# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1489 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1490 --- ## [Es docker 10.2 version is upgraded to 12.0, log "SearchPhaseExecutionException: all shards failed"](https://discuss.elastic.co/t/es-docker-10-2-version-is-upgraded-to-12-0-log-searchphaseexecutionexception-all-shards-failed/268547)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [March 27, 2021, 5:37am UTC](https://discuss.elastic.co/t/es-docker-10-2-version-is-upgraded-to-12-0-log-searchphaseexecutionexception-all-shards-failed/268547 "2021-03-27T05:37:37Z")
{"type": "server", "timestamp": "2021-03-27T00:33:09,519Z", "level": "WARN", "component": "r.suppressed", "cluster.name": "es-single-node", "node.name": "es-docker", "message": "path: /elastalert\_status\_test/\_search, pa… --- ## [How to create SLA breach graph](https://discuss.elastic.co/t/how-to-create-sla-breach-graph/268525)
**Author:** [@Flavio\_Cadete](https://discuss.elastic.co/u/Flavio_Cadete)\ **Replies:** 2\ **Last updated:** [March 27, 2021, 5:21am UTC](https://discuss.elastic.co/t/how-to-create-sla-breach-graph/268525 "2021-03-27T05:21:59Z")
Product Team requires a graph in Kibana for find SLA breaches. In each document of our index we have 2 dates: created, modified There are 2 scenarios that we want to detect: Pending Checks (documents) where Created \> … --- ## [Filebeat - Logstash SSL not working](https://discuss.elastic.co/t/filebeat-logstash-ssl-not-working/268476)
**Author:** [@anandd4](https://discuss.elastic.co/u/anandd4)\ **Replies:** 1\ **Last updated:** [March 27, 2021, 5:06am UTC](https://discuss.elastic.co/t/filebeat-logstash-ssl-not-working/268476 "2021-03-27T05:06:08Z")
Problem Statement - Unable to transfer filebeat logs to logstash when SSL is enabled. Logstash keeps on complaining about incorrect OpenSSL version number PS - Filebeat works fine when SSL is disabled & able to transfer… --- ## [Elasticsearch API for Updating multiple fields for multiple documents that belongs to an index in Elasticsearch](https://discuss.elastic.co/t/elasticsearch-api-for-updating-multiple-fields-for-multiple-documents-that-belongs-to-an-index-in-elasticsearch/268515)
**Author:** [@Srikanth\_Choppara](https://discuss.elastic.co/u/Srikanth_Choppara)\ **Replies:** 2\ **Last updated:** [March 27, 2021, 2:05am UTC](https://discuss.elastic.co/t/elasticsearch-api-for-updating-multiple-fields-for-multiple-documents-that-belongs-to-an-index-in-elasticsearch/268515 "2021-03-27T02:05:19Z")
I have a requirement to update fields of all the documents that were fetched based on come criteria or filter. There is one particular field which should be updated as appending to the existing content. Is there any w… --- ## [How to compare the sums of multiple columns?](https://discuss.elastic.co/t/how-to-compare-the-sums-of-multiple-columns/268491)
**Author:** [@saintjohn](https://discuss.elastic.co/u/saintjohn)\ **Replies:** 1\ **Last updated:** [March 27, 2021, 12:08am UTC](https://discuss.elastic.co/t/how-to-compare-the-sums-of-multiple-columns/268491 "2021-03-27T00:08:54Z")
Hi, I have datasets like below. { count\_A: 10, count\_B: 5 } { count\_A: 20, count\_: 5 } I would to create a Kibana pie chart that compares the sums of each columns. In this case, 30 vs 10 for count\_A and count\_… --- ## [How to include specific field values in Kibana mail action](https://discuss.elastic.co/t/how-to-include-specific-field-values-in-kibana-mail-action/268305)
