# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1416 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1417 --- ## [Logstash Elasticsearch Filter Lookup No Results](https://discuss.elastic.co/t/logstash-elasticsearch-filter-lookup-no-results/272933)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 1\ **Last updated:** [May 13, 2021, 6:02pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-lookup-no-results/272933 "2021-05-13T18:02:01Z")
I am having an issue with the Logstash Elasticsearch filter plugin not returning results, when I know there should be. I am sure it is an escape character, or something along those lines, but I cannot for the life of me … --- ## [Share Synonym Path for multiple nodes](https://discuss.elastic.co/t/share-synonym-path-for-multiple-nodes/272940)
**Author:** [@Coder\_Cub](https://discuss.elastic.co/u/Coder_Cub)\ **Replies:** 0\ **Last updated:** [May 13, 2021, 5:35pm UTC](https://discuss.elastic.co/t/share-synonym-path-for-multiple-nodes/272940 "2021-05-13T17:35:45Z")
Hi, I have 3 nodes for my index. I am using synonym filter with synonym .txt for few fields in my index. Is it possible to use one file for all 3 nodes? Something like keeping it in network path and using that in Synon… --- ## [Elastic sharding strategy](https://discuss.elastic.co/t/elastic-sharding-strategy/272925)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 3\ **Last updated:** [May 13, 2021, 5:28pm UTC](https://discuss.elastic.co/t/elastic-sharding-strategy/272925 "2021-05-13T17:28:50Z")
Hello, I have a question about sharding strategy and performance please: when creating an index, the default number of shards is 1 and 1 replica. when creating an ILM policy, the default rollover is 30days/ 50gb. So … --- ## [Fields and Row template in Annotations \[TSVB\]](https://discuss.elastic.co/t/fields-and-row-template-in-annotations-tsvb/272433)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 16\ **Last updated:** [May 13, 2021, 5:25pm UTC](https://discuss.elastic.co/t/fields-and-row-template-in-annotations-tsvb/272433 "2021-05-13T17:25:36Z")
Hi. I am using TSVB to visualize the data stored in the machine learning index, I have seen that I can use annotations to visualize the details of the anomaly but when I try to add the causes.typical field it does not g… --- ## [Add custom connectors to 3rd party](https://discuss.elastic.co/t/add-custom-connectors-to-3rd-party/271329)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 1\ **Last updated:** [May 13, 2021, 5:25pm UTC](https://discuss.elastic.co/t/add-custom-connectors-to-3rd-party/271329 "2021-05-13T17:25:12Z")
Hi, I'm trying to sync Elastic alerts with an inhouse tool we have in my compagny. Does anyone know if i can add custom connectors to Kibana (i'm not talking about adding a webhook but a real connector) If it is poss… --- ## [Version Conflict Engine Exception - seqNo question](https://discuss.elastic.co/t/version-conflict-engine-exception-seqno-question/272930)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [May 13, 2021, 5:11pm UTC](https://discuss.elastic.co/t/version-conflict-engine-exception-seqno-question/272930 "2021-05-13T17:11:49Z")
Hi All, I'm getting version\_conflict\_engine\_exception when doing an update by query in an index with one shard and no replicas. I do not understand well why is this situation happening. Is there any place in the doc … --- ## [Vega Visualisation Trend indicator](https://discuss.elastic.co/t/vega-visualisation-trend-indicator/271600)
**Author:** [@yorick\_c](https://discuss.elastic.co/u/yorick_c)\ **Replies:** 1\ **Last updated:** [May 13, 2021, 5:09pm UTC](https://discuss.elastic.co/t/vega-visualisation-trend-indicator/271600 "2021-05-13T17:09:42Z")
Hi, I'm very new to the Vega visualization option within Kibana and I was wondering if someone could help me out. I'm working on an indicator with trends to visualize the difference in the amount of logs of Last Hour an… --- ## [Kibana and custom-es exporter cannot connect to Elastic search](https://discuss.elastic.co/t/kibana-and-custom-es-exporter-cannot-connect-to-elastic-search/272550)
