# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1423 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1424 --- ## [Multiple date format failes](https://discuss.elastic.co/t/multiple-date-format-failes/272100)
**Author:** [@telebh](https://discuss.elastic.co/u/telebh)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:23am UTC](https://discuss.elastic.co/t/multiple-date-format-failes/272100 "2021-05-10T09:23:49Z")
Hi .. I have mapping for a date field set as follows. ES version used 7.9 "itemtransactionid": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ss:SSZ||strict\_date\_optional\_time||yyyy-MM-dd'T… --- ## [Grouping similar buckets](https://discuss.elastic.co/t/grouping-similar-buckets/272068)
**Author:** [@Gregorkosmina](https://discuss.elastic.co/u/Gregorkosmina)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:14am UTC](https://discuss.elastic.co/t/grouping-similar-buckets/272068 "2021-05-10T09:14:57Z")
My aggregations buckets are sorted by doc\_count at the moment. I would like to group them by similar buckets (e.g 40 km/h, 50 km/h, 60 km/h) even if doc\_count is different. Is this even possible? --- ## [How do I extend the default analyzer?](https://discuss.elastic.co/t/how-do-i-extend-the-default-analyzer/272390)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:10am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-default-analyzer/272390 "2021-05-10T09:10:08Z")
This is example data. POST coding/\_bulk {"index":{"\_id":"1"}} {"language":"xyz\_foo@abc"} I confirmed that the defulat analyzer distinguishes @ but not the \_ (underscore)symbol through \_termvectors. GET coding/\_termve… --- ## [Error Uploading Template to Elasticsearch](https://discuss.elastic.co/t/error-uploading-template-to-elasticsearch/272275)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 8:58am UTC](https://discuss.elastic.co/t/error-uploading-template-to-elasticsearch/272275 "2021-05-10T08:58:58Z")
Hi. I'm adding the 7.12.1 template to our elasticsearch cluster. However, I'm getting this error: Exiting: error loading template: could not load template. Elasticsearch returned: couldn't load template: 400 Bad Reques… --- ## [\[script\_exception\] runtime error bad request](https://discuss.elastic.co/t/script-exception-runtime-error-bad-request/272394)
**Author:** [@Furman](https://discuss.elastic.co/u/Furman)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 8:08am UTC](https://discuss.elastic.co/t/script-exception-runtime-error-bad-request/272394 "2021-05-10T08:08:48Z")
Hi, I am new in Kibana .So I added a scripted field in one of the index pattern. I am pretty sure the code should work fine. When I previewed the results, it works fine. However, when I tried to view it in Discover, … --- ## [Elastic ignoring cold\_role](https://discuss.elastic.co/t/elastic-ignoring-cold-role/272262)
**Author:** [@mverbeek](https://discuss.elastic.co/u/mverbeek)\ **Replies:** 9\ **Last updated:** [May 10, 2021, 8:00am UTC](https://discuss.elastic.co/t/elastic-ignoring-cold-role/272262 "2021-05-10T08:00:36Z")
We have an Elastic stack on 7.6.1 that we upgrades to 7.10.2. Then we introduced new nodes with slower bigger storage to it with cold\_node role and set the others to data\_warm, data\_hot and data\_content. During the inst… --- ## [Elastic Agent Ingest Manager Error 7.12.1](https://discuss.elastic.co/t/elastic-agent-ingest-manager-error-7-12-1/271711)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 7:50pm UTC](https://discuss.elastic.co/t/elastic-agent-ingest-manager-error-7-12-1/271711 "2021-04-29T19:50:25Z")
I have a issue similar to this one: \[Ingest Manager\] Unable to collect logs on machines with timezone set · Issue #24229 · elastic/beats · GitHub I am running docker 7.12.1 elasticsearch and Kibana. I am using elastic-a… --- ## [Elastic Cloud Elasticsearch 7.11.x node tier index allocation](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-7-11-x-node-tier-index-allocation/272185)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 7:54am UTC](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-7-11-x-node-tier-index-allocation/272185 "2021-05-10T07:54:30Z")
