# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1332 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1333 --- ## [How to sort an elasticsearch query based on the size of nested objects that match a condition?](https://discuss.elastic.co/t/how-to-sort-an-elasticsearch-query-based-on-the-size-of-nested-objects-that-match-a-condition/277810)
**Author:** [@EmilieM](https://discuss.elastic.co/u/EmilieM)\ **Replies:** 1\ **Last updated:** [July 7, 2021, 2:55pm UTC](https://discuss.elastic.co/t/how-to-sort-an-elasticsearch-query-based-on-the-size-of-nested-objects-that-match-a-condition/277810 "2021-07-07T14:55:55Z")
I try to sort my elastic search query based on the size of nested objects that match a condition (here: size of boosters with a specific status) Here is my mapping : { "companies" : { "mappings" : { "dynami… --- ## [ES queries became very slow after upgrading from 7.11 to 7.13.2](https://discuss.elastic.co/t/es-queries-became-very-slow-after-upgrading-from-7-11-to-7-13-2/277932)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [July 7, 2021, 2:52pm UTC](https://discuss.elastic.co/t/es-queries-became-very-slow-after-upgrading-from-7-11-to-7-13-2/277932 "2021-07-07T14:52:50Z")
Hi, ES queries became very slow after upgrading from 7.11 to 7.13.2. what can I do ? what changes made in 7.12 and 7.13 that may affect the performance ? Thanks --- ## [Query containing special character is not working](https://discuss.elastic.co/t/query-containing-special-character-is-not-working/277080)
**Author:** [@ElektroKinetik](https://discuss.elastic.co/u/ElektroKinetik)\ **Replies:** 2\ **Last updated:** [July 7, 2021, 2:35pm UTC](https://discuss.elastic.co/t/query-containing-special-character-is-not-working/277080 "2021-07-07T14:35:13Z")
This works! { "match\_phrase": { "fields.customer": { "query": “\\"MFG OPS AC DEV\\"" } } }, This doe's … --- ## [Elasticsearch-keystore list command could not find java](https://discuss.elastic.co/t/elasticsearch-keystore-list-command-could-not-find-java/278069)
**Author:** [@Prabaharan\_Kathiresa](https://discuss.elastic.co/u/Prabaharan_Kathiresa)\ **Replies:** 0\ **Last updated:** [July 7, 2021, 12:27pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-list-command-could-not-find-java/278069 "2021-07-07T12:27:02Z")
Hi Team we are migrating ES 6.8.5 Java environment from Java8 to Java11. we are using oraclejdk11 as our Java vendor. we set Java\_home in bin/elasticsearch file like below usr/java/jdk11 In ansbile below task is fa… --- ## [I am trying to change the values of the fields while querying the data to Vega](https://discuss.elastic.co/t/i-am-trying-to-change-the-values-of-the-fields-while-querying-the-data-to-vega/277995)
**Author:** [@aswanth\_jabba](https://discuss.elastic.co/u/aswanth_jabba)\ **Replies:** 1\ **Last updated:** [July 7, 2021, 12:47pm UTC](https://discuss.elastic.co/t/i-am-trying-to-change-the-values-of-the-fields-while-querying-the-data-to-vega/277995 "2021-07-07T12:47:01Z")
So, I have data something like this And I want the Data to be like : Except for Closed and Submitted states it should change the value to In Progress I know how this can be achieved through the scripted fields, but… --- ## [What is considered a "large arbitrary set of keys", for the nested mapping?](https://discuss.elastic.co/t/what-is-considered-a-large-arbitrary-set-of-keys-for-the-nested-mapping/278064)