**Author:** [@harsh9](https://discuss.elastic.co/u/harsh9)\ **Replies:** 3\ **Last updated:** [May 13, 2021, 4:54pm UTC](https://discuss.elastic.co/t/kibana-and-custom-es-exporter-cannot-connect-to-elastic-search/272550 "2021-05-13T16:54:57Z")
I cannot connect to my es from my kibana pod and my custom-es-exporter pod, the error which is thrown is Version of elastic search we are using is 7.7.1 Error from the custom-es-exporter logs --- ## [Bulk retry drops whole BulkResponse if only one BulkItemResponse can not be retried](https://discuss.elastic.co/t/bulk-retry-drops-whole-bulkresponse-if-only-one-bulkitemresponse-can-not-be-retried/272936)
**Author:** [@Chobicus](https://discuss.elastic.co/u/Chobicus)\ **Replies:** 0\ **Last updated:** [May 13, 2021, 4:41pm UTC](https://discuss.elastic.co/t/bulk-retry-drops-whole-bulkresponse-if-only-one-bulkitemresponse-can-not-be-retried/272936 "2021-05-13T16:41:04Z")
Hello. Not sure if canRetry method is intended to behave like this. I have an index where sometimes I try to index the document that is already indexed getting CONFLICT(409) which is fine and should not be retried. Som… --- ## [Create Datatable with multiple queries](https://discuss.elastic.co/t/create-datatable-with-multiple-queries/272387)
**Author:** [@NightWalker](https://discuss.elastic.co/u/NightWalker)\ **Replies:** 1\ **Last updated:** [May 13, 2021, 4:17pm UTC](https://discuss.elastic.co/t/create-datatable-with-multiple-queries/272387 "2021-05-13T16:17:36Z")
Hello, I want to create a datatable from multiple queries where each of them have a different WHERE Clause. Each query should be shown as a new column which are grouped by a daily histogram. I’m pretty sure that it sho… --- ## [Rollover very slow to occurr](https://discuss.elastic.co/t/rollover-very-slow-to-occurr/272414)
**Author:** [@Ronaldo\_Lanhellas](https://discuss.elastic.co/u/Ronaldo_Lanhellas)\ **Replies:** 2\ **Last updated:** [May 13, 2021, 4:01pm UTC](https://discuss.elastic.co/t/rollover-very-slow-to-occurr/272414 "2021-05-13T16:01:04Z")
I'm trying to apply the following policy with rollover: \` "policy": { "phases": { "hot":{ "actions": { "rollover":{ "max\_size": "2GB" } } }, "warm": … --- ## [TSVB: aggregate across ALL documents in index, not just those in a selected time range](https://discuss.elastic.co/t/tsvb-aggregate-across-all-documents-in-index-not-just-those-in-a-selected-time-range/272852)
**Author:** [@ivh](https://discuss.elastic.co/u/ivh)\ **Replies:** 2\ **Last updated:** [May 13, 2021, 3:59pm UTC](https://discuss.elastic.co/t/tsvb-aggregate-across-all-documents-in-index-not-just-those-in-a-selected-time-range/272852 "2021-05-13T15:59:13Z")
Hello! I have a working aggregation (cumulative sum) that behaves as expected when I've used the time picker to select a date range large enough (i.e., goes far enough back in time) to calculate the agg cumulative sum ac… --- ## [Facing error while create new index](https://discuss.elastic.co/t/facing-error-while-create-new-index/272890)
**Author:** [@Dhiraj\_Gurav](https://discuss.elastic.co/u/Dhiraj_Gurav)\ **Replies:** 3\ **Last updated:** [May 13, 2021, 3:31pm UTC](https://discuss.elastic.co/t/facing-error-while-create-new-index/272890 "2021-05-13T15:31:18Z")
Hello, 1)While creating new index as : PUT logstash-test/logs/1 { "demo" : "demo" } I am facing error as : { "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason": "Rejecting mapping up… --- ## [Add field to search results](https://discuss.elastic.co/t/add-field-to-search-results/272928)
**Author:** [@fast.fart](https://discuss.elastic.co/u/fast.fart)\ **Replies:** 0\ **Last updated:** [May 13, 2021, 3:31pm UTC](https://discuss.elastic.co/t/add-field-to-search-results/272928 "2021-05-13T15:31:03Z")
Hi, I want to set field value in search results. Let's say for some documents field xxx is not so I need to set the value based on other fields. I tried to use a simple script below but it only adds fields object but … --- ## [Enrich processor debug statements](https://discuss.elastic.co/t/enrich-processor-debug-statements/272921)
**Author:** [@sulsulatoff](https://discuss.elastic.co/u/sulsulatoff)\ **Replies:** 1\ **Last updated:** [May 13, 2021, 3:22pm UTC](https://discuss.elastic.co/t/enrich-processor-debug-statements/272921 "2021-05-13T15:22:04Z")
I am using enrich processor with ingest pipeline. The enrichment works when I simulate the pipeline but fails when ingesting a doc. How can I debug what is going wrong? Verified that the Pipeline is indeed been invoked … --- ## ["Dead ES instance" errors from Logstash](https://discuss.elastic.co/t/dead-es-instance-errors-from-logstash/272927)
