# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1543 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1544 --- ## [TIme series Visual builder : How to do Math calculations betweent the output of two series?](https://discuss.elastic.co/t/time-series-visual-builder-how-to-do-math-calculations-betweent-the-output-of-two-series/264414)
**Author:** [@Harpreet\_Singh](https://discuss.elastic.co/u/Harpreet_Singh)\ **Replies:** 9\ **Last updated:** [February 22, 2021, 11:14am UTC](https://discuss.elastic.co/t/time-series-visual-builder-how-to-do-math-calculations-betweent-the-output-of-two-series/264414 "2021-02-22T11:14:46Z")
Hi Team, I am using Time series visual builder: Top N Chart, i am in a scenario where i am doing Math calculation in 5 different series. See below Screenshot: Pic 1: Final Chart Pic 2: Different time series i have cho… --- ## [Can Logstash accepts GraphQL data and convert into json?](https://discuss.elastic.co/t/can-logstash-accepts-graphql-data-and-convert-into-json/265055)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 11:00am UTC](https://discuss.elastic.co/t/can-logstash-accepts-graphql-data-and-convert-into-json/265055 "2021-02-22T11:00:48Z")
I have one endpoint giving data in GarphQL, is it possible to add a codec filter to parse data from GraphQL to JSON ? or is there any way I can covert GraphQL data to Elasticsearch readable format? --- ## [Count of unique events](https://discuss.elastic.co/t/count-of-unique-events/265037)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 10:51am UTC](https://discuss.elastic.co/t/count-of-unique-events/265037 "2021-02-22T10:51:08Z")
I have 5000 unique events. If I try to unique count with default precision value, I get the wrong value: How can I calculate truly unique values without changing the precision? --- ## [How to filter date field by days and hours separately](https://discuss.elastic.co/t/how-to-filter-date-field-by-days-and-hours-separately/265046)
**Author:** [@Hi\_u\_Nguy\_n\_Dang](https://discuss.elastic.co/u/Hi_u_Nguy_n_Dang)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-to-filter-date-field-by-days-and-hours-separately/265046 "2021-02-22T10:40:58Z")
Hi, I want to create a query that returns all the data from last 30 days and only between 09:00 AM - 18:00 PM. My date field contains both the date and the time of the day (For example "time" : "2021-02-06T06:40:55Z"). … --- ## [Windows Events with evtx](https://discuss.elastic.co/t/windows-events-with-evtx/264565)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 10:28am UTC](https://discuss.elastic.co/t/windows-events-with-evtx/264565 "2021-02-22T10:28:47Z")
Hello. I am trying to setup an PoC with Ingesting Windows Evenst to Elastic. Because of company policies I can´t install Winlogbeat in any host, but the host where I have installed Elasticstack I have access to install a… --- ## [Can't merge a non object mapping with an object mapping](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-with-an-object-mapping/264066)
**Author:** [@Infoxd](https://discuss.elastic.co/u/Infoxd)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 10:25am UTC](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-with-an-object-mapping/264066 "2021-02-22T10:25:43Z")
Hello, When I'm trying to import this json: { "data": { "args": \["v7.0/4529900134935424/feed", { "limit": 100 }\] }, "@timestamp": "2021-02-11T11:07:02.189Z", "@version": "1" } I'm getting this error: can't… --- ## [Accessing field values in script processor](https://discuss.elastic.co/t/accessing-field-values-in-script-processor/265048)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 9:38am UTC](https://discuss.elastic.co/t/accessing-field-values-in-script-processor/265048 "2021-02-22T09:38:32Z")
Hi, I'm studding for the ECE and when reading about script processors to be used in ingestion pipelines I see in the documentation that in order to access the field value I should use the ctx variables You can access th… --- ## [Indices won't close](https://discuss.elastic.co/t/indices-wont-close/262254)
**Author:** [@JuddyBuddy77](https://discuss.elastic.co/u/JuddyBuddy77)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 9:33am UTC](https://discuss.elastic.co/t/indices-wont-close/262254 "2021-02-22T09:33:48Z")
Hello, first post, still learning. Having an issue closing "random" indices, after removing replica shards and using shard allocation awareness. ES 6.8.3, although indices may have been created in ES 5 (I know). Remov… --- ## [Elasticsearch seach using wildcard, range and terms](https://discuss.elastic.co/t/elasticsearch-seach-using-wildcard-range-and-terms/264811)
