# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1389 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1390 --- ## [Index.sort on sequence numbers](https://discuss.elastic.co/t/index-sort-on-sequence-numbers/274485)
**Author:** [@fhalde](https://discuss.elastic.co/u/fhalde)\ **Replies:** 7\ **Last updated:** [June 1, 2021, 8:42am UTC](https://discuss.elastic.co/t/index-sort-on-sequence-numbers/274485 "2021-06-01T08:42:21Z")
We have a use case that can greatly benefit from the ability to have an index.sort on \_seq\_no meta field of ES but that's not possible it seems As of now, that's not possible curl -XPUT -H "Content-Type:application/jso… --- ## [ILM action - lifecycle action \[migrate\] waiting for \[1\] shards to be moved to the \[data\_cold\] tier](https://discuss.elastic.co/t/ilm-action-lifecycle-action-migrate-waiting-for-1-shards-to-be-moved-to-the-data-cold-tier/274574)
**Author:** [@Kmalik19](https://discuss.elastic.co/u/Kmalik19)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 8:40am UTC](https://discuss.elastic.co/t/ilm-action-lifecycle-action-migrate-waiting-for-1-shards-to-be-moved-to-the-data-cold-tier/274574 "2021-06-01T08:40:44Z")
Hello Everyone, We have configured ILM policy but it's stucked in warm phase.Here is the details: ILM Policy definition { "km\_ilm" : { "version" : 3, "modified\_date" : "2021-05-31T14:28:26.359Z", "policy… --- ## [Multiple fast consecutive updates on the same document](https://discuss.elastic.co/t/multiple-fast-consecutive-updates-on-the-same-document/274595)
**Author:** [@Niels\_Theen](https://discuss.elastic.co/u/Niels_Theen)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 8:26am UTC](https://discuss.elastic.co/t/multiple-fast-consecutive-updates-on-the-same-document/274595 "2021-06-01T08:26:37Z")
Hi there, I hope someone can help me with a very specific problem I have. We integrated Elasticsearch in our multi-tenant-system. Based on our system we forced to use update\_by\_query instead of update. This system cr… --- ## [Es\_rejected\_execution\_exception](https://discuss.elastic.co/t/es-rejected-execution-exception/274594)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 8:13am UTC](https://discuss.elastic.co/t/es-rejected-execution-exception/274594 "2021-06-01T08:13:47Z")
All of a sudden, our cluster has started to receive a huge of amount of "es\_rejected\_execution\_exception" errors when upserting. Nothing has really changed on our code side so we are at a complete loss. Our main API is n… --- ## [Logstash stores field as multifield](https://discuss.elastic.co/t/logstash-stores-field-as-multifield/274331)
**Author:** [@nberens](https://discuss.elastic.co/u/nberens)\ **Replies:** 2\ **Last updated:** [May 30, 2021, 2:26am UTC](https://discuss.elastic.co/t/logstash-stores-field-as-multifield/274331 "2021-05-30T02:26:04Z")
Hello, i am currently migrating from an old elatic 6.8 cluster to a new 7.13. The Logstash pipeline is the same: input { kafka { bootstrap\_servers =\> '{{ logstash\_kafka\_bootstrap }}' … --- ## [Kibana is not ready in 7.12](https://discuss.elastic.co/t/kibana-is-not-ready-in-7-12/274545)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 7:34am UTC](https://discuss.elastic.co/t/kibana-is-not-ready-in-7-12/274545 "2021-06-01T07:34:24Z")
I obtain this error can someone help me? kibana | {"type":"log","@timestamp":"2021-05-31T19:22:13+00:00","tags":\["info","savedobjects-service"\],"pid":7,"message":"Waiting until all Elasticsearch nodes a… --- ## [Getting Invalid FieldReference error because of non-indexed property name in document](https://discuss.elastic.co/t/getting-invalid-fieldreference-error-because-of-non-indexed-property-name-in-document/274205)
**Author:** [@rs0000](https://discuss.elastic.co/u/rs0000)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 7:33am UTC](https://discuss.elastic.co/t/getting-invalid-fieldreference-error-because-of-non-indexed-property-name-in-document/274205 "2021-06-01T07:33:18Z")
Hi, My Logstash pipeline keeps failing during scroll because of an error. There are multiple documents causing that issue. Those are referral urls that sometimes look weird. The property itself is not indexed in elastic… --- ## [Essql join on canvas essql](https://discuss.elastic.co/t/essql-join-on-canvas-essql/274496)