**Author:** [@josephmiano](https://discuss.elastic.co/u/josephmiano)\ **Replies:** 0\ **Last updated:** [May 13, 2021, 3:19pm UTC](https://discuss.elastic.co/t/dead-es-instance-errors-from-logstash/272927 "2021-05-13T15:19:55Z")
We have a very busy ES instance with 200+ servers streaming via logstash. At peak volume times, we are seeing these "dead ES instance" errors when logstash attempts to connect to the instance: \[2021-05-12T14:49:46,293… --- ## [Not able to import data in elastic through logstash](https://discuss.elastic.co/t/not-able-to-import-data-in-elastic-through-logstash/271912)
**Author:** [@ajay8310](https://discuss.elastic.co/u/ajay8310)\ **Replies:** 7\ **Last updated:** [May 13, 2021, 3:19pm UTC](https://discuss.elastic.co/t/not-able-to-import-data-in-elastic-through-logstash/271912 "2021-05-13T15:19:16Z")
I am using logstash to import data in elastic search. I am using .conf file to import data in index in elastic. Every time I run the .conf file I get the following message repeatedly and index DOES NOT get created. \< \[… --- ## [Detecting empty fields not working as before in logstash 7.12.1](https://discuss.elastic.co/t/detecting-empty-fields-not-working-as-before-in-logstash-7-12-1/271764)
**Author:** [@mario\_wood](https://discuss.elastic.co/u/mario_wood)\ **Replies:** 3\ **Last updated:** [May 13, 2021, 3:18pm UTC](https://discuss.elastic.co/t/detecting-empty-fields-not-working-as-before-in-logstash-7-12-1/271764 "2021-05-13T15:18:34Z")
Hi, I'm migrating our logstash from 6.8 to 7.12 and I'm finding that the detection of empty fields is not working as it used to. For example given the input { "foo":"", "bar":"baz" } and the logstash filter if \[… --- ## [Calculate the maximum number of requests per second for the same IP](https://discuss.elastic.co/t/calculate-the-maximum-number-of-requests-per-second-for-the-same-ip/272842)
**Author:** [@CHIAWEI\_WU](https://discuss.elastic.co/u/CHIAWEI_WU)\ **Replies:** 2\ **Last updated:** [May 13, 2021, 2:56pm UTC](https://discuss.elastic.co/t/calculate-the-maximum-number-of-requests-per-second-for-the-same-ip/272842 "2021-05-13T14:56:44Z")
I have logs with the fields: . IP . Timestamp how to use visualize calculation the same ip per second ? I have calculated with csv, but due to the maximum length limit ... --- ## [Preventing too\_long\_frame\_exception on GetAlias Rest client](https://discuss.elastic.co/t/preventing-too-long-frame-exception-on-getalias-rest-client/272917)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 0\ **Last updated:** [May 13, 2021, 2:24pm UTC](https://discuss.elastic.co/t/preventing-too-long-frame-exception-on-getalias-rest-client/272917 "2021-05-13T14:24:16Z")
We are on Elasticsearch 6.8 and recently start using rest client. Some of the rest API endpoints like getAlias(\_alias) requests are GET requests with index names are included in the URL. When there are too many indices, … --- ## [No results match your search criteria in discover](https://discuss.elastic.co/t/no-results-match-your-search-criteria-in-discover/272853)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [May 13, 2021, 1:48pm UTC](https://discuss.elastic.co/t/no-results-match-your-search-criteria-in-discover/272853 "2021-05-13T13:48:33Z")
I have a data which has @timestamp (when data was ingested) and time\_logged where log event happen. When I create index pattern with @timestamp I can see data on discover but when I create index pattern with time\_logge… --- ## [Unique count exact value](https://discuss.elastic.co/t/unique-count-exact-value/272910)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 0\ **Last updated:** [May 13, 2021, 12:50pm UTC](https://discuss.elastic.co/t/unique-count-exact-value/272910 "2021-05-13T12:50:47Z")
hi , we trying to use unique count in Elasticsearch we know its Cardinality Aggregation and give approximate count . we also tried using "precision\_threshold":10000 , but still count is not exact. let me give info - … --- ## [Update by query rejected despite having index privilege on index alias](https://discuss.elastic.co/t/update-by-query-rejected-despite-having-index-privilege-on-index-alias/272425)
