# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1329 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1330 --- ## [Desired fields did get create after modifying logstash config](https://discuss.elastic.co/t/desired-fields-did-get-create-after-modifying-logstash-config/278039)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 6\ **Last updated:** [July 9, 2021, 10:28am UTC](https://discuss.elastic.co/t/desired-fields-did-get-create-after-modifying-logstash-config/278039 "2021-07-09T10:28:12Z")
Hi All, I have created two different elastic search clusters. In first cluster (created newly) ,(v 7.13.2), I have created below config in pipeline.conf under conf.d for logstash and it worked as I see expected fields … --- ## [ElasticSearch: Order top-level aggregation buckets based on reverse\_nested doc\_count](https://discuss.elastic.co/t/elasticsearch-order-top-level-aggregation-buckets-based-on-reverse-nested-doc-count/278250)
**Author:** [@afasias](https://discuss.elastic.co/u/afasias)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-order-top-level-aggregation-buckets-based-on-reverse-nested-doc-count/278250 "2021-07-09T10:23:58Z")
Hi. My Elasticsearch info: { "version": { "number": "6.3.1", "build\_flavor": "oss", "build\_type": "zip", "build\_hash": "9d3e794", "build\_date": "2020-06-09T23:40:32.185794Z",… --- ## [Kibana launch failed](https://discuss.elastic.co/t/kibana-launch-failed/277629)
**Author:** [@EpLiar](https://discuss.elastic.co/u/EpLiar)\ **Replies:** 18\ **Last updated:** [July 9, 2021, 9:34am UTC](https://discuss.elastic.co/t/kibana-launch-failed/277629 "2021-07-09T09:34:44Z")
I deploy elasticsearch on 192.168.50.216 and 192.168.50.69. Both are working. \[epi@localhost ~\]$ curl 192.168.50.69:9200 { "name" : "EpCent-1", "cluster\_name" : "EpCluster", "cluster\_uuid" : "XuZIcIMhR46iStO7LJIdN… --- ## [What is best practice for indexing for hot/warm/cold...daily indices?](https://discuss.elastic.co/t/what-is-best-practice-for-indexing-for-hot-warm-cold-daily-indices/278196)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 9:00am UTC](https://discuss.elastic.co/t/what-is-best-practice-for-indexing-for-hot-warm-cold-daily-indices/278196 "2021-07-09T09:00:58Z")
I have a ILM policy for 7 days in hot, 23 days in warm and the rest in cold. Should I have a new index created every day for this? --- ## [Daily index not created](https://discuss.elastic.co/t/daily-index-not-created/278215)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 6\ **Last updated:** [July 9, 2021, 8:39am UTC](https://discuss.elastic.co/t/daily-index-not-created/278215 "2021-07-09T08:39:39Z")
Hi, I see below indices getting created daily without an issue. yellow open access\_server-2021.07.06 HGHg9wiBTz-42qxzIAuV3A 1 1 203 0 341.5kb 341.5kb yellow open access\_serv… --- ## [Ilm is creating an infinite initial index of {index\_name}-000001](https://discuss.elastic.co/t/ilm-is-creating-an-infinite-initial-index-of-index-name-000001/278254)
**Author:** [@Stewart](https://discuss.elastic.co/u/Stewart)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 8:37am UTC](https://discuss.elastic.co/t/ilm-is-creating-an-infinite-initial-index-of-index-name-000001/278254 "2021-07-09T08:37:26Z")
I would like to ask an ILM related issue. The index is being deleted with ilm and it is working, but from a certain moment, the initial 0000001 index is created in the indices that are suddenly well rolled over, and th… --- ## [How to find relations between independent documents within an index](https://discuss.elastic.co/t/how-to-find-relations-between-independent-documents-within-an-index/278107)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 6\ **Last updated:** [July 9, 2021, 8:30am UTC](https://discuss.elastic.co/t/how-to-find-relations-between-independent-documents-within-an-index/278107 "2021-07-09T08:30:41Z")
So, I've been struggling for a while with a problem that looked simple but for which I just cannot find a solution. At this point I'm not sure if it's not possible to do this, or if I'm just unable to see it. Let's see i… --- ## [Index \[ilm-history -3-0001\] blocked by :\[TOO\_MANY\_REQUESTS/12/disk usage exceeded, index has read-only-allow-delete block\]](https://discuss.elastic.co/t/index-ilm-history-3-0001-blocked-by-too-many-requests-12-disk-usage-exceeded-index-has-read-only-allow-delete-block/278051)
