# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1400 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1401 --- ## [Sort with aggregation with another aggregation in Java REST API](https://discuss.elastic.co/t/sort-with-aggregation-with-another-aggregation-in-java-rest-api/273520)
**Author:** [@Nick\_M](https://discuss.elastic.co/u/Nick_M)\ **Replies:** 1\ **Last updated:** [May 25, 2021, 1:33pm UTC](https://discuss.elastic.co/t/sort-with-aggregation-with-another-aggregation-in-java-rest-api/273520 "2021-05-25T13:33:59Z")
I created the query below and I want to execute it with the Java Client provided but I can't really find a way. GET asset-records-latest/\_search { "size": 0, "aggs": { "agg1": { "terms": { "field":… --- ## [How get data from snowflake to elastic search in elastic cloud](https://discuss.elastic.co/t/how-get-data-from-snowflake-to-elastic-search-in-elastic-cloud/273944)
**Author:** [@Ahmed\_Sadek](https://discuss.elastic.co/u/Ahmed_Sadek)\ **Replies:** 0\ **Last updated:** [May 25, 2021, 1:30pm UTC](https://discuss.elastic.co/t/how-get-data-from-snowflake-to-elastic-search-in-elastic-cloud/273944 "2021-05-25T13:30:57Z")
Hi, 1- I am using elastic cloud 2- In kibana, under stack management there is option to configure logstash pipeline 3- In documentation there is a plugin to get data from snowflake to elastic using jdbc 4- can someon… --- ## [How get data from google storage to elastic search in elastic cloud](https://discuss.elastic.co/t/how-get-data-from-google-storage-to-elastic-search-in-elastic-cloud/273942)
**Author:** [@Ahmed\_Sadek](https://discuss.elastic.co/u/Ahmed_Sadek)\ **Replies:** 0\ **Last updated:** [May 25, 2021, 1:28pm UTC](https://discuss.elastic.co/t/how-get-data-from-google-storage-to-elastic-search-in-elastic-cloud/273942 "2021-05-25T13:28:37Z")
Hi, 1- I am using elastic cloud 2- Under stack management there is option to configure logstash pipeline 3- in documentation there is a plugin to get data from google storage to elastic 4- can someone provide a usabl… --- ## [Use multiple Elasticsearch Ingest Pipelines with Logstash Elasticsearch Output](https://discuss.elastic.co/t/use-multiple-elasticsearch-ingest-pipelines-with-logstash-elasticsearch-output/273939)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [May 25, 2021, 1:23pm UTC](https://discuss.elastic.co/t/use-multiple-elasticsearch-ingest-pipelines-with-logstash-elasticsearch-output/273939 "2021-05-25T13:23:07Z")
When passing module logs through Logstash to Elasticsearch for processing by ES ingest pipelines, as described here, is it possible to specify multiple pipelines to apply in order? --- ## [Summing values of similar fields in a time range](https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812)
**Author:** [@Dna61](https://discuss.elastic.co/u/Dna61)\ **Replies:** 3\ **Last updated:** [May 25, 2021, 1:18pm UTC](https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812 "2021-05-25T13:18:25Z")
Hello, I am shipping custom log data into Elasticsearch and my source data look like this: 1621805488 foo\_126 cpu 0.62 1621805488 foo\_59 cpu 0.63 1621805489 foo\_183 cpu 0.82 1621805489 foo\_2 cpu 0.67 1621805489 fo… --- ## [Metricbeat Oracle module only supoorted with docker image](https://discuss.elastic.co/t/metricbeat-oracle-module-only-supoorted-with-docker-image/273755)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 3\ **Last updated:** [May 25, 2021, 1:09pm UTC](https://discuss.elastic.co/t/metricbeat-oracle-module-only-supoorted-with-docker-image/273755 "2021-05-25T13:09:10Z")
Hi ALL, As per mentioned on official ELK site ,Metribeat oracle module is only tested with docker image of oracle version 12c and instant client of version 18.1. so is oracle module supported for non docker image. Pl… --- ## [Import JSON from SQL Server to ElasticSearch](https://discuss.elastic.co/t/import-json-from-sql-server-to-elasticsearch/273931)
**Author:** [@qttv](https://discuss.elastic.co/u/qttv)\ **Replies:** 0\ **Last updated:** [May 25, 2021, 12:28pm UTC](https://discuss.elastic.co/t/import-json-from-sql-server-to-elasticsearch/273931 "2021-05-25T12:28:49Z")
Hi, I'm importing some data from Microsoft SQL Server in ElasticSearch using Logstash. I'm dealing with a table in wich a column contains JSON logs, and i need to import these logs splitting the fields in order to create… --- ## [Invalid FieldReference: \`\[\]\`](https://discuss.elastic.co/t/invalid-fieldreference/273834)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 3\ **Last updated:** [May 25, 2021, 1:02pm UTC](https://discuss.elastic.co/t/invalid-fieldreference/273834 "2021-05-25T13:02:43Z")
