match queries inside the should clause. I would like to add another field match, which should be used only to boost scores and not increase the recall set. I have the below query that is being used curre… --- ## [Rolling pipelines.separate\_logs](https://discuss.elastic.co/t/rolling-pipelines-separate-logs/277925)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 3\ **Last updated:** [July 12, 2021, 7:20am UTC](https://discuss.elastic.co/t/rolling-pipelines-separate-logs/277925 "2021-07-12T07:20:06Z")
Logstash v.7.13.2 Hi all, I'm successfully running 3 logstash instances via the following pipelines.yml file: - pipeline.id: upsert queue.type: persisted queue.checkpoint.writes: 1 path.config: "\ **Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 7:14am UTC](https://discuss.elastic.co/t/logstash-file-watcher-logs/278236 "2021-07-12T07:14:34Z") Hi team, I configured logstash to read to read /var/log/app/app.log file and it is able to read and send logs but data is not continuous. Is there any way to monitor file watcher in logstash. Like HARVESTER in filebe… --- ## [Reindexing Large index](https://discuss.elastic.co/t/reindexing-large-index/278313)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 6:40am UTC](https://discuss.elastic.co/t/reindexing-large-index/278313 "2021-07-12T06:40:48Z")
Earlier we were using ELK stack version 7.11 when we upgrade to 7.13.2 we phase mapping conflict problem although we didn't define mapping for event\_id,thread\_id,z\_elastic\_ecs.event.code GET log-wlb-2021.07.02-00000… --- ## [What is the best mix of index and shards on Elastic Cloud](https://discuss.elastic.co/t/what-is-the-best-mix-of-index-and-shards-on-elastic-cloud/276896)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 29\ **Last updated:** [July 12, 2021, 5:27am UTC](https://discuss.elastic.co/t/what-is-the-best-mix-of-index-and-shards-on-elastic-cloud/276896 "2021-07-12T05:27:40Z")
As the title says, we are using Elastic Cloud with 3 Elastic Instances. We are currently having 338 shards: but just having one index: Is this a proper way? Or should I create one index for each day maybe? (btw … --- ## [If my logstash input is File, do I still need to enable the persistent queue](https://discuss.elastic.co/t/if-my-logstash-input-is-file-do-i-still-need-to-enable-the-persistent-queue/278351)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 1:22am UTC](https://discuss.elastic.co/t/if-my-logstash-input-is-file-do-i-still-need-to-enable-the-persistent-queue/278351 "2021-07-12T01:22:59Z")
As the question, my Logstash reads data from a file and eventually writes it to elasticsearch, I need to ensure that the data will not be lost, do I need to enable persistent queues? My question is whether I need to enab… --- ## [Multiple .gz files in multiple sub directories](https://discuss.elastic.co/t/multiple-gz-files-in-multiple-sub-directories/278365)
**Author:** [@jmt605](https://discuss.elastic.co/u/jmt605)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 12:55am UTC](https://discuss.elastic.co/t/multiple-gz-files-in-multiple-sub-directories/278365 "2021-07-12T00:55:44Z")
I am sure this has been asked before but nothing I have found during my research has solved my problem. I am using Windows Server 2019 Standard. I have installed Kibana and Elasticsearch via zip files. I am trying to … --- ## [Java code to connect elasticsearch](https://discuss.elastic.co/t/java-code-to-connect-elasticsearch/278364)
**Author:** [@Cherrys](https://discuss.elastic.co/u/Cherrys)\ **Replies:** 1\ **Last updated:** [July 11, 2021, 7:07pm UTC](https://discuss.elastic.co/t/java-code-to-connect-elasticsearch/278364 "2021-07-11T19:07:50Z")
HI folks, How can I connect ElasticSearch using Java class. we have requirment suchs as we need java code to send request and get response from ElasticSearch . --- ## [Converting String to Date in Kibana](https://discuss.elastic.co/t/converting-string-to-date-in-kibana/278080)
