# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1483 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1484 --- ## [Install elasticsearch on apache](https://discuss.elastic.co/t/install-elasticsearch-on-apache/268875)
**Author:** [@alexkr](https://discuss.elastic.co/u/alexkr)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 10:40am UTC](https://discuss.elastic.co/t/install-elasticsearch-on-apache/268875 "2021-03-31T10:40:30Z")
Hey I try to install elasticsearch on my centos 7 but all the installation guide are using ngxin and I need to install it on apache server. Someone did it and please can send me how to do it? --- ## [Exact phrase near other terms](https://discuss.elastic.co/t/exact-phrase-near-other-terms/268893)
**Author:** [@rd8388](https://discuss.elastic.co/u/rd8388)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 10:20am UTC](https://discuss.elastic.co/t/exact-phrase-near-other-terms/268893 "2021-03-31T10:20:34Z")
Is there a way to search for one or more exact phrases near one or more other terms/phrases? I'm using MatchPhrase with slop zero to find exact phrases fine and using Match to find two or more terms near each other but … --- ## [Elasticsearch or Kibana How to merge two \_id data](https://discuss.elastic.co/t/elasticsearch-or-kibana-how-to-merge-two-id-data/268887)
**Author:** [@Ivan\_chen](https://discuss.elastic.co/u/Ivan_chen)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 9:21am UTC](https://discuss.elastic.co/t/elasticsearch-or-kibana-how-to-merge-two-id-data/268887 "2021-03-31T09:21:35Z")
Hi I use metricbeat redis moduls My data have two event.dataset in one index I want merge data , Show on kibana data table 1.redis.info Host version 127.0.0.1 5.0.8 127.0.0.2 3.2.0 127.0.0.3 5.0.8 2.re… --- ## [Shrink unable to allocate index due to initial\_recovery setting](https://discuss.elastic.co/t/shrink-unable-to-allocate-index-due-to-initial-recovery-setting/268813)
**Author:** [@toby\_jn](https://discuss.elastic.co/u/toby_jn)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 9:38am UTC](https://discuss.elastic.co/t/shrink-unable-to-allocate-index-due-to-initial-recovery-setting/268813 "2021-03-31T09:38:43Z")
We ran into a very strange issue with index shrink following recovery from a complete cluster network outage. The outage appears to have taken place in the middle of a shrink operation and following the restart the shrin… --- ## [Trying to build a table visualization with multiple aggregations](https://discuss.elastic.co/t/trying-to-build-a-table-visualization-with-multiple-aggregations/268288)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 9:28am UTC](https://discuss.elastic.co/t/trying-to-build-a-table-visualization-with-multiple-aggregations/268288 "2021-03-31T09:28:18Z")
I want to build a table of alerts from and IDS where the rows are keyed on a term (alert name) then in the first column, the second column I want the alert category then I want then number of unique src IP addresses and … --- ## [Issue with query\_string query](https://discuss.elastic.co/t/issue-with-query-string-query/268889)
**Author:** [@arthur\_th](https://discuss.elastic.co/u/arthur_th)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 9:28am UTC](https://discuss.elastic.co/t/issue-with-query-string-query/268889 "2021-03-31T09:28:17Z")
Hello, I am new to the Elastic stack, I want to do a specific search and it doesn't seem to work. I want to search for a regex respecting word order. For example this would be a query with query\_string: '(/Cytochrome\[… --- ## [Certificate issue with elasticsearch SSL](https://discuss.elastic.co/t/certificate-issue-with-elasticsearch-ssl/268659)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 9:07am UTC](https://discuss.elastic.co/t/certificate-issue-with-elasticsearch-ssl/268659 "2021-03-31T09:07:23Z")
Hi All, We have created a self signed certificate for elasticsearch to use elastic through https, all working good with self signed certificate ( which is not a trusted certificate) Now we got a trusted certificate and… --- ## [Multi tenant cluster architecture](https://discuss.elastic.co/t/multi-tenant-cluster-architecture/268841)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 6:15am UTC](https://discuss.elastic.co/t/multi-tenant-cluster-architecture/268841 "2021-03-31T06:15:22Z")