Hi all, i receive from logstash error this kind of error: :exception=\>#\ **Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 5\ **Last updated:** [May 25, 2021, 12:51pm UTC](https://discuss.elastic.co/t/fire-alert-for-each-document-with-specific-value-in-field/273685 "2021-05-25T12:51:05Z") Hi, I'm currently struggling with Filebeat and Alerts. I'm trying to build a system that would allow me to fire an alert for each document with a specific value in log.level field. From what i tried i was only able to… --- ## [How to modify the generation rules of DataStream naming?](https://discuss.elastic.co/t/how-to-modify-the-generation-rules-of-datastream-naming/273933)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [May 25, 2021, 12:44pm UTC](https://discuss.elastic.co/t/how-to-modify-the-generation-rules-of-datastream-naming/273933 "2021-05-25T12:44:32Z")
I want to use DataStream to manage indexes instead of splicing dates after index names, but I found that the indexes generated by DataStream start with .ds-, which does not match our old index naming rules, which will ca… --- ## ['reindexed-v7-yellow' shards?](https://discuss.elastic.co/t/reindexed-v7-yellow-shards/273661)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 12:23pm UTC](https://discuss.elastic.co/t/reindexed-v7-yellow-shards/273661 "2021-05-25T12:23:49Z")
After some recent server updates these showed up as 'unassigned shards'. What are they and can I delete them? They're on every node in the cluster. --- ## [Extract routing value from document - bulk index](https://discuss.elastic.co/t/extract-routing-value-from-document-bulk-index/273404)
**Author:** [@brjisc](https://discuss.elastic.co/u/brjisc)\ **Replies:** 1\ **Last updated:** [May 25, 2021, 12:05pm UTC](https://discuss.elastic.co/t/extract-routing-value-from-document-bulk-index/273404 "2021-05-25T12:05:15Z")
The documentation states " When setting up explicit mapping, you can also use the \_routing field to direct the index operation to extract the routing value from the document itself" How is the routing information repres… --- ## [Maps kibana with geo point](https://discuss.elastic.co/t/maps-kibana-with-geo-point/273862)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 7\ **Last updated:** [May 25, 2021, 11:08am UTC](https://discuss.elastic.co/t/maps-kibana-with-geo-point/273862 "2021-05-25T11:08:49Z")
Hello, what is the fastest way to insert geographic data on a Maps in Kibana (elastic cloud)? I need to show a map with very specific points, maybe even with a custom icon and a label. Thank you --- ## [Geo\_shape mapping for xyz format to xy format](https://discuss.elastic.co/t/geo-shape-mapping-for-xyz-format-to-xy-format/273579)
**Author:** [@cpavan811](https://discuss.elastic.co/u/cpavan811)\ **Replies:** 3\ **Last updated:** [May 25, 2021, 11:02am UTC](https://discuss.elastic.co/t/geo-shape-mapping-for-xyz-format-to-xy-format/273579 "2021-05-25T11:02:27Z")
We have field in one of our index with GeoJSON supported format of coordinates \[ x, y , z\] in number format. however when tried to created mapping with geo\_shape format with flag "ignore\_z\_value" to true it still fails t… --- ## [Filebeat: How to not send logs from kube-system namespace](https://discuss.elastic.co/t/filebeat-how-to-not-send-logs-from-kube-system-namespace/273876)
**Author:** [@vrathore18](https://discuss.elastic.co/u/vrathore18)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 10:39am UTC](https://discuss.elastic.co/t/filebeat-how-to-not-send-logs-from-kube-system-namespace/273876 "2021-05-25T10:39:11Z")
I tried all possible solutions mentioned here and StackOverflow. But not able to exclude logs from kube-system namespaces. Basically, I am getting logs from all the namespaces. data: filebeat.yml: |- filebeat.inpu… --- ## [Unable to calculate average bucket over multi layer data](https://discuss.elastic.co/t/unable-to-calculate-average-bucket-over-multi-layer-data/273270)