**Author:** [@lucac](https://discuss.elastic.co/u/lucac)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 7:29am UTC](https://discuss.elastic.co/t/essql-join-on-canvas-essql/274496 "2021-06-01T07:29:30Z")
Hi, is it possible to write an essql query with join inside? I have a field in one index and I would to compare that to another field in another index and extract some value. I need this value in canvas. How can I do… --- ## [Disable logstash logger for inputs.jdbc](https://discuss.elastic.co/t/disable-logstash-logger-for-inputs-jdbc/274526)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 7:15am UTC](https://discuss.elastic.co/t/disable-logstash-logger-for-inputs-jdbc/274526 "2021-06-01T07:15:08Z")
Hi all, I am using Logstash 7.12.1 to update an elasticsearch 7.12.1 index from an oracle database. I have no problem establishing communication with the DB using the below input jdbc declaration: input { jdbc { … --- ## [Rolling Upgrade not supported for kibana](https://discuss.elastic.co/t/rolling-upgrade-not-supported-for-kibana/274588)
**Author:** [@Sachin\_kovuru](https://discuss.elastic.co/u/Sachin_kovuru)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 7:11am UTC](https://discuss.elastic.co/t/rolling-upgrade-not-supported-for-kibana/274588 "2021-06-01T07:11:38Z")
I see that kibana doesn't support rolling upgrades as per the below link. Since the rolling upgrade is one of the basic upgrading strategies of Kubernetes. So, is there any plans of supporting rolling upgrade in future… --- ## [Dynamically append field from an index to same field in other indices](https://discuss.elastic.co/t/dynamically-append-field-from-an-index-to-same-field-in-other-indices/274579)
**Author:** [@CoolCommando\_Sniper](https://discuss.elastic.co/u/CoolCommando_Sniper)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:51am UTC](https://discuss.elastic.co/t/dynamically-append-field-from-an-index-to-same-field-in-other-indices/274579 "2021-06-01T05:51:10Z")
Hi, I would like to achieve the following: Lets say there are 3 indices A, B & C, each having a document with \_id '1'. I would like to append value of a field in A to the same field in indices B & C, where document \_i… --- ## [Sum aggregated values](https://discuss.elastic.co/t/sum-aggregated-values/274554)
**Author:** [@qvers](https://discuss.elastic.co/u/qvers)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 6:41am UTC](https://discuss.elastic.co/t/sum-aggregated-values/274554 "2021-06-01T06:41:44Z")
Hello. I'm trying to collect some statistics data from my docs, but I'm struggling a bit. My docs looks like this: { "productId": "156" "price": "101.23" "discount": "2.23" "marketplace": "some\_marketplace" "… --- ## [How I can run jdbc\_streaming filter just one time on multiple jdbc plugin row results](https://discuss.elastic.co/t/how-i-can-run-jdbc-streaming-filter-just-one-time-on-multiple-jdbc-plugin-row-results/274477)
**Author:** [@zeraf29](https://discuss.elastic.co/u/zeraf29)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 6:17am UTC](https://discuss.elastic.co/t/how-i-can-run-jdbc-streaming-filter-just-one-time-on-multiple-jdbc-plugin-row-results/274477 "2021-06-01T06:17:27Z")
Hi. I want to run jdbc\_streaming filter plugin just one time on multiple jdbc plugin row results. For example, I set jdbc input plugin in pipeline, and It return 10 table rows. input{ Jdbc{ #jdbc settings … --- ## [Metricbeat for SSH/Secure log](https://discuss.elastic.co/t/metricbeat-for-ssh-secure-log/274581)
**Author:** [@bs\_aggarwal](https://discuss.elastic.co/u/bs_aggarwal)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 6:06am UTC](https://discuss.elastic.co/t/metricbeat-for-ssh-secure-log/274581 "2021-06-01T06:06:55Z")
How to import SSH failed attempts reported in /var/log/secure log using metric beat. or alternatively i want to ssh login attempts using metric beat. pls advise. --- ## [Convert the @timestamp field](https://discuss.elastic.co/t/convert-the-timestamp-field/273902)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 6\ **Last updated:** [June 1, 2021, 5:26am UTC](https://discuss.elastic.co/t/convert-the-timestamp-field/273902 "2021-06-01T05:26:18Z")
