# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1346 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1347 --- ## [Different number of hits between DSL Query and KQL](https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 11:11am UTC](https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063 "2021-06-28T11:11:50Z")
Hello everyone, I was curious about working with DSL queries, so I made some tests and I found something strange. I have a winlogbeat-security index which contains windows security events and I am searching logs with … --- ## [Simple variation of counts - Serial differencing](https://discuss.elastic.co/t/simple-variation-of-counts-serial-differencing/277118)
**Author:** [@efftee](https://discuss.elastic.co/u/efftee)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 10:48am UTC](https://discuss.elastic.co/t/simple-variation-of-counts-serial-differencing/277118 "2021-06-28T10:48:14Z")
Hi Community, The most apparently simplest of things, that you can do in seconds with a pen and paper, but spent hours trying in Kibana and failed so far. It's driving me completely crazy !! Try it and tell me … --- ## [Can't start elasticsearch](https://discuss.elastic.co/t/cant-start-elasticsearch/277086)
**Author:** [@Fatma\_Alzahraa](https://discuss.elastic.co/u/Fatma_Alzahraa)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 10:37am UTC](https://discuss.elastic.co/t/cant-start-elasticsearch/277086 "2021-06-28T10:37:18Z")
Hello , I installed elasticsearch but can't start and get errors centos 7 jdk version : jdk 11 elasticsearch version : 7.13.2 \[root@server bin\]# systemctl status elasticsearch.service ● elasticsearch.service - Elas… --- ## [org.elasticsearch.hadoop.EsHadoopIllegalStateException: Position for field' not found in row](https://discuss.elastic.co/t/org-elasticsearch-hadoop-eshadoopillegalstateexception-position-for-field-not-found-in-row/274662)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 10:23am UTC](https://discuss.elastic.co/t/org-elasticsearch-hadoop-eshadoopillegalstateexception-position-for-field-not-found-in-row/274662 "2021-06-28T10:23:14Z")
Hi there, I have seen this issue before and it seems stills to apply. I am using this version via pyspark: ss = ( SparkSession.builder.appName("ES") .config("spark.driver.memory", "8g") .config( "spark.jars.packa… --- ## [Calculate a list of identical date prefixes for a date range](https://discuss.elastic.co/t/calculate-a-list-of-identical-date-prefixes-for-a-date-range/277199)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 10:11am UTC](https://discuss.elastic.co/t/calculate-a-list-of-identical-date-prefixes-for-a-date-range/277199 "2021-06-28T10:11:06Z")
The background is, I want to use the keyword field to optimize the search of 1 date range, because it is keyword, I need to use prefix search, but if it is 1 date range, I need to calculate 2 date prefixes based on the s… --- ## [Text getting trimmed in Kibana](https://discuss.elastic.co/t/text-getting-trimmed-in-kibana/275607)
**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\ **Replies:** 17\ **Last updated:** [June 28, 2021, 9:26am UTC](https://discuss.elastic.co/t/text-getting-trimmed-in-kibana/275607 "2021-06-28T09:26:28Z")
Hi all, I've uploaded a SCV file of HTTP traffic to ELK. The file has quite large values in URL field. These values may go upto 20 lines. Kibana is not showing the complete values, which is hampering my logs analysis. H… --- ## [The specified log group does not exist. Error when configuring lambda function for cloudwatch logs](https://discuss.elastic.co/t/the-specified-log-group-does-not-exist-error-when-configuring-lambda-function-for-cloudwatch-logs/277193)
**Author:** [@Origin\_Jing](https://discuss.elastic.co/u/Origin_Jing)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 9:26am UTC](https://discuss.elastic.co/t/the-specified-log-group-does-not-exist-error-when-configuring-lambda-function-for-cloudwatch-logs/277193 "2021-06-28T09:26:00Z")
I'm trying to setup the functionbeat aws example. However, I keep getting "ResourceState: CREATE\_FAILED, ResourceStatusReason: The specified log group does not exist. (Service: AWSLogs; Status Code: 400; Error Code: Reso… --- ## [ILM policy without alias](https://discuss.elastic.co/t/ilm-policy-without-alias/277188)