**Author:** [@sumit.sontakke](https://discuss.elastic.co/u/sumit.sontakke)\ **Replies:** 1\ **Last updated:** [May 25, 2021, 10:34am UTC](https://discuss.elastic.co/t/unable-to-calculate-average-bucket-over-multi-layer-data/273270 "2021-05-25T10:34:25Z")
Hi, I'm able to calculate average bucket score over one layer of data, but not on two lever hierarchy data. Example: A-parent-group m-group t-team 1 A-parent-group m-group t-team 4 A-parent-group n-group p-team 45 … --- ## [./gradlew clean check is giving error \> Task :licenseHeaders FAILED](https://discuss.elastic.co/t/gradlew-clean-check-is-giving-error-task-licenseheaders-failed/273745)
**Author:** [@Sreekumar\_Chathambil](https://discuss.elastic.co/u/Sreekumar_Chathambil)\ **Replies:** 1\ **Last updated:** [May 25, 2021, 10:30am UTC](https://discuss.elastic.co/t/gradlew-clean-check-is-giving-error-task-licenseheaders-failed/273745 "2021-05-25T10:30:50Z")
Hi, I am new to plugin development. I have created ingest-plugin project using cookiecutter for the version 7.9.0 and tried checking with ./gradle clean check. i was getting an error Task :licenseHeaders FAILED Unapp… --- ## [Parsing JSON array inside](https://discuss.elastic.co/t/parsing-json-array-inside/273870)
**Author:** [@mirko.spezie](https://discuss.elastic.co/u/mirko.spezie)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 9:53am UTC](https://discuss.elastic.co/t/parsing-json-array-inside/273870 "2021-05-25T09:53:34Z")
Hi, I've got a json with an array inside. Based on another thread I've tried something with ruby to change the key names but it doesn't work. "messages": \[ { "message": "XSS Attack Detected via libinjection… --- ## [Need to write KQL to check if these 4 documents occur one after the other](https://discuss.elastic.co/t/need-to-write-kql-to-check-if-these-4-documents-occur-one-after-the-other/273916)
**Author:** [@abhishek\_s1](https://discuss.elastic.co/u/abhishek_s1)\ **Replies:** 0\ **Last updated:** [May 25, 2021, 9:51am UTC](https://discuss.elastic.co/t/need-to-write-kql-to-check-if-these-4-documents-occur-one-after-the-other/273916 "2021-05-25T09:51:48Z")
1. 31628 2021-02-13T00:20:49.325893Z - xyz svn/repos open 2. 31628 2021-02-13T00:20:49.607437Z - xyz svn/repos get-latest 3. 31628 2021-02-13T00:20:49.888794Z - xyz svn/repos reparent 4. 31628 2021-02-13… --- ## [Wildcard match on multiple fields](https://discuss.elastic.co/t/wildcard-match-on-multiple-fields/273852)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 7:11am UTC](https://discuss.elastic.co/t/wildcard-match-on-multiple-fields/273852 "2021-05-25T07:11:03Z")
Hi, im looking for the right query to find in multiple fields a wildcard query (phone number in phone number fields). i use ElasticsearchDSL ElasticsearchPHP I try the Multi-match query with a part of given value, t… --- ## [Setting Xms and Xmx](https://discuss.elastic.co/t/setting-xms-and-xmx/273875)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 8:52am UTC](https://discuss.elastic.co/t/setting-xms-and-xmx/273875 "2021-05-25T08:52:52Z")
I assume this is a long-debated topic but I was kind of puzzled by this recommendation: Modifying advanced settings is generally not recommended and could negatively impact performance and stability. Using the Elastics… --- ## [Parsing xml in logstash \[0\] "\_xmlparsefailure"](https://discuss.elastic.co/t/parsing-xml-in-logstash-0-xmlparsefailure/273857)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 4\ **Last updated:** [May 25, 2021, 8:42am UTC](https://discuss.elastic.co/t/parsing-xml-in-logstash-0-xmlparsefailure/273857 "2021-05-25T08:42:18Z")
Issue: \[0\] "\_xmlparsefailure" ..Hi all need your help on below issue.. Pleaes refer to step by step explanation of the issue. Step 1 : I have sample input as per below. \ blue … --- ## [Elasticsearch simple query string and highlighter leads to timeout](https://discuss.elastic.co/t/elasticsearch-simple-query-string-and-highlighter-leads-to-timeout/273897)
**Author:** [@schubec](https://discuss.elastic.co/u/schubec)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 8:42am UTC](https://discuss.elastic.co/t/elasticsearch-simple-query-string-and-highlighter-leads-to-timeout/273897 "2021-05-25T08:42:11Z")
Hi! I am facing a strange problem with Elasticsearch: I have this query which results in a timeout because it takes more than 60 seconds: GET /website/\_search { "query": { "simple\_query\_string": { "query":… --- ## [Preventing duplicates when reading the same data multiple times](https://discuss.elastic.co/t/preventing-duplicates-when-reading-the-same-data-multiple-times/273576)