**Author:** [@mba](https://discuss.elastic.co/u/mba)\ **Replies:** 5\ **Last updated:** [July 9, 2021, 8:27am UTC](https://discuss.elastic.co/t/index-ilm-history-3-0001-blocked-by-too-many-requests-12-disk-usage-exceeded-index-has-read-only-allow-delete-block/278051 "2021-07-09T08:27:41Z")
index \[ilm-history -3-0001\] blocked by :\[TOO\_MANY\_REQUESTS/12/disk usage exceeded, index has read-only-allow-delete block\] --- ## [Comparing Date Fields of Nested Objects](https://discuss.elastic.co/t/comparing-date-fields-of-nested-objects/278222)
**Author:** [@Fatih\_Kurnaz](https://discuss.elastic.co/u/Fatih_Kurnaz)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 8:27am UTC](https://discuss.elastic.co/t/comparing-date-fields-of-nested-objects/278222 "2021-07-09T08:27:13Z")
Hi Everyone; Here my painless script; "script\_fields": { "seen": { "script": { "source": """ for (view in params\['\_source'\]\['viewing\_appointments'\]) { if (new Date().getTime() - view.view… --- ## [Not able to connect to elastic host](https://discuss.elastic.co/t/not-able-to-connect-to-elastic-host/278247)
**Author:** [@mac2](https://discuss.elastic.co/u/mac2)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 8:23am UTC](https://discuss.elastic.co/t/not-able-to-connect-to-elastic-host/278247 "2021-07-09T08:23:31Z")
I am trying to connect to the elastic running on a linux box from my local windows azure machine using below in java Preformatted textTransportClient transportClient = (new PreBuiltTransportClient(Settings.EMPTY, new Cl… --- ## [Heatmap hide specific column](https://discuss.elastic.co/t/heatmap-hide-specific-column/278170)
**Author:** [@Celiken](https://discuss.elastic.co/u/Celiken)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 7:50am UTC](https://discuss.elastic.co/t/heatmap-hide-specific-column/278170 "2021-07-09T07:50:45Z")
Hi, I'm trying to create a heatmap but I encounter some issues. This is how it looked at first: Here, the X axis is not sorted and miss values (going from 1 to 15). I found I can fix it by adding {"min\_doc\_count":… --- ## [Date Field with Millis stored as double leading to error](https://discuss.elastic.co/t/date-field-with-millis-stored-as-double-leading-to-error/277519)
**Author:** [@Bertram](https://discuss.elastic.co/u/Bertram)\ **Replies:** 4\ **Last updated:** [July 9, 2021, 7:25am UTC](https://discuss.elastic.co/t/date-field-with-millis-stored-as-double-leading-to-error/277519 "2021-07-09T07:25:40Z")
Hey there, I recently got this strange problem in a new index: Basic info: Elasticsearch Version: 7.13.2 Nodes: 1 Node (localhost in Dev-Env) Middleware: \[Elasticsearch-PHP\] API-Wrapper The index got a date field a… --- ## [I'm confused: Keyword Mapping and Multi-fields](https://discuss.elastic.co/t/im-confused-keyword-mapping-and-multi-fields/278237)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 7:11am UTC](https://discuss.elastic.co/t/im-confused-keyword-mapping-and-multi-fields/278237 "2021-07-09T07:11:03Z")
I'm trying to switch our logging data to ECS. So I've adapted our logstash config to use some new field names and created a static mapping in the destination index. But the data is not indexed as keyword as I would expec… --- ## [Aggs order with a query scope, got docs not in the query scope, why?](https://discuss.elastic.co/t/aggs-order-with-a-query-scope-got-docs-not-in-the-query-scope-why/278230)
**Author:** [@daniel\_wang](https://discuss.elastic.co/u/daniel_wang)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 7:05am UTC](https://discuss.elastic.co/t/aggs-order-with-a-query-scope-got-docs-not-in-the-query-scope-why/278230 "2021-07-09T07:05:15Z")
My es version info: { "version": { "number": "7.7.1", "build\_flavor": "default", "build\_type": "tar", "build\_hash": "ad56dce891c901a492bb1ee393f12dfff473a423", "build\_date": "… --- ## [Winlogbeat timestamp different with event create time](https://discuss.elastic.co/t/winlogbeat-timestamp-different-with-event-create-time/278160)