**Author:** [@lalitesh](https://discuss.elastic.co/u/lalitesh)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 9:28am UTC](https://discuss.elastic.co/t/elasticsearch-seach-using-wildcard-range-and-terms/264811 "2021-02-22T09:28:15Z")
I am trying to write a search DSL query on a Elasticsearch ( Version 7.1 ) index that has fields like, product\_name, exported\_at and category\_id. From the document I understand that I would need to use the wildcard, ran… --- ## [Way aren't Event details under security using the same query as you put in Elasticsearch indices](https://discuss.elastic.co/t/way-arent-event-details-under-security-using-the-same-query-as-you-put-in-elasticsearch-indices/265044)
**Author:** [@tellus83](https://discuss.elastic.co/u/tellus83)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 9:04am UTC](https://discuss.elastic.co/t/way-arent-event-details-under-security-using-the-same-query-as-you-put-in-elasticsearch-indices/265044 "2021-02-22T09:04:01Z")
I have a soc-filebeat alias whit filter on filebeat-7.11.1-\* and use soc-\* for Elasticsearch indices in settings. And have created a user that have full access to soc-. All dashboards are OK under Security network and … --- ## [Logstash input plugin jdbc schedule issue on k8s](https://discuss.elastic.co/t/logstash-input-plugin-jdbc-schedule-issue-on-k8s/263535)
**Author:** [@Dongsheng\_XI](https://discuss.elastic.co/u/Dongsheng_XI)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 9:01am UTC](https://discuss.elastic.co/t/logstash-input-plugin-jdbc-schedule-issue-on-k8s/263535 "2021-02-22T09:01:14Z")
our team is using logstash to sync data between MySQL and ElasticSearch, I am following How to keep Elasticsearch synchronized with a relational database using Logstash and JDBC to set up my pipeline. when the logstash i… --- ## [Metricbeat DNS error in kubernetes Cluster](https://discuss.elastic.co/t/metricbeat-dns-error-in-kubernetes-cluster/263303)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 8\ **Last updated:** [February 22, 2021, 8:47am UTC](https://discuss.elastic.co/t/metricbeat-dns-error-in-kubernetes-cluster/263303 "2021-02-22T08:47:37Z")
I have installed metric beat using helm chart and I am getting following DNS error. 2021-02-04T21:27:38.074Z WARN \[transport\] transport/tcp.go:52 DNS lookup failure "k8s-rke-cluster1-node2": lookup k8s-rke-cluster1-node… --- ## [Filebeat 2 log sources](https://discuss.elastic.co/t/filebeat-2-log-sources/264827)
**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 8:40am UTC](https://discuss.elastic.co/t/filebeat-2-log-sources/264827 "2021-02-22T08:40:11Z")
Hi, i'm currently working with Filebeat and i would like to know if there is a way Filebeat gets logs from 1 remote Windows server then if the the server is down it will get logs automatically from a different server. I … --- ## [Aggregation bucket sum + max group by time with filtering](https://discuss.elastic.co/t/aggregation-bucket-sum-max-group-by-time-with-filtering/264718)
**Author:** [@Tim4](https://discuss.elastic.co/u/Tim4)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 8:14am UTC](https://discuss.elastic.co/t/aggregation-bucket-sum-max-group-by-time-with-filtering/264718 "2021-02-22T08:14:23Z")
Hi, I'm in need of some help. Let's start of with some sample data: Datetime \_\_\_\_\_\_\_\_\_\_\_\_| User | Mbps 18/02/2021 12:00:00 | a \_\_\_ | 10 18/02/2021 12:00:00 | b \_\_\_ | 5 18/02/2021 12:20:00 | a … --- ## [Elasticsearch bulk operation: insert if not existing, otherwise update or add a nested element](https://discuss.elastic.co/t/elasticsearch-bulk-operation-insert-if-not-existing-otherwise-update-or-add-a-nested-element/265034)
**Author:** [@corlee](https://discuss.elastic.co/u/corlee)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 7:50am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-operation-insert-if-not-existing-otherwise-update-or-add-a-nested-element/265034 "2021-02-22T07:50:24Z")
In elasticsearch 7.11.0 I have products as described. { "\_index" : "products", "\_type" : "\_doc", "\_id" : "1234567890123", "\_source" : { "ean" : "1234567890123", "title" : "Very nice product", "mercha… --- ## [JSON file input to Filebeat sending data to Logstash and then to Azure Data Explorer](https://discuss.elastic.co/t/json-file-input-to-filebeat-sending-data-to-logstash-and-then-to-azure-data-explorer/264800)
