# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1549 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1550 --- ## [How does sorting work under the hood?](https://discuss.elastic.co/t/how-does-sorting-work-under-the-hood/263999)
**Author:** [@Harald\_Bittermann](https://discuss.elastic.co/u/Harald_Bittermann)\ **Replies:** 2\ **Last updated:** [February 18, 2021, 3:34pm UTC](https://discuss.elastic.co/t/how-does-sorting-work-under-the-hood/263999 "2021-02-18T15:34:56Z")
Elasticsearch Version: 7.10 Before I start to take a deeper look at a bug report that just arrived my desk I wanted to know the following. When a sort criteria is applied, is it guaranteed that all documents are sorted… --- ## [Watcher error - null pointer exception](https://discuss.elastic.co/t/watcher-error-null-pointer-exception/262975)
**Author:** [@firstpostcommenter](https://discuss.elastic.co/u/firstpostcommenter)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 3:12pm UTC](https://discuss.elastic.co/t/watcher-error-null-pointer-exception/262975 "2021-02-18T15:12:34Z")
Hi, I seem to have similar problem mentioned in Problem execute watcher "Cannot invoke \\"Object.getClass()\\" because \\"callArgs\[0\]\\" is null" Sample JSON: "aggs": { "unique\_customerid": { … --- ## [Time elapsed difference between two events tagged as start and stop](https://discuss.elastic.co/t/time-elapsed-difference-between-two-events-tagged-as-start-and-stop/262588)
**Author:** [@satred](https://discuss.elastic.co/u/satred)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 3:08pm UTC](https://discuss.elastic.co/t/time-elapsed-difference-between-two-events-tagged-as-start-and-stop/262588 "2021-02-18T15:08:06Z")
I am trying to calculate the time duration difference between two events tagged as start and stop. From message using grok pattern created two filters process id and process type which are common in both the messages an… --- ## [Bucket the most 10 popular terms using a scripted field](https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 3:04pm UTC](https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369 "2021-02-18T15:04:37Z")
Hi there, I am a bit struggling getting this right. I have some log messages, What I need to do is to look for log.message, get the first 15 characters and display the most 10 popular messages. What I did so far is cr… --- ## [How change index name in Heartbeat](https://discuss.elastic.co/t/how-change-index-name-in-heartbeat/264630)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 10\ **Last updated:** [February 18, 2021, 2:36pm UTC](https://discuss.elastic.co/t/how-change-index-name-in-heartbeat/264630 "2021-02-18T14:36:25Z")
Hi there guys i need help with a problem i have in heartbeat.yml look what I need is to change the name of the index of heartbeat, ie mapping to index it in kibana with another name other than heartbeat-7-10-2-2021-000… --- ## [Elastic search s3 plugin and bucket name](https://discuss.elastic.co/t/elastic-search-s3-plugin-and-bucket-name/264716)
**Author:** [@Sergiodive](https://discuss.elastic.co/u/Sergiodive)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 2:35pm UTC](https://discuss.elastic.co/t/elastic-search-s3-plugin-and-bucket-name/264716 "2021-02-18T14:35:19Z")
Hello May I please get some clarification on my observations regarding the S3 plugin and bucket names? I have observed with Elasticsearch 7.10.2 and the s3 plugin that if i don't provide the bucket name in all caps th… --- ## [Kibana with ingress getting ERR\_TOO\_MANY\_REDIRECTS 302](https://discuss.elastic.co/t/kibana-with-ingress-getting-err-too-many-redirects-302/264448)
**Author:** [@rubans](https://discuss.elastic.co/u/rubans)\ **Replies:** 7\ **Last updated:** [February 18, 2021, 2:30pm UTC](https://discuss.elastic.co/t/kibana-with-ingress-getting-err-too-many-redirects-302/264448 "2021-02-18T14:30:37Z")
When I try and expose the Kibana UI externally using ingress, getting ERR\_TOO\_MANY\_REDIRECTS 302 using https. Kibana v 7.8.1 Seems to get into an infinite loop. Works without any issues with port-forward on http://loc… --- ## [Calculate percentage of fileds in aggregate](https://discuss.elastic.co/t/calculate-percentage-of-fileds-in-aggregate/264713)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 2:14pm UTC](https://discuss.elastic.co/t/calculate-percentage-of-fileds-in-aggregate/264713 "2021-02-18T14:14:30Z")
Hi all and sorry for my poor english I need to calculate percentage of usageTime per services in a json like that { "myID": "-1819947444", "accountUuid": "account-1", "serviceName": "Dazn299", "usageTime": … --- ## [Error building transform on the destination index of previous transform](https://discuss.elastic.co/t/error-building-transform-on-the-destination-index-of-previous-transform/264338)