**Author:** [@Jacky1](https://discuss.elastic.co/u/Jacky1)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 3:38am UTC](https://discuss.elastic.co/t/winlogbeat-timestamp-different-with-event-create-time/278160 "2021-07-09T03:38:46Z")
Dears I got a very strange problem. We installed winlogbeat v7.2 and directly shipped windows event log to ES, configurations about winlogbeat as below: name: Security ignore\_older: 24h name: Microsoft-Windows-NTLM/O… --- ## [Advice on optimal number of indices](https://discuss.elastic.co/t/advice-on-optimal-number-of-indices/278227)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 12:59am UTC](https://discuss.elastic.co/t/advice-on-optimal-number-of-indices/278227 "2021-07-09T00:59:51Z")
I am working on a system to store network flow records in Elasticsearch. There are too many documents to keep for long periods (~35 million per hour). We wrote a tool to aggregate these into fewer documents (~8 million … --- ## [Policy for index failed on step \[{"phase":"hot","action":"rollover","name":"check-rollover-ready"}\]](https://discuss.elastic.co/t/policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/278141)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 6:40am UTC](https://discuss.elastic.co/t/policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/278141 "2021-07-08T06:40:09Z")
I am using Logstash to create a daily index in ElasticSearch. This time, I tried to create an index using an index template, but I noticed that ElasticSearch was generating the following ILM error. $ tail -n 30 /var/lo… --- ## [How to enable geo\_point or geo\_shape in csv data to linestring](https://discuss.elastic.co/t/how-to-enable-geo-point-or-geo-shape-in-csv-data-to-linestring/278120)
**Author:** [@yuhw1](https://discuss.elastic.co/u/yuhw1)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 12:07am UTC](https://discuss.elastic.co/t/how-to-enable-geo-point-or-geo-shape-in-csv-data-to-linestring/278120 "2021-07-09T00:07:22Z")
I am trying to draw a line by extracting the location and timestamp data from the geo\_point or geo\_shape index where the csv file is uploaded. But it keeps failing, and the aggregations are not applied. So, I am asking i… --- ## [More Like This (MLT) query among only documents with a given field value?](https://discuss.elastic.co/t/more-like-this-mlt-query-among-only-documents-with-a-given-field-value/278225)
**Author:** [@aacitelli](https://discuss.elastic.co/u/aacitelli)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 11:01pm UTC](https://discuss.elastic.co/t/more-like-this-mlt-query-among-only-documents-with-a-given-field-value/278225 "2021-07-08T23:01:27Z")
I have a bunch (millions, but ideally scalable to billions/trillions) of documents in an ElasticSearch 7.13.0 index, and I am successfully performing MLT queries on them. Each document has an id, a text field, and a "clu… --- ## [Can't create new Kibana visualizations after upgrade to 7.13](https://discuss.elastic.co/t/cant-create-new-kibana-visualizations-after-upgrade-to-7-13/278202)
**Author:** [@Toumal](https://discuss.elastic.co/u/Toumal)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 10:00pm UTC](https://discuss.elastic.co/t/cant-create-new-kibana-visualizations-after-upgrade-to-7-13/278202 "2021-07-08T22:00:11Z")
Unfortunately I still run into issues after this upgrade: creating any kind of new visualization fails with an "Application not found" error. This is the basic license and I was trying to create a basic bar chart. It see… --- ## [Space/permission controls for "Add data" button](https://discuss.elastic.co/t/space-permission-controls-for-add-data-button/278187)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 8:11pm UTC](https://discuss.elastic.co/t/space-permission-controls-for-add-data-button/278187 "2021-07-08T20:11:24Z")
Is there a permission to remove/hide the button shown in the screenshot? I've tried trial and error but no luck. --- ## [High CPU usages in Elastic Node](https://discuss.elastic.co/t/high-cpu-usages-in-elastic-node/277996)
**Author:** [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 7:53pm UTC](https://discuss.elastic.co/t/high-cpu-usages-in-elastic-node/277996 "2021-07-08T19:53:48Z")
High CPU usages in Elastic Node In a development setting, I have both ElasticSearch, Kibana and MetricBeat running on the same server. The CPU resources are so high that I couldn’t remote onto the server. It is only wh… --- ## [Yarn kbn bootstrap fails](https://discuss.elastic.co/t/yarn-kbn-bootstrap-fails/275337)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 27\ **Last updated:** [July 8, 2021, 7:14pm UTC](https://discuss.elastic.co/t/yarn-kbn-bootstrap-fails/275337 "2021-07-08T19:14:17Z")