**Author:** [@omkarg81](https://discuss.elastic.co/u/omkarg81)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 7:39am UTC](https://discuss.elastic.co/t/json-file-input-to-filebeat-sending-data-to-logstash-and-then-to-azure-data-explorer/264800 "2021-02-22T07:39:39Z")
I'm trying to send a single line JSON input file to Filebeat which should read and send in the data over to Logstash which should then forward or dump it to Azure Data Explorer cluster-table. Somehow, when the Filebeat … --- ## [Create search request from available json unit test](https://discuss.elastic.co/t/create-search-request-from-available-json-unit-test/264952)
**Author:** [@Rohit\_Sharma](https://discuss.elastic.co/u/Rohit_Sharma)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 6:58am UTC](https://discuss.elastic.co/t/create-search-request-from-available-json-unit-test/264952 "2021-02-22T06:58:27Z")
Hi, I'm new to elastic search. I need to write unit test where I need to create search request object and search response object. I have search response and search request available in JSON. My search request contain… --- ## [Is Xpack related to "master\_not\_discovered\_exception"? 503](https://discuss.elastic.co/t/is-xpack-related-to-master-not-discovered-exception-503/264539)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 6:48am UTC](https://discuss.elastic.co/t/is-xpack-related-to-master-not-discovered-exception-503/264539 "2021-02-22T06:48:01Z")
Hello everyone! I have a single-node cluster running which I have enabled the Xpack security on. I'd like to add a node to this cluster, but I get "master\_not\_discovered\_exception". I have set the discovery.seed\_hosts as… --- ## [Foreign "fields" in JSON document in Kibana Discover](https://discuss.elastic.co/t/foreign-fields-in-json-document-in-kibana-discover/265024)
**Author:** [@thesn](https://discuss.elastic.co/u/thesn)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 6:44am UTC](https://discuss.elastic.co/t/foreign-fields-in-json-document-in-kibana-discover/265024 "2021-02-22T06:44:46Z")
Hi, my setup: .log file --\> filebeat --\> logstash --\> elasticsearch \<-- kibana sample of .log file content: { "@timestamp":"2021-02-22T09:40:32.533+07:00", "@version":"1", "message":"mappingReloadDTreeEr… --- ## [\[Heartbeat\]: add retry logic into http/tcp check](https://discuss.elastic.co/t/heartbeat-add-retry-logic-into-http-tcp-check/264328)
**Author:** [@lowry](https://discuss.elastic.co/u/lowry)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 6:25am UTC](https://discuss.elastic.co/t/heartbeat-add-retry-logic-into-http-tcp-check/264328 "2021-02-22T06:25:51Z")
Hello Beats friends, Wondering if current heartbeat supports retry in http/tcp check? Current Heartbeat ails me since looks like there's no retry logic in http/tcp check. As far as I can find, only icmp support retry … --- ## [Kibana to access data from multiple Elastic Search Clusters](https://discuss.elastic.co/t/kibana-to-access-data-from-multiple-elastic-search-clusters/265027)
**Author:** [@Sudarshan\_Reddy](https://discuss.elastic.co/u/Sudarshan_Reddy)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 5:28am UTC](https://discuss.elastic.co/t/kibana-to-access-data-from-multiple-elastic-search-clusters/265027 "2021-02-22T05:28:41Z")
Hi, we are building dashboard for test results . Same test cases execute in multiple k8s clusters ( we organized as devus1, qaus1, produs1,prodeu1 ,prodanz1 ) . each environment we have seperate elastic search instance r… --- ## [java.net.SocketTimeoutException: 30,000 milliseconds timeout on connection http-outgoing-12](https://discuss.elastic.co/t/java-net-sockettimeoutexception-30-000-milliseconds-timeout-on-connection-http-outgoing-12/264657)
**Author:** [@vands](https://discuss.elastic.co/u/vands)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 7:58am UTC](https://discuss.elastic.co/t/java-net-sockettimeoutexception-30-000-milliseconds-timeout-on-connection-http-outgoing-12/264657 "2021-02-18T07:58:17Z")
Hi All, Facing the below issue while fetching bulk records using high level rest client builder . java.net.SocketTimeoutException: 30,000 milliseconds timeout on connection http-outgoing-12 . Do I need to change any c… --- ## [How to enable shards allocation of node that was disabled the shards allocation](https://discuss.elastic.co/t/how-to-enable-shards-allocation-of-node-that-was-disabled-the-shards-allocation/264790)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 5:23am UTC](https://discuss.elastic.co/t/how-to-enable-shards-allocation-of-node-that-was-disabled-the-shards-allocation/264790 "2021-02-22T05:23:03Z")