How would you design a multi tenant cluster in eladtic 7.12? Should support 5000 tenants . Some have less than 100mb of data and some 150 gb or more. I thought of having shared datastream for the small ones, and dedicat… --- ## [How to assign one value to another](https://discuss.elastic.co/t/how-to-assign-one-value-to-another/268824)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 8:52am UTC](https://discuss.elastic.co/t/how-to-assign-one-value-to-another/268824 "2021-03-31T08:52:13Z")
Hi , I am new to logstash I have below data in JSON. "attributes": \[ { "name": "test1", "value": "test1\_value" }, { "name": "test2", "value": "test2\_value" } \] I want this data in below format : "attributes": … --- ## [Script query - iterating through nested docs](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877)
**Author:** [@bruno\_v](https://discuss.elastic.co/u/bruno_v)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 8:20am UTC](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877 "2021-03-31T08:20:14Z")
I have the following nested property in my mapping: "books": { "type": "nested", "properties": { "book\_id": { "type": "keyword" }, "book\_name": { "type": "keyword" } … --- ## [How get object in script in aggregations](https://discuss.elastic.co/t/how-get-object-in-script-in-aggregations/268082)
**Author:** [@Marina\_S](https://discuss.elastic.co/u/Marina_S)\ **Replies:** 2\ **Last updated:** [March 23, 2021, 12:26pm UTC](https://discuss.elastic.co/t/how-get-object-in-script-in-aggregations/268082 "2021-03-23T12:26:31Z")
I have this object which have ArrayList wirh objects "sizeData" : { "id" : 1, "elasticSizeScale" : { "id" : 3, "sizes" : \[ { "id" : 321, … --- ## [Elasticsearch giving query\_shard\_exception for query\_string](https://discuss.elastic.co/t/elasticsearch-giving-query-shard-exception-for-query-string/268556)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 8:01am UTC](https://discuss.elastic.co/t/elasticsearch-giving-query-shard-exception-for-query-string/268556 "2021-03-31T08:01:47Z")
I am storing URL in the elastic search and I making the following request to get a result for elastic search: { "query\_string": { "query": "\*http://localhost:8000/v3/a… --- ## [Unable to configure the filebeat with open distro for elasticsearch](https://discuss.elastic.co/t/unable-to-configure-the-filebeat-with-open-distro-for-elasticsearch/268799)
**Author:** [@shai](https://discuss.elastic.co/u/shai)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 7:43am UTC](https://discuss.elastic.co/t/unable-to-configure-the-filebeat-with-open-distro-for-elasticsearch/268799 "2021-03-31T07:43:01Z")
hi team, unable to configure filebeat with open distro for elasticsearch. Please tell me where should be change according to open distro for elastic search --- ## [Index template creation: can we parameterize the shards and replica](https://discuss.elastic.co/t/index-template-creation-can-we-parameterize-the-shards-and-replica/268811)
**Author:** [@raja\_augstin](https://discuss.elastic.co/u/raja_augstin)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 7:36am UTC](https://discuss.elastic.co/t/index-template-creation-can-we-parameterize-the-shards-and-replica/268811 "2021-03-31T07:36:04Z")
can't we parameterize index shards and replicas in index template. { "index\_template\_1": { "index\_patterns": \[ "\*" \], "settings": { "index": { "analysis": { "analyzer": { "index\_edgeNGram\_analyzer": { "filter"… --- ## [How to find the time difference between two documents (rows in sql) in an index (table in sql) with same Id](https://discuss.elastic.co/t/how-to-find-the-time-difference-between-two-documents-rows-in-sql-in-an-index-table-in-sql-with-same-id/268782)
**Author:** [@imganeshr](https://discuss.elastic.co/u/imganeshr)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-find-the-time-difference-between-two-documents-rows-in-sql-in-an-index-table-in-sql-with-same-id/268782 "2021-03-31T07:12:13Z")
Hello Everyone, I am new to Elastic Search and Kibana Query Language. I would like to find the time difference between the two documents which have the id as common between them as like below. TimeStamp … --- ## [Wont be able to generate .csv file](https://discuss.elastic.co/t/wont-be-able-to-generate-csv-file/268798)