Hello everyone, I have been trying to run yarn kbn bootstrap but it keeps giving me following errors. E:\\Kibana-development\\kibana\>yarn kbn bootstrap --force-install yarn run v1.22.10 $ node scripts/kbn bootstrap --for… --- ## [Need clarity on recovery throttling parameters impacting snapshot restores](https://discuss.elastic.co/t/need-clarity-on-recovery-throttling-parameters-impacting-snapshot-restores/278199)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 6:24pm UTC](https://discuss.elastic.co/t/need-clarity-on-recovery-throttling-parameters-impacting-snapshot-restores/278199 "2021-07-08T18:24:50Z")
Hi, Current version used - elasticsearch-oss 7.8.0 Upgrading to: elasticsearch-oss 7.10.2 Elasticsearch 7.9 breaking change mentions about Snapshot restore throttling. As per the change - Restoring from a snapshot n… --- ## [How do I change a symbol on the kibana panel, as per the condition](https://discuss.elastic.co/t/how-do-i-change-a-symbol-on-the-kibana-panel-as-per-the-condition/278077)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 6:08pm UTC](https://discuss.elastic.co/t/how-do-i-change-a-symbol-on-the-kibana-panel-as-per-the-condition/278077 "2021-07-08T18:08:50Z")
How do I change a symbol on the kibana panel, as per the condition. example, I wanted to show that when something had a value above 10, I would place an image, and if it was less than 10, another image. It would be poss… --- ## [\[kibana 7.13\]can not support the --allow-root when using the kibana-keystore](https://discuss.elastic.co/t/kibana-7-13-can-not-support-the-allow-root-when-using-the-kibana-keystore/278207)
**Author:** [@harry\_010](https://discuss.elastic.co/u/harry_010)\ **Replies:** 6\ **Last updated:** [July 8, 2021, 6:08pm UTC](https://discuss.elastic.co/t/kibana-7-13-can-not-support-the-allow-root-when-using-the-kibana-keystore/278207 "2021-07-08T18:08:26Z")
when I used the following command to create the Keystore, I got the following error. /usr/share/kibana/bin/kibana-keystore create --allow-root kibana.keystore located in the data folder is deprecated. Future versions … --- ## [Firefox not loading the contents in kibana dashboard](https://discuss.elastic.co/t/firefox-not-loading-the-contents-in-kibana-dashboard/278182)
**Author:** [@martianzz](https://discuss.elastic.co/u/martianzz)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 5:50pm UTC](https://discuss.elastic.co/t/firefox-not-loading-the-contents-in-kibana-dashboard/278182 "2021-07-08T17:50:19Z")
OS is debian 8. Tried opening elastic in all browsers. None worked. Except for Firefox atleast loaded the contents without the values. It is working in all other Desktops. Kindly help with this issue. --- ## [Full Collection rebuild for Indexing fails](https://discuss.elastic.co/t/full-collection-rebuild-for-indexing-fails/277679)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 4:20pm UTC](https://discuss.elastic.co/t/full-collection-rebuild-for-indexing-fails/277679 "2021-07-08T16:20:07Z")
Upgraded to new Oracle12c CMS and migrated ~4 Million documents. However running the Full Collection Rebuild for Indexing fails with below error. 2 difference CMS instances are pointing to same Elasticsearch.. Error: "\>… --- ## [Error 401 when authenticating with OpenIDConnect](https://discuss.elastic.co/t/error-401-when-authenticating-with-openidconnect/277977)
**Author:** [@Kostas\_elastic](https://discuss.elastic.co/u/Kostas_elastic)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 4:29pm UTC](https://discuss.elastic.co/t/error-401-when-authenticating-with-openidconnect/277977 "2021-07-08T16:29:09Z")
Hello everyone, I am getting this error message after trying to authenticate with OIDC. {"statusCode":401,"error":"Unauthorized","message":"Response session state does not have corresponding state or nonce parameters o… --- ## [Netflow Configuration](https://discuss.elastic.co/t/netflow-configuration/278176)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 4:15pm UTC](https://discuss.elastic.co/t/netflow-configuration/278176 "2021-07-08T16:15:01Z")
what would be the best way to ingest netflow traffic in elastic? I couldn't find much info about this on elastic website. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1328) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1330)