Hi All, I noticed that when I started restoring backups in my Elastic Cloud cluster, except for the hot nodes the warm nodes started being populated automatically with data. Is there any documentation about this behavi… --- ## [Kibana hosts list](https://discuss.elastic.co/t/kibana-hosts-list/272315)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 5\ **Last updated:** [May 10, 2021, 7:53am UTC](https://discuss.elastic.co/t/kibana-hosts-list/272315 "2021-05-10T07:53:01Z")
Hello, I have several devices that send data to Elastic via HTTP POST. Is it possible to see them on a list somewhere? Maybe in the Security-\> Hosts section? Thank you --- ## [Elasticsearch exporter metrics from Elastic Cloud](https://discuss.elastic.co/t/elasticsearch-exporter-metrics-from-elastic-cloud/272546)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 0\ **Last updated:** [May 10, 2021, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-exporter-metrics-from-elastic-cloud/272546 "2021-05-10T07:47:07Z")
Hi All, We noticed that when using elasticsearch exporter for prometheus only the hot nodes in Elastic Cloud clusters report their metrics. How can we target the warm and cold (etc.) nodes? Thank you in advance! --- ## [GeoIP from dns.ip\_resolved](https://discuss.elastic.co/t/geoip-from-dns-ip-resolved/272520)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 7:20am UTC](https://discuss.elastic.co/t/geoip-from-dns-ip-resolved/272520 "2021-05-10T07:20:25Z")
Hey guys! I'm using my raspberry pi as a network scanner, I would like to create a map dashboard in kibana which contains the destinations geo location FROM dns resolved IPs. Home network, there are only private IPs, s… --- ## [Panel Settings in Lens - Where have the gone?](https://discuss.elastic.co/t/panel-settings-in-lens-where-have-the-gone/272534)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 6:56am UTC](https://discuss.elastic.co/t/panel-settings-in-lens-where-have-the-gone/272534 "2021-05-10T06:56:56Z")
When creating a vis with Lens, can someone point me in the direction where the panel settings are located? I'm trying to change the settings for the "fill missing values" Thanks in advance, Matt --- ## [Reimporting data at the start of a project](https://discuss.elastic.co/t/reimporting-data-at-the-start-of-a-project/272541)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 6:54am UTC](https://discuss.elastic.co/t/reimporting-data-at-the-start-of-a-project/272541 "2021-05-10T06:54:41Z")
Have just finished the proof of concept (and learning) stage of ELK 7.12.1 installation. At the moment we are using a relatively simple filebeat-\>logstash-\>elasticsearch-\>kibana set up. During that process, I made some… --- ## [Length of bar and text are not matching in bar visualization](https://discuss.elastic.co/t/length-of-bar-and-text-are-not-matching-in-bar-visualization/271539)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 6:38am UTC](https://discuss.elastic.co/t/length-of-bar-and-text-are-not-matching-in-bar-visualization/271539 "2021-05-10T06:38:28Z")
Hi, In below spec though same field (a\_count) has been used for x-axis and text, text is shown correctly where as length of bars is incorrect (x-axis). May I pls know where the issue is? { "$schema": "https://vega.g… --- ## [Installation of filebeat in Docker multi container server](https://discuss.elastic.co/t/installation-of-filebeat-in-docker-multi-container-server/272540)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [May 10, 2021, 6:32am UTC](https://discuss.elastic.co/t/installation-of-filebeat-in-docker-multi-container-server/272540 "2021-05-10T06:32:54Z")
Can you please provide the details related to using the filebeat in multi container docker environment - 1 filebeat per container and 1 filebeat for all containers, considering the log monitoring use case. Any pointer to… --- ## [Kibana Search Latency](https://discuss.elastic.co/t/kibana-search-latency/272493)