**Author:** [@jdmcalee](https://discuss.elastic.co/u/jdmcalee)\ **Replies:** 2\ **Last updated:** [May 13, 2021, 12:48pm UTC](https://discuss.elastic.co/t/update-by-query-rejected-despite-having-index-privilege-on-index-alias/272425 "2021-05-13T12:48:54Z")
I have a set of concrete indexes named like myindex-v1 with aliases like myindex. For my roles, I've granted privileges as needed to all of the aliases and not the concrete indexes. That all works fine except when I atte… --- ## [Implement Hot-Warm-Cold-Frozen-Delete phases with only one node but multiple storage destinations?](https://discuss.elastic.co/t/implement-hot-warm-cold-frozen-delete-phases-with-only-one-node-but-multiple-storage-destinations/272901)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 4\ **Last updated:** [May 13, 2021, 12:36pm UTC](https://discuss.elastic.co/t/implement-hot-warm-cold-frozen-delete-phases-with-only-one-node-but-multiple-storage-destinations/272901 "2021-05-13T12:36:32Z")
Hello We are looking to implement Hot-Warm-Cold-Frozen-Delete phases for a client but the idea is to move the indexes to other storage: For example, keep hot on local SSDs but move frozen to offsite HDDs (just a example… --- ## [Elastic Query for single field on multiple values](https://discuss.elastic.co/t/elastic-query-for-single-field-on-multiple-values/272903)
**Author:** [@Divy\_Garg](https://discuss.elastic.co/u/Divy_Garg)\ **Replies:** 0\ **Last updated:** [May 13, 2021, 11:19am UTC](https://discuss.elastic.co/t/elastic-query-for-single-field-on-multiple-values/272903 "2021-05-13T11:19:10Z")
Hi, I am not able to come up with a solution how to implement this query. So if someone could help that will be great. My doc looks something like this { a: "val", b: "val1", c: "val3" } I want to g… --- ## [How to deal with brackets json input filter](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848)
**Author:** [@Magnuss](https://discuss.elastic.co/u/Magnuss)\ **Replies:** 8\ **Last updated:** [May 13, 2021, 11:02am UTC](https://discuss.elastic.co/t/how-to-deal-with-brackets-json-input-filter/272848 "2021-05-13T11:02:15Z")
Hi there, I'm trying to figure out how to deal with brackets in logstash. The code is as following: { "test1": "text", "images": \[ "https://test2.com/images/I/test.jpg", "https://test2.com/images/I/test.jpg", … --- ## [Error parsing logs Filebeat - APACHE module](https://discuss.elastic.co/t/error-parsing-logs-filebeat-apache-module/272889)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 1\ **Last updated:** [May 13, 2021, 10:44am UTC](https://discuss.elastic.co/t/error-parsing-logs-filebeat-apache-module/272889 "2021-05-13T10:44:10Z")
Hi everyone, I have configured my Apache server with Filebeat apache module to load ACCESS and ERROR logs to Elasticsearch but is not working properly, all the logs are not parsed (are raw). This is my configuration: A… --- ## [Reindex data on old ES version using Logstash](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 5\ **Last updated:** [May 13, 2021, 9:48am UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496 "2021-05-13T09:48:01Z")
Hey there, I am trying to reindex data from an old ES version to another old ES version using Logstash with elasticsearch input. Anyway I have some doubts. If I schedule the action, during the second execution it will … --- ## [Custom Icon for Kibana App Category](https://discuss.elastic.co/t/custom-icon-for-kibana-app-category/272847)
**Author:** [@amartin-layer3com](https://discuss.elastic.co/u/amartin-layer3com)\ **Replies:** 1\ **Last updated:** [May 13, 2021, 9:14am UTC](https://discuss.elastic.co/t/custom-icon-for-kibana-app-category/272847 "2021-05-13T09:14:34Z")
Our business uses a simple in-house kibana plugin to present dashboard links in the sidebar. Here is an image illustrating how this might look: To get this to work, we have an custom AppCategory in our plugin: c… --- ## [Children aggregation not returning results](https://discuss.elastic.co/t/children-aggregation-not-returning-results/272896)
**Author:** [@brjisc](https://discuss.elastic.co/u/brjisc)\ **Replies:** 0\ **Last updated:** [May 13, 2021, 9:14am UTC](https://discuss.elastic.co/t/children-aggregation-not-returning-results/272896 "2021-05-13T09:14:26Z")
Using a mapping with: "stats\_rel": { "type": "join", "relations": { "metadata": "stat" } }\`\`\` and sample data of: \`\`\`{ "\_index": "irustest", "\_type": "\_doc", "\_id": … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1415) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1417)