**Author:** [@francois75](https://discuss.elastic.co/u/francois75)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 8:52am UTC](https://discuss.elastic.co/t/ilm-policy-without-alias/277188 "2021-06-28T08:52:04Z")
To smoothly transit from Elasticsearch curator to ILM I want to implement a simple ILM policy that change index status according to its age. So I've create a policy and added to existing indices as following: { "inde… --- ## [Logstash ERROR with CVS parsing in a Pod](https://discuss.elastic.co/t/logstash-error-with-cvs-parsing-in-a-pod/277180)
**Author:** [@jsu](https://discuss.elastic.co/u/jsu)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 8:41am UTC](https://discuss.elastic.co/t/logstash-error-with-cvs-parsing-in-a-pod/277180 "2021-06-28T08:41:13Z")
Hey there, I'm currently trying to automatically ingest a CVS when launching a Logstash pod connected to ECK and I have the following error: \[ERROR\] 2021-06-28 07:25:43.494 \[Converge PipelineAction::Create\\] agent… --- ## [Override geo location for packetbeat](https://discuss.elastic.co/t/override-geo-location-for-packetbeat/277185)
**Author:** [@termcap](https://discuss.elastic.co/u/termcap)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 8:13am UTC](https://discuss.elastic.co/t/override-geo-location-for-packetbeat/277185 "2021-06-28T08:13:26Z")
Hi, I have enabled geo enrichment according to this document and its working file. Unfortunately, my private network address is not from the private range(its a public range we use internally) and thus the geo locati… --- ## [Drop\_Fields doesn't work - Filebeat](https://discuss.elastic.co/t/drop-fields-doesnt-work-filebeat/277183)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 7:58am UTC](https://discuss.elastic.co/t/drop-fields-doesnt-work-filebeat/277183 "2021-06-28T07:58:01Z")
Hi All, I have configured filebeat to read IIS logs using the IIS module. In the same time, I want to drop unwanted fields to save the space of my ES server. I have enabled the IIS module using below command. .\\filebe… --- ## [Kibana URL links gets altered to security\_global](https://discuss.elastic.co/t/kibana-url-links-gets-altered-to-security-global/277177)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 7:48am UTC](https://discuss.elastic.co/t/kibana-url-links-gets-altered-to-security-global/277177 "2021-06-28T07:48:59Z")
Hi all, I'm working on kibana 7.10.2 version. I have some kibana dashboards in Global Tenant. In my project I have an UI associated with Kibana. In my Kibana dashboard URL links redirect correctly. But the same in m… --- ## [Questions related to transforms limitations](https://discuss.elastic.co/t/questions-related-to-transforms-limitations/277158)
**Author:** [@crpj](https://discuss.elastic.co/u/crpj)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 7:35am UTC](https://discuss.elastic.co/t/questions-related-to-transforms-limitations/277158 "2021-06-28T07:35:01Z")
Hello, I am experimenting Transforms and I would to confirm that the limitations below are true: Doc removal detection in source and reflection upon next sync. If a doc is removed at source the value remains in the de… --- ## [Offline Elastic Restore From GCS](https://discuss.elastic.co/t/offline-elastic-restore-from-gcs/276842)
**Author:** [@simonross936](https://discuss.elastic.co/u/simonross936)\ **Replies:** 4\ **Last updated:** [June 28, 2021, 6:50am UTC](https://discuss.elastic.co/t/offline-elastic-restore-from-gcs/276842 "2021-06-28T06:50:43Z")
I needed to shift a sizeable amount of data from GCS repository. Directly from the Google Console, I downloaded the Elastic snapshots to a local external hard drive. With a fully functioning local Elastic instance, wher… --- ## [Need help to calculate percentage in watcher](https://discuss.elastic.co/t/need-help-to-calculate-percentage-in-watcher/277174)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 6:43am UTC](https://discuss.elastic.co/t/need-help-to-calculate-percentage-in-watcher/277174 "2021-06-28T06:43:38Z")
Hello team, Need your help to configure alert to get 'percentage' using total payload hits. Attached configuration for the same. Kindly help to get 'percentage' count based on 'total hits' from the watcher result. Deta… --- ## [How to run configured pipeline.yml in logstash](https://discuss.elastic.co/t/how-to-run-configured-pipeline-yml-in-logstash/276072)