**Author:** [@robertashok](https://discuss.elastic.co/u/robertashok)\ **Replies:** 2\ **Last updated:** [July 11, 2021, 3:54pm UTC](https://discuss.elastic.co/t/converting-string-to-date-in-kibana/278080 "2021-07-11T15:54:43Z")
I have the date as YYYY-MM-DD in kibana, I want to convert this one to date, so that i can use it in Visualisation. --- ## [Logstash jdbc input for sql express](https://discuss.elastic.co/t/logstash-jdbc-input-for-sql-express/276712)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 1\ **Last updated:** [July 11, 2021, 2:35pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-for-sql-express/276712 "2021-07-11T14:35:21Z")
Hi, Does anyone know a good example showing how to configure input for jdbc driver with sqlexpress. input { jdbc { jdbc\_driver\_library =\> "C:\\JDBC8.4\\sqljdbc\_8.4\\enu\\mssql-jdbc-8.4.1.jre14.jar" jdbc\_driver\_class =\> … --- ## [Logstash 5 not running](https://discuss.elastic.co/t/logstash-5-not-running/64449)
**Author:** [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)\ **Replies:** 71\ **Last updated:** [July 11, 2021, 11:39am UTC](https://discuss.elastic.co/t/logstash-5-not-running/64449 "2021-07-11T11:39:04Z")
hey there, I am following the official document and seems like it's not working. I am using a freshly installed CentOS 7 system and have Java 1.8 installed. As per the document when i run below \[Foo@Elastic logstash\]… --- ## [Change index alias](https://discuss.elastic.co/t/change-index-alias/278355)
**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\ **Replies:** 0\ **Last updated:** [July 11, 2021, 10:59am UTC](https://discuss.elastic.co/t/change-index-alias/278355 "2021-07-11T10:59:51Z")
Hi, Previously I have created an index alias tests PUT tests-00000001 { "aliases": { "tests": { "is\_write\_index": true } } } I have used it as rollover alias to create an index template PUT \_index\_t… --- ## [Kibana - intersection of two data sets on map](https://discuss.elastic.co/t/kibana-intersection-of-two-data-sets-on-map/277911)
**Author:** [@leonidbionic](https://discuss.elastic.co/u/leonidbionic)\ **Replies:** 4\ **Last updated:** [July 11, 2021, 9:34am UTC](https://discuss.elastic.co/t/kibana-intersection-of-two-data-sets-on-map/277911 "2021-07-11T09:34:38Z")
I have a index named 'request' with the below schema - \`\`\` "id": "160c6273-8462-4830-9a51-dabf2e292ebb", "username": "bob\_dylan", "date": "Jul 6, 2021 @ 12:00:00.000", "location": { "lat": 48.8, "lon": 2.35 }\`\`\`… --- ## [Metricbeat cluster sizing](https://discuss.elastic.co/t/metricbeat-cluster-sizing/276872)
**Author:** [@premierpsp](https://discuss.elastic.co/u/premierpsp)\ **Replies:** 16\ **Last updated:** [July 11, 2021, 7:12am UTC](https://discuss.elastic.co/t/metricbeat-cluster-sizing/276872 "2021-07-11T07:12:29Z")
Hello, I need your help. I’m deploying metricbeat on 3000 servers. The problem is that from 1000 agents loaded, kibana has problems to display the metrics. In fact, there are metrics that kibana cannot display. I think … --- ## [Search query for boolean operators in Elasticsearch 7.10?](https://discuss.elastic.co/t/search-query-for-boolean-operators-in-elasticsearch-7-10/278346)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 0\ **Last updated:** [July 11, 2021, 3:32am UTC](https://discuss.elastic.co/t/search-query-for-boolean-operators-in-elasticsearch-7-10/278346 "2021-07-11T03:32:01Z")