Hello All , I am trying to convert the @timestamp field to the required format. @timestamp shows the field as : 2021-05-25T07:34:08.137Z and I want the value to be converted in to this format : 05/25/2021 07:34:08 . I … --- ## [Is there any way to do batch inference(matrix compute) using cosineSimilarity?](https://discuss.elastic.co/t/is-there-any-way-to-do-batch-inference-matrix-compute-using-cosinesimilarity/274573)
**Author:** [@berry](https://discuss.elastic.co/u/berry)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:17am UTC](https://discuss.elastic.co/t/is-there-any-way-to-do-batch-inference-matrix-compute-using-cosinesimilarity/274573 "2021-06-01T05:17:29Z")
In some scenarios, I want to calculate the cosine similarity between M dense\_vectors and all the stored dense\_vectors. This can be achieved by calling the cosineSimilarity function for M times like this: "script": { … --- ## [Elasticsearch 2021 License](https://discuss.elastic.co/t/elasticsearch-2021-license/274133)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 6\ **Last updated:** [June 1, 2021, 5:13am UTC](https://discuss.elastic.co/t/elasticsearch-2021-license/274133 "2021-06-01T05:13:20Z")
Hi. I am asking a question because the elasticsearch license changed in 2021 is not well understood. I have the phrase below, People who take our products and sell them directly as services, like Amazon Elasticsearch … --- ## [Elasticsearch 7.x with Curator -- close replicas older than N days to reduce shard count](https://discuss.elastic.co/t/elasticsearch-7-x-with-curator-close-replicas-older-than-n-days-to-reduce-shard-count/274560)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 3:33am UTC](https://discuss.elastic.co/t/elasticsearch-7-x-with-curator-close-replicas-older-than-n-days-to-reduce-shard-count/274560 "2021-06-01T03:33:48Z")
I bumped against the cluster shard limit recently, and am trying to find useful ways to manage this. I'm dealling with logs as my primary use-case, and some of these logs are very high volume. By default, I've generally… --- ## [Mutate rename issue after upgrade](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 2:27am UTC](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558 "2021-06-01T02:27:50Z")
Hello, I have a pipeline where that receives data from a F5 load balancer and parses it with the cef codec, in the filters I have a series of mutate using rename to change the name of some fields to their ecs correspond… --- ## [Showing newsfeed posts based on friends' list](https://discuss.elastic.co/t/showing-newsfeed-posts-based-on-friends-list/274557)
**Author:** [@m-asfour](https://discuss.elastic.co/u/m-asfour)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 2:01am UTC](https://discuss.elastic.co/t/showing-newsfeed-posts-based-on-friends-list/274557 "2021-06-01T02:01:47Z")
Hi, I'm trying to build a social network app similar to Facebook which shows each user their friends' posts on their feed. What is the best way to implement this using Elasticsearch? --- ## [Find IP in between two ranges](https://discuss.elastic.co/t/find-ip-in-between-two-ranges/274104)
**Author:** [@Sarthak\_Mishra](https://discuss.elastic.co/u/Sarthak_Mishra)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 1:53am UTC](https://discuss.elastic.co/t/find-ip-in-between-two-ranges/274104 "2021-06-01T01:53:34Z")
Hello Community, I have two indexes. Index 1 contains a column of IP address. Index 2 contains 2 columns: the start subnet and end IP Address column. I want to find in which subnet range does the particular IP belong to… --- ## [Elasticsearch 2021 License](https://discuss.elastic.co/t/elasticsearch-2021-license/274559)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 1:38am UTC](https://discuss.elastic.co/t/elasticsearch-2021-license/274559 "2021-06-01T01:38:21Z")
Hi. I am asking a question because the elasticsearch license changed in 2021 is not well understood. It cannot be provided as a managed-service to other users. Our company develops a system called “A” and sells “A” … --- ## [Logstash aggregation overwrite](https://discuss.elastic.co/t/logstash-aggregation-overwrite/274556)