**Author:** [@Kaustubh20](https://discuss.elastic.co/u/Kaustubh20)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 7:01am UTC](https://discuss.elastic.co/t/wont-be-able-to-generate-csv-file/268798 "2021-03-31T07:01:42Z")
Hi , i am using kibana version 6.4 and Wont be able to generate .csv file. sometimes it work automatically and sometimes not. It showing me error that field format is not a constructor. Please suggest me --- ## [How to create Tile maps visualization in kibana using tile map service?](https://discuss.elastic.co/t/how-to-create-tile-maps-visualization-in-kibana-using-tile-map-service/268789)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 6:54am UTC](https://discuss.elastic.co/t/how-to-create-tile-maps-visualization-in-kibana-using-tile-map-service/268789 "2021-03-31T06:54:23Z")
Hello.I am using Kibana version 7.12.0. I want to create Tile map visualization using tile map service for my logs.It ask's three things i.e "Url","Attribution text","Attribution link".What things we have to specify here… --- ## [Aggregate data using filebeat](https://discuss.elastic.co/t/aggregate-data-using-filebeat/267907)
**Author:** [@szabgab](https://discuss.elastic.co/u/szabgab)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 6:53am UTC](https://discuss.elastic.co/t/aggregate-data-using-filebeat/267907 "2021-03-31T06:53:09Z")
I have a log file that looks like this: TIMESTAMP FIELD VALUE e.g. 100 load 1 100 mem 23 100 free 7 103 load 2 103 mem 17 103 free 9 ... I would like to aggregate the lines with the same … --- ## [Indexing performance degraded in Elasticsearch 7.10](https://discuss.elastic.co/t/indexing-performance-degraded-in-elasticsearch-7-10/267938)
**Author:** [@shamzeer](https://discuss.elastic.co/u/shamzeer)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 6:28am UTC](https://discuss.elastic.co/t/indexing-performance-degraded-in-elasticsearch-7-10/267938 "2021-03-31T06:28:01Z")
Hi, As per the blog below, there is considerable improvement made in Elasticsearch 7.10 in data storage needs. https://www.elastic.co/blog/save-space-and-money-with-improved-storage-efficiency-in-elasticsearch-7-10. I… --- ## [OpenSource Framework Solution](https://discuss.elastic.co/t/opensource-framework-solution/268865)
**Author:** [@maheshballa](https://discuss.elastic.co/u/maheshballa)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 6:20am UTC](https://discuss.elastic.co/t/opensource-framework-solution/268865 "2021-03-31T06:20:05Z")
Hello All, We are developing an open source Diagnostic solutions which works on Oracle products. During this process, we have enough logs generated, and we want to use ELK (Open Source) for visualization and analysis o… --- ## [How to increase the number of filebeat servers in stages](https://discuss.elastic.co/t/how-to-increase-the-number-of-filebeat-servers-in-stages/268853)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 3:44am UTC](https://discuss.elastic.co/t/how-to-increase-the-number-of-filebeat-servers-in-stages/268853 "2021-03-31T03:44:45Z")
We are currently trying to increase the number of servers we log using filebeat and logstash in stages. Filebeat can be installed on a new logging server, and logstash can send logs to the installed server. logstash is… --- ## [For an I/O block on a machine in the ES cluster, how can I set it so that ES returns a 504 timeout and then tries to poll the node to retry](https://discuss.elastic.co/t/for-an-i-o-block-on-a-machine-in-the-es-cluster-how-can-i-set-it-so-that-es-returns-a-504-timeout-and-then-tries-to-poll-the-node-to-retry/268857)
**Author:** [@serug](https://discuss.elastic.co/u/serug)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 2:59am UTC](https://discuss.elastic.co/t/for-an-i-o-block-on-a-machine-in-the-es-cluster-how-can-i-set-it-so-that-es-returns-a-504-timeout-and-then-tries-to-poll-the-node-to-retry/268857 "2021-03-31T02:59:28Z")
I have a question to ask . The scenario is that one of the machines in my ES(6.7) cluster is blocked by I/O, which causes the ES request to be blocked as well, thus causing the thread pool resource depletion. I would li… --- ## [Logontime logofftime](https://discuss.elastic.co/t/logontime-logofftime/268719)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 2:58am UTC](https://discuss.elastic.co/t/logontime-logofftime/268719 "2021-03-31T02:58:29Z")