**Author:** [@111470](https://discuss.elastic.co/u/111470)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 6:21am UTC](https://discuss.elastic.co/t/kibana-search-latency/272493 "2021-05-10T06:21:41Z")
Hello, I want to know how kibana search latency is calculated. Because I don't understand the kibana source code, so I want to ask you to help me --- ## [Restrict the fields from being updated](https://discuss.elastic.co/t/restrict-the-fields-from-being-updated/272264)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 9\ **Last updated:** [May 10, 2021, 6:21am UTC](https://discuss.elastic.co/t/restrict-the-fields-from-being-updated/272264 "2021-05-10T06:21:35Z")
Hi , Is there a way to restrict the updation of a particular field while indexing a document. For example I have a field 'name' which is of type text and I index a document , next time I try to change this 'name' eithe… --- ## [Dae histogram with line chart](https://discuss.elastic.co/t/dae-histogram-with-line-chart/272405)
**Author:** [@abhishek30](https://discuss.elastic.co/u/abhishek30)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 6:16am UTC](https://discuss.elastic.co/t/dae-histogram-with-line-chart/272405 "2021-05-10T06:16:43Z")
The first interval values on x axis for 0-15 minutes is plotted on 00:00 rather than 00:15. How can i get it to plot on 00:15. --- ## [Google Cloud Traffic Filters](https://discuss.elastic.co/t/google-cloud-traffic-filters/272323)
**Author:** [@Alfredo1](https://discuss.elastic.co/u/Alfredo1)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 3:39am UTC](https://discuss.elastic.co/t/google-cloud-traffic-filters/272323 "2021-05-10T03:39:48Z")
Hi. I see Google Cloud regions in the traffic filter private link endpoint setup section of my Elastic Cloud console. From docs, it appears that Google Cloud is not supported for traffic filter private links, but I want… --- ## [Filebeat cannot setup](https://discuss.elastic.co/t/filebeat-cannot-setup/272305)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 13\ **Last updated:** [May 10, 2021, 3:11am UTC](https://discuss.elastic.co/t/filebeat-cannot-setup/272305 "2021-05-10T03:11:50Z")
i wanna setup my filebeat but i have a report like this \[root@bdi-uat-splunkes filebeat\]# filebeat setup Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch… --- ## [How to change the \_routing field](https://discuss.elastic.co/t/how-to-change-the-routing-field/272488)
**Author:** [@Anyzm](https://discuss.elastic.co/u/Anyzm)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 2:28am UTC](https://discuss.elastic.co/t/how-to-change-the-routing-field/272488 "2021-05-10T02:28:09Z")
i create the index： PUT mobile\_info/?pretty { "settings": { "number\_of\_shards": 5, "number\_of\_replicas": 1 }, "mappings": { "info": { "\_routing":{ "required":"true" }, "properties": { "cust\_no": { "type": "… --- ## [Kibana missing primary shards](https://discuss.elastic.co/t/kibana-missing-primary-shards/272522)
**Author:** [@Ben\_Tang](https://discuss.elastic.co/u/Ben_Tang)\ **Replies:** 7\ **Last updated:** [May 10, 2021, 1:44am UTC](https://discuss.elastic.co/t/kibana-missing-primary-shards/272522 "2021-05-10T01:44:28Z")
I have 2 Kibana nodes and the monitoring page keeps saying missing primary shard GET \_cluster/allocation/explain shows nothing to explain --- ## [Windows logs filtered with Active Directory Groups](https://discuss.elastic.co/t/windows-logs-filtered-with-active-directory-groups/272212)
**Author:** [@MitxelF](https://discuss.elastic.co/u/MitxelF)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 1:08am UTC](https://discuss.elastic.co/t/windows-logs-filtered-with-active-directory-groups/272212 "2021-05-10T01:08:23Z")
Sorry if it is obvious but i'm very new with this. I would like to filter our windows security logs based in some groups manged in the active directory. I don't know how to start. Any idea for begin to think how? Tha… --- ## [\[Suggestion\] Runtime fields and enriching](https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 1:03am UTC](https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402 "2021-05-10T01:03:26Z")