**Author:** [@fuzes](https://discuss.elastic.co/u/fuzes)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 1:13am UTC](https://discuss.elastic.co/t/logstash-aggregation-overwrite/274556 "2021-06-01T01:13:42Z")
I don't know why aggregation is overwritten by last one following is my logstash code filter { aggregate { task\_id =\> "%{code}" code =\> " map\['code'\] = event.get('code') map\[event.get('langu… --- ## [KIbana - How do I point to remote instance of Elasticsearch](https://discuss.elastic.co/t/kibana-how-do-i-point-to-remote-instance-of-elasticsearch/274550)
**Author:** [@debasisc](https://discuss.elastic.co/u/debasisc)\ **Replies:** 3\ **Last updated:** [June 1, 2021, 12:36am UTC](https://discuss.elastic.co/t/kibana-how-do-i-point-to-remote-instance-of-elasticsearch/274550 "2021-06-01T00:36:42Z")
Locally I have installed Elasticsearch and KIbana (version 7.8, OS = Windows 10). Using KIbana console and I can type in commands in left-hand-side, click "arrow" to execute command and see results in right-hand side. … --- ## [Elasticsearch Cluster Status is RED](https://discuss.elastic.co/t/elasticsearch-cluster-status-is-red/274129)
**Author:** [@lls](https://discuss.elastic.co/u/lls)\ **Replies:** 11\ **Last updated:** [June 1, 2021, 12:28am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-is-red/274129 "2021-06-01T00:28:34Z")
Hi guys: I need advise to fix the following error after issuing \_cluster/allocation/explain. I did try to fix it by running this \_cluster/reroute?retry\_failed=true but no luck. Appreciate your advise, thanks so much. {… --- ## [Kibana Monitoring says Missing Primary Shards](https://discuss.elastic.co/t/kibana-monitoring-says-missing-primary-shards/274548)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 11:52pm UTC](https://discuss.elastic.co/t/kibana-monitoring-says-missing-primary-shards/274548 "2021-05-31T23:52:44Z")
Hello, I've just update my cluster from 7.9.3 to 7.12.1 and in the monitoring for Kibana it says that the status is Red and that it is Missing Primary Shards. The elasticsearch monitoring part is green, this is the res… --- ## [Best ELK Stack option for AWS centric Team](https://discuss.elastic.co/t/best-elk-stack-option-for-aws-centric-team/274481)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 11:38pm UTC](https://discuss.elastic.co/t/best-elk-stack-option-for-aws-centric-team/274481 "2021-05-31T23:38:17Z")
Hello Everyone, I'm a part of team that focuses on creating AI products on AWS Cloud. We are currently looking into what would be the option for setting up Elastic as a part of our stack. Its main job would be to visual… --- ## [KQL : query\_string doesn't work](https://discuss.elastic.co/t/kql-query-string-doesnt-work/274451)
**Author:** [@lls](https://discuss.elastic.co/u/lls)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 9:42pm UTC](https://discuss.elastic.co/t/kql-query-string-doesnt-work/274451 "2021-05-31T21:42:07Z")
Hi there: Interestingly, I'm not sure why the below "query\_string" doesn't returns any hits but it returns hits on 'Discovery UI's Filters section. Please advise, thanks "sql\_string" - This doesn't return any hits GET… --- ## [Having an issue with filebeat pushing to Elasticsearch](https://discuss.elastic.co/t/having-an-issue-with-filebeat-pushing-to-elasticsearch/271822)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 21\ **Last updated:** [May 31, 2021, 9:24pm UTC](https://discuss.elastic.co/t/having-an-issue-with-filebeat-pushing-to-elasticsearch/271822 "2021-05-31T21:24:25Z")
Hello, I am receiving the following error when attempting to push log files to Elasticsearch: Exiting: error loading config file: yaml: line 2: did not find expected key Here is my .yaml file: filebeat.inputs: - ty… --- ## [Role that would allow a user to create index in ES](https://discuss.elastic.co/t/role-that-would-allow-a-user-to-create-index-in-es/274534)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 9:05pm UTC](https://discuss.elastic.co/t/role-that-would-allow-a-user-to-create-index-in-es/274534 "2021-05-31T21:05:02Z")
Hi, I am looking for a role that would allow a user to create indices in ES. Basically I want to avoid assigning "superuser" role. Please guide on what role can I assign? My configuration for ELK7.6.2 stack looks li… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1388) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1390)