hello, I'm currently using winlogbeat for window server monitoring. how to i know logon and logoff time an user on windows server? here's the example of splunk's report --- ## [Default index template for streams](https://discuss.elastic.co/t/default-index-template-for-streams/268847)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 0\ **Last updated:** [March 30, 2021, 11:52pm UTC](https://discuss.elastic.co/t/default-index-template-for-streams/268847 "2021-03-30T23:52:52Z")
Is there a way to create a default index template for the newer streams from the Elastic Agent for example. I am wanting to set the replica count to 0 for all streams. This was pretty easy to do for the legacy templates … --- ## [Attaching a drill down to a table panel](https://discuss.elastic.co/t/attaching-a-drill-down-to-a-table-panel/268691)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 1:50am UTC](https://discuss.elastic.co/t/attaching-a-drill-down-to-a-table-panel/268691 "2021-03-31T01:50:52Z")
Kibana 7 I have a table visualisation with with a total column and two Unique counts. I now want to be able to drill down into the cells to see a further level of detail for each of those cells. Signature … --- ## [Snapshot Failures in elastic cloud 's elastic search](https://discuss.elastic.co/t/snapshot-failures-in-elastic-cloud-s-elastic-search/268846)
**Author:** [@saelastic](https://discuss.elastic.co/u/saelastic)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 1:19am UTC](https://discuss.elastic.co/t/snapshot-failures-in-elastic-cloud-s-elastic-search/268846 "2021-03-31T01:19:22Z")
Our current elastic stack is not healthy by snapshot failures. We have about 800 primary shards and all of them fail with the same error during snapshot as below. Could some one help us understand the error in depth tha… --- ## [User system Kibana](https://discuss.elastic.co/t/user-system-kibana/268747)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 1:16am UTC](https://discuss.elastic.co/t/user-system-kibana/268747 "2021-03-31T01:16:48Z")
Is it the system in Kibana that runs the service has a system user: kibana? --- ## [Trouble getting ILM to work for externally created index](https://discuss.elastic.co/t/trouble-getting-ilm-to-work-for-externally-created-index/268766)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 0\ **Last updated:** [March 30, 2021, 9:59am UTC](https://discuss.elastic.co/t/trouble-getting-ilm-to-work-for-externally-created-index/268766 "2021-03-30T09:59:33Z")
Hello, I am using a kafka service from a supplier called Aiven, they have a connector which can push logs to elasticsearch. They push the logs into a daily index called: kafka-YYYY-MM-DD . Now I tried to create an inde… --- ## [Track user logged into Kibana and track their activities](https://discuss.elastic.co/t/track-user-logged-into-kibana-and-track-their-activities/268779)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 1:14am UTC](https://discuss.elastic.co/t/track-user-logged-into-kibana-and-track-their-activities/268779 "2021-03-31T01:14:28Z")
Hi All, For the monitoring purpose, we need to do the analysis on below two points in Kibana Which all users logged in to Kibana What all activities they performed/which all query they executed. Can somebody please h… --- ## [How to add a field with description for a specific Windows Event ID?](https://discuss.elastic.co/t/how-to-add-a-field-with-description-for-a-specific-windows-event-id/268617)
**Author:** [@nael\_uchiha](https://discuss.elastic.co/u/nael_uchiha)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 12:22am UTC](https://discuss.elastic.co/t/how-to-add-a-field-with-description-for-a-specific-windows-event-id/268617 "2021-03-31T00:22:43Z")
Hello, I need to add some fields and descriptions for a Windows Event ID. For example, for winlog.event\_id = 1111 create a field named rule.description: Our descroption Thank you for your help! [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1482) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1484)