**Author:** [@vkoukou](https://discuss.elastic.co/u/vkoukou)\ **Replies:** 1\ **Last updated:** [March 26, 2021, 10:51pm UTC](https://discuss.elastic.co/t/how-to-include-specific-field-values-in-kibana-mail-action/268305 "2021-03-26T22:51:25Z")
Is there a way to include one or more of the event fields in the message of a Kibana Mail alert? Thanks in advance for your help. --- ## [Send data via mqtt](https://discuss.elastic.co/t/send-data-via-mqtt/268372)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 11\ **Last updated:** [March 26, 2021, 9:40pm UTC](https://discuss.elastic.co/t/send-data-via-mqtt/268372 "2021-03-26T21:40:19Z")
Hello, I am using an Elastic Cloud instance and I was wondering if there was the possibility to send data via MQTT from a Linux system device in the cloud. How can I do? Thank you --- ## [Problem with filter](https://discuss.elastic.co/t/problem-with-filter/268466)
**Author:** [@modesto](https://discuss.elastic.co/u/modesto)\ **Replies:** 6\ **Last updated:** [March 26, 2021, 8:19pm UTC](https://discuss.elastic.co/t/problem-with-filter/268466 "2021-03-26T20:19:16Z")
Hi community I'm quite new to Elastic and have run into some obstacles. I want to do a search on a specific company id, with filters, but can't it to work, although it works with query. Why is that? curl --location -… --- ## [Duration field formatter hh:mm:ss](https://discuss.elastic.co/t/duration-field-formatter-hhss/268533)
**Author:** [@Carl\_Schneidinger](https://discuss.elastic.co/u/Carl_Schneidinger)\ **Replies:** 2\ **Last updated:** [March 26, 2021, 8:14pm UTC](https://discuss.elastic.co/t/duration-field-formatter-hhss/268533 "2021-03-26T20:14:01Z")
I have a number field that represents a time duration in seconds. I set this field as duration in an index pattern. My end users want to see the time duration in hh:mm:ss instead of number of seconds/minutes/hours. Th… --- ## [Elastic SaaS on Azure - Securing data and communication](https://discuss.elastic.co/t/elastic-saas-on-azure-securing-data-and-communication/268222)
**Author:** [@ceiche](https://discuss.elastic.co/u/ceiche)\ **Replies:** 1\ **Last updated:** [March 26, 2021, 7:59pm UTC](https://discuss.elastic.co/t/elastic-saas-on-azure-securing-data-and-communication/268222 "2021-03-26T19:59:36Z")
One of my client is planning to use Elastic SaaS Solution from Elastic on Azure (native Elasticsearch) for document search. It will be storing very sensitive data. So the question is how "secure" an Elastic SaaS solutio… --- ## [Logstash http output basic auth base64 encode not parsed](https://discuss.elastic.co/t/logstash-http-output-basic-auth-base64-encode-not-parsed/268432)
**Author:** [@lemoncodes91](https://discuss.elastic.co/u/lemoncodes91)\ **Replies:** 1\ **Last updated:** [March 26, 2021, 5:02pm UTC](https://discuss.elastic.co/t/logstash-http-output-basic-auth-base64-encode-not-parsed/268432 "2021-03-26T17:02:53Z")
Hello i followed some guides on how to do basic auth in logstash. However, when i check the outgoing packet from logstash, the HTTP protocol contains "Authorization: Basic %{password}" instead of "Authorization: Basic \ **Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 5\ **Last updated:** [March 26, 2021, 4:58pm UTC](https://discuss.elastic.co/t/replay-old-events-as-if-they-were-new/268218 "2021-03-26T16:58:01Z") Suppose I have: A Kibana dashboard that shows the last few minutes, automatically refreshing every few seconds A Logstash config that reads JSON Lines from a file (via stdin), sets the event timestamp to the value of a… --- ## [Elasticsearch Output Plugin - Batching, How?](https://discuss.elastic.co/t/elasticsearch-output-plugin-batching-how/268469)