Hey, I've been playing around with runtime fields, and the feature is looking promising. Something that's not possible right now, but I think would be very helpful: The ability to use enrich policies with runtime fiel… --- ## [Elasticsearch Query Alert](https://discuss.elastic.co/t/elasticsearch-query-alert/272524)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 0\ **Last updated:** [May 10, 2021, 12:56am UTC](https://discuss.elastic.co/t/elasticsearch-query-alert/272524 "2021-05-10T00:56:22Z")
I want to create an Alert for a Surikata event. What I want is to generate an alert according to correlation for multiple documents. The problem is that elastalert, KQL, and DSL also seem impossible to query this way. … --- ## [Running elasticsearch 6.x with arm64 architecture](https://discuss.elastic.co/t/running-elasticsearch-6-x-with-arm64-architecture/272287)
**Author:** [@Yugansh\_Marwah](https://discuss.elastic.co/u/Yugansh_Marwah)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:46am UTC](https://discuss.elastic.co/t/running-elasticsearch-6-x-with-arm64-architecture/272287 "2021-05-10T00:46:13Z")
We have our application built on elastic 6.x (to be precise 6.8.15), for local development how can we support Elastic 6.x in docker for arm64 architecture, as migration to 7.x and respective library currently is not a fe… --- ## [ES does not push logs to customized \_type . it push logs for \_doc](https://discuss.elastic.co/t/es-does-not-push-logs-to-customized-type-it-push-logs-for-doc/272320)
**Author:** [@Dhiraj](https://discuss.elastic.co/u/Dhiraj)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:39am UTC](https://discuss.elastic.co/t/es-does-not-push-logs-to-customized-type-it-push-logs-for-doc/272320 "2021-05-10T00:39:34Z")
we have lots of indexes. some have "\_type" : "logs" & some have "\_type" : "log event" . It pushes logs every month after creating an index with the required \_type. but suddenly it was stopped pushing logs to customized … --- ## [Any Gotcha's I should be aware of when upgrading Docker Cluster Installs](https://discuss.elastic.co/t/any-gotchas-i-should-be-aware-of-when-upgrading-docker-cluster-installs/272371)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 6:17am UTC](https://discuss.elastic.co/t/any-gotchas-i-should-be-aware-of-when-upgrading-docker-cluster-installs/272371 "2021-05-07T06:17:26Z")
Hello, I currently have 2 Docker Clusters that are running ES 6.5.1 There are some newer features the team wants to use that in the later / latest version of ES. We have our compose files working and our ES 6.5.1 Dock… --- ## [How do I collect the highest disk active time in Resource Monitor?](https://discuss.elastic.co/t/how-do-i-collect-the-highest-disk-active-time-in-resource-monitor/272398)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 9:27am UTC](https://discuss.elastic.co/t/how-do-i-collect-the-highest-disk-active-time-in-resource-monitor/272398 "2021-05-07T09:27:29Z")
I want to collect the highest disk active time via Metricbeat. I tried to check the data by adding the PhysicalDisk(\_Total)% Disk Time counter in the Performance Monitor Properties. However, when I display the… --- ## [Need to define a role for Filebet and metricbeat for writing to elasticsearch](https://discuss.elastic.co/t/need-to-define-a-role-for-filebet-and-metricbeat-for-writing-to-elasticsearch/272503)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 8\ **Last updated:** [May 10, 2021, 12:28am UTC](https://discuss.elastic.co/t/need-to-define-a-role-for-filebet-and-metricbeat-for-writing-to-elasticsearch/272503 "2021-05-10T00:28:26Z")
I am running v7.7 of the stack from a ZIP install on Windows. But I have the same issue with v7.12 running as docker container on a Mac. I've searched and searched and either I don't know what to search for, or I don't… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1422) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1424)