**Author:** [@Lockhead](https://discuss.elastic.co/u/Lockhead)\ **Replies:** 2\ **Last updated:** [July 7, 2021, 12:42pm UTC](https://discuss.elastic.co/t/what-is-considered-a-large-arbitrary-set-of-keys-for-the-nested-mapping/278064 "2021-07-07T12:42:46Z")
On Nested field type | Elasticsearch Guide \[7.13\] | Elastic you can find this statement: "When ingesting key-value pairs with a large, arbitrary set of keys, you might consider modeling each key-value pair as its own nes… --- ## [Entity-centric indexing with Transforms](https://discuss.elastic.co/t/entity-centric-indexing-with-transforms/277798)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 4\ **Last updated:** [July 7, 2021, 12:34pm UTC](https://discuss.elastic.co/t/entity-centric-indexing-with-transforms/277798 "2021-07-07T12:34:51Z")
Hello, we're working with Elasticsearch for the first time and we are currently deciding on what would be the best solution for our problem at hand. We are receiving Event based logs (in JSON form) from our applications… --- ## [Get rid of message: ... waiting for elected master node... to setup local exporter... (does it have x-pack installed?)](https://discuss.elastic.co/t/get-rid-of-message-waiting-for-elected-master-node-to-setup-local-exporter-does-it-have-x-pack-installed/277999)
**Author:** [@Dyanne\_Ostlind](https://discuss.elastic.co/u/Dyanne_Ostlind)\ **Replies:** 1\ **Last updated:** [July 7, 2021, 12:28pm UTC](https://discuss.elastic.co/t/get-rid-of-message-waiting-for-elected-master-node-to-setup-local-exporter-does-it-have-x-pack-installed/277999 "2021-07-07T12:28:36Z")
How do I shut off this message? I'm using the fully open-source version of ES 7.5.2: \[2020-02-20T00:22:18,086\]\[INFO \]\[o.e.x.m.e.l.LocalExporter\] \[coordinator6\] waiting for elected master node \[{master1}{68sPQmYrRdW60YXS… --- ## [Logstash elastic HostUnreachableError while elastic is available](https://discuss.elastic.co/t/logstash-elastic-hostunreachableerror-while-elastic-is-available/278067)
**Author:** [@JoranDox](https://discuss.elastic.co/u/JoranDox)\ **Replies:** 0\ **Last updated:** [July 7, 2021, 12:13pm UTC](https://discuss.elastic.co/t/logstash-elastic-hostunreachableerror-while-elastic-is-available/278067 "2021-07-07T12:13:04Z")
logstash (7.13.1) doesn't work without clear reason why: we get "LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError" but we can curl from the same pod with the same url & credentials it works in … --- ## [ES is not coming up after changing JAVA\_HOME](https://discuss.elastic.co/t/es-is-not-coming-up-after-changing-java-home/277835)
**Author:** [@Prabaharan\_Kathiresa](https://discuss.elastic.co/u/Prabaharan_Kathiresa)\ **Replies:** 3\ **Last updated:** [July 7, 2021, 12:05pm UTC](https://discuss.elastic.co/t/es-is-not-coming-up-after-changing-java-home/277835 "2021-07-07T12:05:15Z")
Hi Team, We are running ES 6.8.5 in unix machine and its running on 1.8. We decided to promote java 1.8 to java11 oracle jdk. Can someone advise me what should i do now ? Steps we did Stopped ES 6.8.5 from Unix Mac… --- ## [Unexpected lens render behavior](https://discuss.elastic.co/t/unexpected-lens-render-behavior/278058)
**Author:** [@evgeny-divi](https://discuss.elastic.co/u/evgeny-divi)\ **Replies:** 1\ **Last updated:** [July 7, 2021, 11:45am UTC](https://discuss.elastic.co/t/unexpected-lens-render-behavior/278058 "2021-07-07T11:45:43Z")
When i am using multiple filters in lens i get unexpected behavior of rendering. How to get "No results found" dummy instead of pic related when there is no data and available fields ? By the way there is a really smal… --- ## [Filebeat Multiline - requires pattern to repeat?](https://discuss.elastic.co/t/filebeat-multiline-requires-pattern-to-repeat/277982)