**Author:** [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)\ **Replies:** 9\ **Last updated:** [June 28, 2021, 6:27am UTC](https://discuss.elastic.co/t/how-to-run-configured-pipeline-yml-in-logstash/276072 "2021-06-28T06:27:41Z")
I have configured 2 logstash.conf file in pipelines.yml file, pipeline.id: sys\_log\_1 pipeline.workers: 2 path.config: "D:/Elastic/Logstash/7.12.1/config/logstash\_sys\_1.conf" pipeline.id: sys\_log\_2 pipeline.workers: … --- ## [Can I create ingest processor to do some action like append tags or insert an alert to other index when a document match some conditions](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999)
**Author:** [@ndhcoder](https://discuss.elastic.co/u/ndhcoder)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 6:13am UTC](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999 "2021-06-28T06:13:50Z")
Hello everyone, Have a nice day ! I have a problem, Can I create ingest processor to do some action like append tags or insert an alert to other index when a document match some conditions ? Example: I want to get so… --- ## [Coordinating Node Role in Data Ingestion](https://discuss.elastic.co/t/coordinating-node-role-in-data-ingestion/277157)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 4\ **Last updated:** [June 28, 2021, 6:08am UTC](https://discuss.elastic.co/t/coordinating-node-role-in-data-ingestion/277157 "2021-06-28T06:08:05Z")
Can anybody please help me understand the role of coordinating node with respect to data ingestion. I understand the role of the coordinating nodes in terms of search queries (the scatter and gather phases), But what i… --- ## [Delete data from Indices](https://discuss.elastic.co/t/delete-data-from-indices/276540)
**Author:** [@danny.tveria](https://discuss.elastic.co/u/danny.tveria)\ **Replies:** 11\ **Last updated:** [June 28, 2021, 5:33am UTC](https://discuss.elastic.co/t/delete-data-from-indices/276540 "2021-06-28T05:33:04Z")
Hi, I new in ELK. Our previous sysadmin installed and configured the elk server but he getting out of space... I want to know if I can delete data from indices without reconfiguring the entire server or ELK? --- ## [CCR stats. Question about negative values](https://discuss.elastic.co/t/ccr-stats-question-about-negative-values/276916)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 5:25am UTC](https://discuss.elastic.co/t/ccr-stats-question-about-negative-values/276916 "2021-06-28T05:25:16Z")
Hi. I have two ES clusters 7.7.1. Leader cluster include 1 index with 2 primary and 2 replica shards. (total 6) I indexed few documents (the same doc). I see that those documents indexed to the one primary shard, mean… --- ## [Encrypted connection between Logstash and Elasticsearch](https://discuss.elastic.co/t/encrypted-connection-between-logstash-and-elasticsearch/277091)
**Author:** [@manfred](https://discuss.elastic.co/u/manfred)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 4:51am UTC](https://discuss.elastic.co/t/encrypted-connection-between-logstash-and-elasticsearch/277091 "2021-06-28T04:51:32Z")
Hi. How to encrypt communication between Logstash and Elasticsearch DB ? From what I read it uses by default plain HTTP, is there a way to make it HTTPS ? --- ## [Unhealthy kibana instance](https://discuss.elastic.co/t/unhealthy-kibana-instance/276725)
**Author:** [@Ashvin\_Bhutekar](https://discuss.elastic.co/u/Ashvin_Bhutekar)\ **Replies:** 4\ **Last updated:** [June 28, 2021, 3:59am UTC](https://discuss.elastic.co/t/unhealthy-kibana-instance/276725 "2021-06-28T03:59:09Z")
Unhealthy deployment, NO kibana instances are running. I am facing this issue after editing configuration in yml file. I changed edits back to the original configurations but still kibana instance is down. --- ## [How to delete a field completely from an index](https://discuss.elastic.co/t/how-to-delete-a-field-completely-from-an-index/276893)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 6\ **Last updated:** [June 28, 2021, 3:43am UTC](https://discuss.elastic.co/t/how-to-delete-a-field-completely-from-an-index/276893 "2021-06-28T03:43:45Z")