I disabled shards allocation using curl -XPUT “http://username:password@host:port/\_cluster/settings” -d '{ "transient" :{ "cluster.routing.allocation.exclude.\_ip" : "X.X.X.X" } }' command. Then again enabled usin… --- ## [Can it be supported to be configured by user that dropping @timestamp and @metadata fields of filebeat event before sent to kafka?](https://discuss.elastic.co/t/can-it-be-supported-to-be-configured-by-user-that-dropping-timestamp-and-metadata-fields-of-filebeat-event-before-sent-to-kafka/264849)
**Author:** [@mover](https://discuss.elastic.co/u/mover)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 5:17am UTC](https://discuss.elastic.co/t/can-it-be-supported-to-be-configured-by-user-that-dropping-timestamp-and-metadata-fields-of-filebeat-event-before-sent-to-kafka/264849 "2021-02-22T05:17:37Z")
currently, the @timestamp and @metadata fields of filebeat event can not be dropped before sending to kafka. why? dropping or retainning these fields before sent to kafka can be controlled by user? --- ## [Reduce metricbeat storage data](https://discuss.elastic.co/t/reduce-metricbeat-storage-data/262125)
**Author:** [@tvander](https://discuss.elastic.co/u/tvander)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 5:02am UTC](https://discuss.elastic.co/t/reduce-metricbeat-storage-data/262125 "2021-02-22T05:02:05Z")
Hi, I'm collecting 2 days of metricbeat data on my servers, its 20go per day, i let the default configuration and i need it this way to get precise real time information, But i also want to get information on my last 6… --- ## [How i can store field in kibana](https://discuss.elastic.co/t/how-i-can-store-field-in-kibana/263950)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 4:41am UTC](https://discuss.elastic.co/t/how-i-can-store-field-in-kibana/263950 "2021-02-22T04:41:51Z")
How i can store field in kibana? --- ## [Metricbeat on 200 PCs](https://discuss.elastic.co/t/metricbeat-on-200-pcs/265025)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 4:32am UTC](https://discuss.elastic.co/t/metricbeat-on-200-pcs/265025 "2021-02-22T04:32:25Z")
With default settings (like sending data every 10s), 200 PCs with Metricbeat, how much data is going to be sent and how many GBs per day do you think will be collected? Will my network traffic become slow since a lot of … --- ## [Exiting: 1 error: error loading config file: invalid config: yaml: line 91: did not find expected '-' indicator](https://discuss.elastic.co/t/exiting-1-error-error-loading-config-file-invalid-config-yaml-line-91-did-not-find-expected-indicator/264996)
**Author:** [@Wahyu\_Nugroho](https://discuss.elastic.co/u/Wahyu_Nugroho)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:30am UTC](https://discuss.elastic.co/t/exiting-1-error-error-loading-config-file-invalid-config-yaml-line-91-did-not-find-expected-indicator/264996 "2021-02-22T04:30:33Z")
Please help me. This is my filebeat.yml : ###################### Filebeat Configuration Example ######################### # This file is an example configuration file highlighting only the most common # options. The… --- ## [Elastic node not connecting to master](https://discuss.elastic.co/t/elastic-node-not-connecting-to-master/265026)
**Author:** [@jelbatn](https://discuss.elastic.co/u/jelbatn)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:26am UTC](https://discuss.elastic.co/t/elastic-node-not-connecting-to-master/265026 "2021-02-22T04:26:08Z")
I have the following configuration for a multi node elastic cluster. both nodes are running part of a docker swarm. here is the docker yaml config elasticsearch: image: {imagerepo}/elasticsearch:0.0.7-6892bb5 … --- ## [Increase size limit - Python ElasticSearch](https://discuss.elastic.co/t/increase-size-limit-python-elasticsearch/264830)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 7\ **Last updated:** [February 22, 2021, 4:02am UTC](https://discuss.elastic.co/t/increase-size-limit-python-elasticsearch/264830 "2021-02-22T04:02:16Z")
Hi, I'm currently writing a python script to extract out my elasticsearch documents and the following are my ES parameters that involves the sizing response = es.search(index= es\_index\_list,scroll='5m', size='10000', b… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1542) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1544)