**Author:** [@Liam\_B](https://discuss.elastic.co/u/Liam_B)\ **Replies:** 1\ **Last updated:** [March 26, 2021, 4:51pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-batching-how/268469 "2021-03-26T16:51:51Z")
In the Logstash elastic search output documentation it mentions... Batch Sizes: This plugin attempts to send batches of events to the \[Elasticsearch Bulk API\] I can't find any information on how the batches are buffere… --- ## [Is case-insensitive sort on keyword aggregation. ES 7.7.0](https://discuss.elastic.co/t/is-case-insensitive-sort-on-keyword-aggregation-es-7-7-0/268198)
**Author:** [@Cular](https://discuss.elastic.co/u/Cular)\ **Replies:** 3\ **Last updated:** [March 26, 2021, 4:44pm UTC](https://discuss.elastic.co/t/is-case-insensitive-sort-on-keyword-aggregation-es-7-7-0/268198 "2021-03-26T16:44:49Z")
I have similar case like here and here2. I am trying to achive alphabetical sorting (case insensitive) with original value from aggregation. Simplified example mapping: PUT test\_data { "mappings": { "prope… --- ## [Logstash does not pick up all gzip log files](https://discuss.elastic.co/t/logstash-does-not-pick-up-all-gzip-log-files/268446)
**Author:** [@erictung](https://discuss.elastic.co/u/erictung)\ **Replies:** 1\ **Last updated:** [March 26, 2021, 4:39pm UTC](https://discuss.elastic.co/t/logstash-does-not-pick-up-all-gzip-log-files/268446 "2021-03-26T16:39:25Z")
Hi community, this is my first post in this forum and I would like to seek help regarding Logstash. So here's the scenario: I have a Python script to pull logs from Cloudflare ELS and then save it into local folder as … --- ## [Filter documents prior to bucketing using GeoTile Aggregation](https://discuss.elastic.co/t/filter-documents-prior-to-bucketing-using-geotile-aggregation/268517)
**Author:** [@jvanulde](https://discuss.elastic.co/u/jvanulde)\ **Replies:** 0\ **Last updated:** [March 26, 2021, 4:10pm UTC](https://discuss.elastic.co/t/filter-documents-prior-to-bucketing-using-geotile-aggregation/268517 "2021-03-26T16:10:57Z")
Hi all, I am looking for an example where documents are filtered prior to bucketing via the GeoTile aggregation. For example I would like to have buckets that hold the number of documents where some value is greater than… --- ## [Unable to tesselate shape error on indexing ES 7.11.1](https://discuss.elastic.co/t/unable-to-tesselate-shape-error-on-indexing-es-7-11-1/268356)
**Author:** [@mario.l](https://discuss.elastic.co/u/mario.l)\ **Replies:** 8\ **Last updated:** [March 26, 2021, 4:18pm UTC](https://discuss.elastic.co/t/unable-to-tesselate-shape-error-on-indexing-es-7-11-1/268356 "2021-03-26T16:18:33Z")
Dear all, I'm tring to save the following geometry MULTIPOLYGON(((177.59 59.9735,180 62.288856810085,180 63.763900213475,178.731 64.0348,177.44 64.2967,176.148 64.5406,174.809 64.7792,173.45 65.005,172.047 65.2202,170.… --- ## [Extract value from regex with parentheses in if condition](https://discuss.elastic.co/t/extract-value-from-regex-with-parentheses-in-if-condition/268190)
**Author:** [@Romanian\_Coder](https://discuss.elastic.co/u/Romanian_Coder)\ **Replies:** 8\ **Last updated:** [March 26, 2021, 4:14pm UTC](https://discuss.elastic.co/t/extract-value-from-regex-with-parentheses-in-if-condition/268190 "2021-03-26T16:14:24Z")
I have next input in logstash { logstash | "sourceRecordPosition" =\> 11, logstash | "rejectionReason" =\> "", logstash | "key" =\> 2251799813685255, logstash … --- ## [Filebeat Azure Activity Logs fail to index when field azure.activitylogs.identity.claims is string instead of json](https://discuss.elastic.co/t/filebeat-azure-activity-logs-fail-to-index-when-field-azure-activitylogs-identity-claims-is-string-instead-of-json/268516)