I created some field in the past for testing. Let's take the "STATISTIC-PROCESS-RUNTIME-HOUR" as an example. So I was able to find a way to remove that field from my index with: POST filebeat-7.13.0-2021.05.26-000001/\_… --- ## [In Kibana data is coming at localtime+3 instead of UTC+3](https://discuss.elastic.co/t/in-kibana-data-is-coming-at-localtime-3-instead-of-utc-3/277116)
**Author:** [@Yaniv\_Etrogi](https://discuss.elastic.co/u/Yaniv_Etrogi)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 12:18am UTC](https://discuss.elastic.co/t/in-kibana-data-is-coming-at-localtime-3-instead-of-utc-3/277116 "2021-06-28T00:18:24Z")
My system Ubuntu 18.04 Elastic version 7.12 run on docker PowerShell sending data to Elastic from Windows hosts System is set to UTC+3 Elastic is set to UTC+3 My problem In Kibana data is coming at localtime+3 ins… --- ## [Request error: circuit\_breaking\_exception, \[parent\] Data too large](https://discuss.elastic.co/t/request-error-circuit-breaking-exception-parent-data-too-large/277026)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 12:10am UTC](https://discuss.elastic.co/t/request-error-circuit-breaking-exception-parent-data-too-large/277026 "2021-06-28T00:10:50Z")
We are using Elastic Cloud and some times getting this message here. Why does this happen? Is the index to big or is it the instance that is too slow? Request error: circuit\_breaking\_exception, \[parent\] Data too large… --- ## [Elastic Data Node leaves the cluster after force merge](https://discuss.elastic.co/t/elastic-data-node-leaves-the-cluster-after-force-merge/276672)
**Author:** [@gdd](https://discuss.elastic.co/u/gdd)\ **Replies:** 4\ **Last updated:** [June 27, 2021, 11:00pm UTC](https://discuss.elastic.co/t/elastic-data-node-leaves-the-cluster-after-force-merge/276672 "2021-06-27T23:00:23Z")
Elasticsearch version 7.3.2, JVM 12.0.2; Heap 15 GB. The machine remains blocked and it's not possible to access by ssh. These the node statististics just before the issue. And these are the system metrics: Anyb… --- ## [Error fetching fields for index pattern filebeat\*](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-filebeat/276967)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [June 24, 2021, 5:23pm UTC](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-filebeat/276967 "2021-06-24T17:23:03Z")
hello, i need help with this error that kibana gives me when i create a filebeat index; The error occurs when I create the index pattern in kibana, it generates this ID error, I have tried with another name, but still th… --- ## [Convert text value to IP](https://discuss.elastic.co/t/convert-text-value-to-ip/277146)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 2\ **Last updated:** [June 27, 2021, 10:27pm UTC](https://discuss.elastic.co/t/convert-text-value-to-ip/277146 "2021-06-27T22:27:14Z")
Hello every body, I am parsing the wallix logs by using the kv plugin kv{ source =\> "syslog\_message" value\_split =\> "=\\"" field\_split =\> "\\"\\s" } As results i get all the output as text as you can see bellow: \> { \>… --- ## [DSL aggregation query in event pair documents for showing in kibana](https://discuss.elastic.co/t/dsl-aggregation-query-in-event-pair-documents-for-showing-in-kibana/277165)
**Author:** [@irajtaghlidi](https://discuss.elastic.co/u/irajtaghlidi)\ **Replies:** 0\ **Last updated:** [June 27, 2021, 10:03pm UTC](https://discuss.elastic.co/t/dsl-aggregation-query-in-event-pair-documents-for-showing-in-kibana/277165 "2021-06-27T22:03:30Z")
I have event document pairs that each one shows the start or end of an event. Every two events have a key with the save value. for example: doc1: { startTime: 123 endTime: 0 buildId: ABC1 (shared ID) } doc2: { … --- ## [Load balancer for multi logstash](https://discuss.elastic.co/t/load-balancer-for-multi-logstash/277071)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 2\ **Last updated:** [June 27, 2021, 8:16pm UTC](https://discuss.elastic.co/t/load-balancer-for-multi-logstash/277071 "2021-06-27T20:16:17Z")
Hi, We have 2 Logstash servers. I want to put them behind a load balancer and push the data to the logstash over the HTTPS. But now, I am using the HTTP input plugin without a load balancer. Let me show you my HTTPS co… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1345) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1347)