**Author:** [@MrDecisive](https://discuss.elastic.co/u/MrDecisive)\ **Replies:** 1\ **Last updated:** [July 7, 2021, 11:30am UTC](https://discuss.elastic.co/t/filebeat-multiline-requires-pattern-to-repeat/277982 "2021-07-07T11:30:07Z")
I have a file like this. \[2021-04-22T13:10:06.549Z\] Start new event \[2021-04-22T13:10:06.549Z\] + set \[2021-04-22T13:10:06.549Z\] BUILD\_NUMBER=401 \[2021-04-22T13:10:06.549Z\] BRANCH\_NAME=develop \[2021-04-22T13:10:06.549Z\] … --- ## [As best practice as there any limit on number of indices in elastic search](https://discuss.elastic.co/t/as-best-practice-as-there-any-limit-on-number-of-indices-in-elastic-search/278049)
**Author:** [@mba](https://discuss.elastic.co/u/mba)\ **Replies:** 1\ **Last updated:** [July 7, 2021, 11:28am UTC](https://discuss.elastic.co/t/as-best-practice-as-there-any-limit-on-number-of-indices-in-elastic-search/278049 "2021-07-07T11:28:13Z")
I want to do logging of 100+ microservices. So is it good practice to have separate index for every microservice (index=MS name) ?? --- ## [Activate Xpack + Watcher for existing Elasticsearch installation](https://discuss.elastic.co/t/activate-xpack-watcher-for-existing-elasticsearch-installation/278057)
**Author:** [@jdbcplusnet](https://discuss.elastic.co/u/jdbcplusnet)\ **Replies:** 1\ **Last updated:** [July 7, 2021, 11:22am UTC](https://discuss.elastic.co/t/activate-xpack-watcher-for-existing-elasticsearch-installation/278057 "2021-07-07T11:22:12Z")
Hi all My company has already installed Elasticsearch + Kibana 6.8.7 with Basic License. We need to use Watcher API from Xpack plugin, so I guess we should buy a License for it. Can someone describe the process in case… --- ## [ElasticSearch Goes Down (Ram issue)](https://discuss.elastic.co/t/elasticsearch-goes-down-ram-issue/277696)
**Author:** [@bhamidpour](https://discuss.elastic.co/u/bhamidpour)\ **Replies:** 6\ **Last updated:** [July 7, 2021, 10:42am UTC](https://discuss.elastic.co/t/elasticsearch-goes-down-ram-issue/277696 "2021-07-07T10:42:00Z")
Hello, I assigned 3GB ram to elasticSearch and also I used one cluster with 3 nodes for it. 3 JDBC pipelines (log data with logstash) run on it and I want to extend it in the future too. and also I used Docker to run ELK… --- ## [Yet another logstash and json issue, unable to ingest a "basic" json](https://discuss.elastic.co/t/yet-another-logstash-and-json-issue-unable-to-ingest-a-basic-json/277991)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 4\ **Last updated:** [July 7, 2021, 10:09am UTC](https://discuss.elastic.co/t/yet-another-logstash-and-json-issue-unable-to-ingest-a-basic-json/277991 "2021-07-07T10:09:56Z")
I have a dir with tons of subdirs with a json file like this: { "id": "2234", "name": "Text", "url": "https://url.com", "param": "string", "last": "2021-07-06 20:05:49.458724", "url2": "url.com… --- ## [Any-way-to-show-different-dashboards-for-different-users for same org in same space](https://discuss.elastic.co/t/any-way-to-show-different-dashboards-for-different-users-for-same-org-in-same-space/277957)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [July 7, 2021, 9:35am UTC](https://discuss.elastic.co/t/any-way-to-show-different-dashboards-for-different-users-for-same-org-in-same-space/277957 "2021-07-07T09:35:53Z")
Hi Experts! Is there any possible way for me to show different Kibana dashboards for different users? For example, I have 4 users in the same org, as the org is the same the data/dashboards are stored in the same space. … --- ## [Problems in Elasticsearch combining two types of logs using two pipelines (Logstash)](https://discuss.elastic.co/t/problems-in-elasticsearch-combining-two-types-of-logs-using-two-pipelines-logstash/278048)