I have an index with large set of documents. I want to perform following boolean queries for the below operators: 1. eq 2. ne 3. startsWith 4. endsWith 5. contains 6. void : Return the document whi… --- ## [Can't find grok match](https://discuss.elastic.co/t/cant-find-grok-match/278240)
**Author:** [@Badb0y](https://discuss.elastic.co/u/Badb0y)\ **Replies:** 4\ **Last updated:** [July 11, 2021, 2:57am UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240 "2021-07-11T02:57:07Z")
Hi, I'm almost at the solution but not sure how to make this optimal and how to parse the ? marked part. These are my log lines: 2021-07-09T12:11:40.917+0700 7fce8a240700 1 beast: 0x7fceee9b06b0: 10.111.111.111 - - \[… --- ## [Logstash don't send logs to elasticsearch](https://discuss.elastic.co/t/logstash-dont-send-logs-to-elasticsearch/278339)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 20\ **Last updated:** [July 11, 2021, 12:50am UTC](https://discuss.elastic.co/t/logstash-dont-send-logs-to-elasticsearch/278339 "2021-07-11T00:50:43Z")
Hi community, I configured ssl on the whole stack (elasticsearch, kibana, logstash, filebeat) When I manually launch logstash to test my configuration, I have this return. I think it's good but I don't see anything in… --- ## [Listen loop error: #\](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/278338)
**Author:** [@Carlos\_Velasquez](https://discuss.elastic.co/u/Carlos_Velasquez)\ **Replies:** 0\ **Last updated:** [July 10, 2021, 3:41pm UTC](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/278338 "2021-07-10T15:41:10Z")
Hi, When I start the logstash (manual invocation), I receive the folowing error. the version i'm using is 7.12.1 and Centos 8 Operating System: CentOS Linux 8 CPE OS Name: cpe:/o:centos:centos:8 Ke… --- ## [I am unable to sync data from postgresql, Basically I am not able to start logstash](https://discuss.elastic.co/t/i-am-unable-to-sync-data-from-postgresql-basically-i-am-not-able-to-start-logstash/278331)
**Author:** [@NETESH\_KUMAR](https://discuss.elastic.co/u/NETESH_KUMAR)\ **Replies:** 2\ **Last updated:** [July 10, 2021, 2:50pm UTC](https://discuss.elastic.co/t/i-am-unable-to-sync-data-from-postgresql-basically-i-am-not-able-to-start-logstash/278331 "2021-07-10T14:50:47Z")
\#Here is my config file #--------- config file start---------------- Sample Logstash configuration for creating a simple Beats -\> Logstash -\> Elasticsearch pipeline. input{ jdbc{ jdbc\_connection\_string =\> "jdbc:postg… --- ## [\[Filebeat\] aws-cloudwatch input sends logs only after the filebeat service restarts](https://discuss.elastic.co/t/filebeat-aws-cloudwatch-input-sends-logs-only-after-the-filebeat-service-restarts/278336)
**Author:** [@Luci](https://discuss.elastic.co/u/Luci)\ **Replies:** 0\ **Last updated:** [July 10, 2021, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-aws-cloudwatch-input-sends-logs-only-after-the-filebeat-service-restarts/278336 "2021-07-10T14:41:48Z")
Filebeats ver: 7.13 I am using the aws-cloudwatch plugin with the following input configuration. \[2021-07-10 13:39:49.883Z:30560:I:\_\_main\_\_:wst-infra:39\] Invoking: sshi on account: beacon-test-tko region: None filebeat… --- ## [ILM my index is not doing rollover properly](https://discuss.elastic.co/t/ilm-my-index-is-not-doing-rollover-properly/278334)
**Author:** [@Daud\_Ahmed1](https://discuss.elastic.co/u/Daud_Ahmed1)\ **Replies:** 4\ **Last updated:** [July 10, 2021, 2:29pm UTC](https://discuss.elastic.co/t/ilm-my-index-is-not-doing-rollover-properly/278334 "2021-07-10T14:29:07Z")
Below is my ILM policy { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_age": "30d", "max\_size": "50gb" }, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1326) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1328)