**Author:** [@tobias.berg](https://discuss.elastic.co/u/tobias.berg)\ **Replies:** 0\ **Last updated:** [March 26, 2021, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-azure-activity-logs-fail-to-index-when-field-azure-activitylogs-identity-claims-is-string-instead-of-json/268516 "2021-03-26T16:02:47Z")
Hi, We have noticed that sometimes, the Azure Activity logs contains serilaized json instead of pure json in the azure.activitylogs.identity field. Thus, these logs fail to index with a mapping parsing exception. We ha… --- ## [Painless scripted field - access query range](https://discuss.elastic.co/t/painless-scripted-field-access-query-range/268135)
**Author:** [@Nuno\_Centeio](https://discuss.elastic.co/u/Nuno_Centeio)\ **Replies:** 1\ **Last updated:** [March 26, 2021, 3:38pm UTC](https://discuss.elastic.co/t/painless-scripted-field-access-query-range/268135 "2021-03-26T15:38:03Z")
Hi, I'm new to Painless (and to Elasticsearch as well) and I'm building a query that looks like this: "script\_fields": { "PeriodTime": { "script": { "source": "doc\['@timestamp'\].value.millis - doc\['… --- ## [ElasticSearch install stuck](https://discuss.elastic.co/t/elasticsearch-install-stuck/268507)
**Author:** [@MertYavuz](https://discuss.elastic.co/u/MertYavuz)\ **Replies:** 4\ **Last updated:** [March 26, 2021, 3:26pm UTC](https://discuss.elastic.co/t/elasticsearch-install-stuck/268507 "2021-03-26T15:26:34Z")
Hello, I am trying to install elasticsearch 7.12 in windows 2016. It's been stuck for like an hour at somepoint: \[2021-03-26T15:55:23,770\]\[INFO \]\[o.e.p.PluginsService \] \[WIN-PP7D4702OPT\] loaded module \[x-pack-sec… --- ## [How to get the data from yesterday to today's date range](https://discuss.elastic.co/t/how-to-get-the-data-from-yesterday-to-todays-date-range/268493)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 4\ **Last updated:** [March 26, 2021, 3:23pm UTC](https://discuss.elastic.co/t/how-to-get-the-data-from-yesterday-to-todays-date-range/268493 "2021-03-26T15:23:59Z")
Hello Experts, I have tried to get the data between dates as below, but the exact date it is not giving.It is under UTC format. "range" : { "@timestamp" : { "gte": "now-1d/d ", … --- ## [Elasticsearch space character problem](https://discuss.elastic.co/t/elasticsearch-space-character-problem/268506)
**Author:** [@Celal\_Poyraz](https://discuss.elastic.co/u/Celal_Poyraz)\ **Replies:** 3\ **Last updated:** [March 26, 2021, 3:21pm UTC](https://discuss.elastic.co/t/elasticsearch-space-character-problem/268506 "2021-03-26T15:21:05Z")
I do elasticsearch indexing, but the first 2 characters after the space character do not search. For example, when I search for "John", the results come, but when I search for "John S", the result is not available. The n… --- ## [Data from SQL to Azure Data Lake Gen2](https://discuss.elastic.co/t/data-from-sql-to-azure-data-lake-gen2/268500)
**Author:** [@\_Louw](https://discuss.elastic.co/u/_Louw)\ **Replies:** 0\ **Last updated:** [March 26, 2021, 1:34pm UTC](https://discuss.elastic.co/t/data-from-sql-to-azure-data-lake-gen2/268500 "2021-03-26T13:34:34Z")
What I want to do: Input: Query from a SQL MariaDB Output: Put everything into an Azure Data Lake Gen2 What Azure wants in order to put a file on the data lake: A precise count of all characters in the input My pro… --- ## [Filebeat is not Seeing Log Traffic on Server](https://discuss.elastic.co/t/filebeat-is-not-seeing-log-traffic-on-server/268373)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 4\ **Last updated:** [March 26, 2021, 12:58pm UTC](https://discuss.elastic.co/t/filebeat-is-not-seeing-log-traffic-on-server/268373 "2021-03-26T12:58:29Z")