**Author:** [@francesco96](https://discuss.elastic.co/u/francesco96)\ **Replies:** 0\ **Last updated:** [July 7, 2021, 9:06am UTC](https://discuss.elastic.co/t/problems-in-elasticsearch-combining-two-types-of-logs-using-two-pipelines-logstash/278048 "2021-07-07T09:06:57Z")
Hi everyone, I need some help. I have configured my ES stack inside a docker. I need to show two types of logs (syslog, log), in an Elastic index. I have created two configuration files logstash.cong logstash-syslog.c… --- ## [Jdbc input not writing index](https://discuss.elastic.co/t/jdbc-input-not-writing-index/277815)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 10:53am UTC](https://discuss.elastic.co/t/jdbc-input-not-writing-index/277815 "2021-07-05T10:53:33Z")
Hello, here is my sample input.conf: input { jdbc { jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_connection\_string =\> "jdbc:sqlserver://x.x.x.x;databa… --- ## [Endless Exceptions loop fixed or not?](https://discuss.elastic.co/t/endless-exceptions-loop-fixed-or-not/278047)
**Author:** [@pascalku](https://discuss.elastic.co/u/pascalku)\ **Replies:** 0\ **Last updated:** [July 7, 2021, 8:59am UTC](https://discuss.elastic.co/t/endless-exceptions-loop-fixed-or-not/278047 "2021-07-07T08:59:46Z")
Hi there, I am running into an endless loop of exceptions (see: Fix Infinite Loops in ExceptionsHelper#unwrap by original-brownbear · Pull Request #42716 · elastic/elasticsearch · GitHub). According to your release docu… --- ## [Unable to ceate new index pattern in kibana](https://discuss.elastic.co/t/unable-to-ceate-new-index-pattern-in-kibana/277929)
**Author:** [@brand.u](https://discuss.elastic.co/u/brand.u)\ **Replies:** 2\ **Last updated:** [July 7, 2021, 8:39am UTC](https://discuss.elastic.co/t/unable-to-ceate-new-index-pattern-in-kibana/277929 "2021-07-07T08:39:27Z")
Hi, i'm using elastic stack fpr several years. I've been watching the problem since version 5.xx and up to 7.13.2 After some time of usage your're unable to crate new index patterns in kibana. The "create index patte… --- ## [Incorrect timestamp used during query or while seeing messages in Discover](https://discuss.elastic.co/t/incorrect-timestamp-used-during-query-or-while-seeing-messages-in-discover/277868)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 3\ **Last updated:** [July 7, 2021, 8:24am UTC](https://discuss.elastic.co/t/incorrect-timestamp-used-during-query-or-while-seeing-messages-in-discover/277868 "2021-07-07T08:24:58Z")
Hi All, I have some 30 logs files (each file of individual day) of June month. I am collecting data through filebeat and then passing it to logstash. There is one index got created (yesterday, 4th July) which has indexe… --- ## [Can the split “query” and “aggregations” achieve higher performance？](https://discuss.elastic.co/t/can-the-split-query-and-aggregations-achieve-higher-performance/278034)
**Author:** [@Ryze](https://discuss.elastic.co/u/Ryze)\ **Replies:** 0\ **Last updated:** [July 7, 2021, 7:32am UTC](https://discuss.elastic.co/t/can-the-split-query-and-aggregations-achieve-higher-performance/278034 "2021-07-07T07:32:48Z")
Imagine I have an index "article" with 100 million pieces of data. Its template data and mapping file are as follows. What I want to ask is, does splitting query and aggs (The following query1) and then using \_bulk api … --- ## [Fields removed from Filebeat Zeek Module/Pipeline](https://discuss.elastic.co/t/fields-removed-from-filebeat-zeek-module-pipeline/278029)
**Author:** [@valhalla](https://discuss.elastic.co/u/valhalla)\ **Replies:** 0\ **Last updated:** [July 7, 2021, 6:57am UTC](https://discuss.elastic.co/t/fields-removed-from-filebeat-zeek-module-pipeline/278029 "2021-07-07T06:57:19Z")
Hi team, I need some help regarding some fields that are being removed from one version to another. I am using ES 7.13.2. Some fields from this Zeek module/pipeline were available under older ES/ ECS versions, that are … --- ## [How to create logstash-\* index pattern to see syslog messages](https://discuss.elastic.co/t/how-to-create-logstash-index-pattern-to-see-syslog-messages/277705)