**Author:** [@wlbsxnlp22](https://discuss.elastic.co/u/wlbsxnlp22)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 8:34am UTC](https://discuss.elastic.co/t/preventing-duplicates-when-reading-the-same-data-multiple-times/273576 "2021-05-25T08:34:51Z")
Hi, I'm wondering if anyone has a good solution to the following. I have to read in .csv files that are generated every hour. These .csv files contain all the historic data for as far back as the program has run. Every… --- ## [Does anyone know the password for "file1" in zipWithEncryption?](https://discuss.elastic.co/t/does-anyone-know-the-password-for-file1-in-zipwithencryption/273817)
**Author:** [@fox1](https://discuss.elastic.co/u/fox1)\ **Replies:** 3\ **Last updated:** [May 25, 2021, 7:29am UTC](https://discuss.elastic.co/t/does-anyone-know-the-password-for-file1-in-zipwithencryption/273817 "2021-05-25T07:29:52Z")
HI all, I just hope I'm on the right place... Does anyone know by chance what is the password for that little text file called "file1" in the zip file called "zipWithEncryption" ? located somewhere here : ...\\layer\\u… --- ## [Import es source code into idea,not recognize the src/java as java source fold in searchable-snapshot](https://discuss.elastic.co/t/import-es-source-code-into-idea-not-recognize-the-src-java-as-java-source-fold-in-searchable-snapshot/273905)
**Author:** [@J\_Jackie](https://discuss.elastic.co/u/J_Jackie)\ **Replies:** 0\ **Last updated:** [May 25, 2021, 8:16am UTC](https://discuss.elastic.co/t/import-es-source-code-into-idea-not-recognize-the-src-java-as-java-source-fold-in-searchable-snapshot/273905 "2021-05-25T08:16:17Z")
how can i make it same as others --- ## [Avro to Json](https://discuss.elastic.co/t/avro-to-json/273820)
**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 6:45am UTC](https://discuss.elastic.co/t/avro-to-json/273820 "2021-05-25T06:45:48Z")
Hi, I am consuming data from Kafka with INPUT configuration: input { kafka { codec =\> avro { schema\_uri =\> "/etc/logstash/avro.avsc" } key\_deserializer\_class =\> "org.apach… --- ## [Need to test a index with terabytes of data, how can I do](https://discuss.elastic.co/t/need-to-test-a-index-with-terabytes-of-data-how-can-i-do/272787)
**Author:** [@GITnewfish](https://discuss.elastic.co/u/GITnewfish)\ **Replies:** 7\ **Last updated:** [May 24, 2021, 8:30am UTC](https://discuss.elastic.co/t/need-to-test-a-index-with-terabytes-of-data-how-can-i-do/272787 "2021-05-24T08:30:53Z")
I need to test performance of appand to a index with terabytes of data, and the index mapping is customed. Is there a solution to this scenario? Refer to this topic: Increase data size in Rally existing tracks Whet… --- ## [Stuck at Successfully started Logstash API endpoint {:port=\>9601}](https://discuss.elastic.co/t/stuck-at-successfully-started-logstash-api-endpoint-port-9601/273890)
**Author:** [@dinesh5](https://discuss.elastic.co/u/dinesh5)\ **Replies:** 4\ **Last updated:** [May 25, 2021, 6:10am UTC](https://discuss.elastic.co/t/stuck-at-successfully-started-logstash-api-endpoint-port-9601/273890 "2021-05-25T06:10:24Z")
Hello Please help me out I'm stuck at Successfully started Logstash API endpoint {:port=\>9601} my conf file input { file { path =\> "/home/lsdp/Desktop/covid2405.csv" start\_position =\> "beginning" sincedb\_path =\> "… --- ## [Elastic CCR feature update/delete fails at follower index](https://discuss.elastic.co/t/elastic-ccr-feature-update-delete-fails-at-follower-index/273828)
**Author:** [@pavan\_koppolu](https://discuss.elastic.co/u/pavan_koppolu)\ **Replies:** 0\ **Last updated:** [May 24, 2021, 1:22pm UTC](https://discuss.elastic.co/t/elastic-ccr-feature-update-delete-fails-at-follower-index/273828 "2021-05-24T13:22:59Z")
Hi Team, I have a query like while working with CCR feature everything went well except one use case like Placed a document from one cluster, then replicated the same doc in other cluster Then the first cluster down, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1399) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1401)