I am running into a strange issue with filebeat on one of our production transaction servers. Background: Filebeat on one of our production servers went down for some ‘unknown’ reason (still haven’t figured out why thi… --- ## [ECS template initial import](https://discuss.elastic.co/t/ecs-template-initial-import/268492)
**Author:** [@Til\_bardaga](https://discuss.elastic.co/u/Til_bardaga)\ **Replies:** 0\ **Last updated:** [March 26, 2021, 12:38pm UTC](https://discuss.elastic.co/t/ecs-template-initial-import/268492 "2021-03-26T12:38:37Z")
I am having trouble figuring out how to start using an ECS index template. I have read through a lot of the documentation and familiarized myself with the concepts of ECS. Now I want to test it in practice. The questi… --- ## [With arm64 now officially supported for beats, can we get arm64 beat containers on docker hub?](https://discuss.elastic.co/t/with-arm64-now-officially-supported-for-beats-can-we-get-arm64-beat-containers-on-docker-hub/268214)
**Author:** [@mloebl](https://discuss.elastic.co/u/mloebl)\ **Replies:** 3\ **Last updated:** [March 26, 2021, 12:35pm UTC](https://discuss.elastic.co/t/with-arm64-now-officially-supported-for-beats-can-we-get-arm64-beat-containers-on-docker-hub/268214 "2021-03-26T12:35:18Z")
Thank you for formally supporting arm64 for the beats! What at the odds of also getting the arm64 beats added to docker hub? Have some arm64 k8s clusters would like to monitor a bit easier. Thanks! --- ## [ES 6.x / 7.x freezes on index deletion/creation for a long time ONLY with big amount of deprecation warnings](https://discuss.elastic.co/t/es-6-x-7-x-freezes-on-index-deletion-creation-for-a-long-time-only-with-big-amount-of-deprecation-warnings/265516)
**Author:** [@Ivan\_Rabotyga](https://discuss.elastic.co/u/Ivan_Rabotyga)\ **Replies:** 9\ **Last updated:** [March 26, 2021, 12:13pm UTC](https://discuss.elastic.co/t/es-6-x-7-x-freezes-on-index-deletion-creation-for-a-long-time-only-with-big-amount-of-deprecation-warnings/265516 "2021-03-26T12:13:19Z")
Hello everyone :wave: ! I'm getting a mysterious case on the CI. ES freezes on an index deletion or creation for a long time, when I run application tests using ES 6.8.13 (same for 7.10.1) and the application is config… --- ## [Install Curator as a Zip file](https://discuss.elastic.co/t/install-curator-as-a-zip-file/268454)
**Author:** [@Darshan\_Kamat](https://discuss.elastic.co/u/Darshan_Kamat)\ **Replies:** 3\ **Last updated:** [March 26, 2021, 11:54am UTC](https://discuss.elastic.co/t/install-curator-as-a-zip-file/268454 "2021-03-26T11:54:09Z")
I cant install pip on my Linux server . Could some one please share zip package of curator just like its windows Version --- ## [Cluster "green" - but shards not in sync !? 😯](https://discuss.elastic.co/t/cluster-green-but-shards-not-in-sync/268344)
**Author:** [@some\_one](https://discuss.elastic.co/u/some_one)\ **Replies:** 9\ **Last updated:** [March 26, 2021, 11:40am UTC](https://discuss.elastic.co/t/cluster-green-but-shards-not-in-sync/268344 "2021-03-26T11:40:50Z")
Hello all, we have been using ES productively for quite some time now but today we came across a new problem that we have never seen before: We found two indices in our ES 6.8.14 cluster, each with one shard where prim… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1488) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1490)