**Author:** [@ankan1979](https://discuss.elastic.co/u/ankan1979)\ **Replies:** 2\ **Last updated:** [July 7, 2021, 5:56am UTC](https://discuss.elastic.co/t/how-to-create-logstash-index-pattern-to-see-syslog-messages/277705 "2021-07-07T05:56:07Z")
Hi, I am very new to ILK stack. I am forwarding syslog messages from my routers and switches to Logstash and want to see those in Kibana. When I am trying to add index pattern named logstash-\* from Kibana portal it's no… --- ## [Parsing logs of FIlebeat and send to Elastic search](https://discuss.elastic.co/t/parsing-logs-of-filebeat-and-send-to-elastic-search/277944)
**Author:** [@ranvijaysanu](https://discuss.elastic.co/u/ranvijaysanu)\ **Replies:** 2\ **Last updated:** [July 7, 2021, 2:24am UTC](https://discuss.elastic.co/t/parsing-logs-of-filebeat-and-send-to-elastic-search/277944 "2021-07-07T02:24:37Z")
I am using filebeat to ship the logs directly to elastic search and then visualizing it in Kibana. I want to parse the message field to fetch the response code(200 as per the below screenshot) as a separate field in Kib… --- ## [Cisco Filebeat Issues](https://discuss.elastic.co/t/cisco-filebeat-issues/277890)
**Author:** [@codersoul](https://discuss.elastic.co/u/codersoul)\ **Replies:** 4\ **Last updated:** [July 7, 2021, 1:36am UTC](https://discuss.elastic.co/t/cisco-filebeat-issues/277890 "2021-07-07T01:36:18Z")
Hi, I'm working with Filebeat and Cisco Module in a Lab. I am ingesting data from Cisco AMP, everything work as expected , but I getting this error in Filebeat logs. Jul 02 09:26:48 cstxsvngs01 filebeat\[25410\]: 2021-07… --- ## [Why is only one node processing the query?](https://discuss.elastic.co/t/why-is-only-one-node-processing-the-query/275070)
**Author:** [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Replies:** 11\ **Last updated:** [July 6, 2021, 11:23pm UTC](https://discuss.elastic.co/t/why-is-only-one-node-processing-the-query/275070 "2021-07-06T23:23:35Z")
Hi everyone. I had an index that had 5 primary shards and around 250GB of data in total (primaries only). I decided to reindex it with more primary shards (30) to see if I would have performance improvements. The index … --- ## [Im stuck at formatting data while trying to send xml file to Elasticsearch](https://discuss.elastic.co/t/im-stuck-at-formatting-data-while-trying-to-send-xml-file-to-elasticsearch/278002)
**Author:** [@Sourtoast](https://discuss.elastic.co/u/Sourtoast)\ **Replies:** 1\ **Last updated:** [July 6, 2021, 11:23pm UTC](https://discuss.elastic.co/t/im-stuck-at-formatting-data-while-trying-to-send-xml-file-to-elasticsearch/278002 "2021-07-06T23:23:30Z")
I'm trying to add data from xml to Elasticsearch but I want only specific fields with its names changed. I'm using mutate filter to map xml fields to my own fields. My problem is with photos input { http\_poller { ur… --- ## [Mysql-slow multiline](https://discuss.elastic.co/t/mysql-slow-multiline/277757)
**Author:** [@bz\_Os](https://discuss.elastic.co/u/bz_Os)\ **Replies:** 2\ **Last updated:** [July 6, 2021, 9:40pm UTC](https://discuss.elastic.co/t/mysql-slow-multiline/277757 "2021-07-06T21:40:34Z")
Hello, I am parsing the mysql-slow logs using the parser: input{ pipeline { address =\> input } file{ path =\> "/etc/logstash/logsamples/all.log" start\_position =\> "beginnin… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1331) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1333)