**Author:** [@Jeff\_Bolle](https://discuss.elastic.co/u/Jeff_Bolle)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 1:41pm UTC](https://discuss.elastic.co/t/error-building-transform-on-the-destination-index-of-previous-transform/264338 "2021-02-18T13:41:42Z")
We are running elasticsearch 7.6.1 on linux nodes. Our cluster is about 50 nodes. I have 3 indexes which hold the results of dataframe transforms that aggregate some details on IP addresses across 2 different source ind… --- ## [Kibana - APM UI - JVMs - Listing (Empty) JVM](https://discuss.elastic.co/t/kibana-apm-ui-jvms-listing-empty-jvm/264618)
**Author:** [@chandra2037](https://discuss.elastic.co/u/chandra2037)\ **Replies:** 4\ **Last updated:** [February 18, 2021, 1:35pm UTC](https://discuss.elastic.co/t/kibana-apm-ui-jvms-listing-empty-jvm/264618 "2021-02-18T13:35:14Z")
Hi, Elasticsearch - v7.10.1 Kibana - V7.10.1 APM Server - V7.10.1 APM Java agent - V1.20.0 Recently upgraded to Elastic stack to 7.10.1. In Kibana APM JVM UI, apart from the actual JVM there is an (Empty) JVM is sh… --- ## [Changes are not reflecting on the browser - (Kibana 7.10- Customization)](https://discuss.elastic.co/t/changes-are-not-reflecting-on-the-browser-kibana-7-10-customization/264504)
**Author:** [@Akhil\_Kaithoju](https://discuss.elastic.co/u/Akhil_Kaithoju)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 12:45pm UTC](https://discuss.elastic.co/t/changes-are-not-reflecting-on-the-browser-kibana-7-10-customization/264504 "2021-02-18T12:45:24Z")
Hi, When i make any changes in kibana 7.10.1 build those changes are not reflecting on the browser. Earlier in 7.6 i was able to make it successfully by removing the /optimize/bundles. Now it has been deprecated in Kiba… --- ## [Can Kibana mutate documents?](https://discuss.elastic.co/t/can-kibana-mutate-documents/264580)
**Author:** [@trympet](https://discuss.elastic.co/u/trympet)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 11:39am UTC](https://discuss.elastic.co/t/can-kibana-mutate-documents/264580 "2021-02-18T11:39:56Z")
I am building a dashboard to track and correlate exceptions and events in a desktop application. Previously, I was using Visual Studio App Center, but since they enforce limits on the number of events per day, I switched… --- ## [Metric Beats installation 408 Error Import File](https://discuss.elastic.co/t/metric-beats-installation-408-error-import-file/264601)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 11:38am UTC](https://discuss.elastic.co/t/metric-beats-installation-408-error-import-file/264601 "2021-02-18T11:38:57Z")
I am attempting to install the Metric Beats V 7.10.2 (I have also tried 7.11.0 aswell) module against my Elastic Cloud instance. I have followed the guide for installing: However I am getting an error message as follo… --- ## [Elastic licence isn't sticky](https://discuss.elastic.co/t/elastic-licence-isnt-sticky/264677)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 11:29am UTC](https://discuss.elastic.co/t/elastic-licence-isnt-sticky/264677 "2021-02-18T11:29:40Z")
I have the ELK stack installed in Kubernetes. I find that the license has to be updated on a daily basis, otherwise I get: {"statusCode":403,"error":"Forbidden","message":"Your basic license does not support PDF Report… --- ## [Use rally to compare existing clusters - document a way to run 'short' tests](https://discuss.elastic.co/t/use-rally-to-compare-existing-clusters-document-a-way-to-run-short-tests/264452)
**Author:** [@arthurlogilab](https://discuss.elastic.co/u/arthurlogilab)\ **Replies:** 2\ **Last updated:** [February 18, 2021, 11:17am UTC](https://discuss.elastic.co/t/use-rally-to-compare-existing-clusters-document-a-way-to-run-short-tests/264452 "2021-02-18T11:17:18Z")
I'm a bit new to rally and have been recently trying it out. My goal is to start comparing the performance of two elasticsearch clusters I have access to (classic "old one", new "on kubernetes one"). I was hoping to have… --- ## [Fargate with logstash container consume iam role](https://discuss.elastic.co/t/fargate-with-logstash-container-consume-iam-role/264671)
**Author:** [@J\_Kit](https://discuss.elastic.co/u/J_Kit)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 9:29am UTC](https://discuss.elastic.co/t/fargate-with-logstash-container-consume-iam-role/264671 "2021-02-18T09:29:56Z")
Hi I tried to set up logstash in AWS ECS fargate and the logstash will read from the s3 bucket. I configuring logstash input s3 with access\_key\_id =\> ''" secret\_access\_key =\> ''" and able to read s3 files successfully. … --- ## [GenerateCustomBeats hangs](https://discuss.elastic.co/t/generatecustombeats-hangs/264682)
**Author:** [@Dev-Flo](https://discuss.elastic.co/u/Dev-Flo)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 10:12am UTC](https://discuss.elastic.co/t/generatecustombeats-hangs/264682 "2021-02-18T10:12:43Z")
Hi all, I'm attempting to create a new custom beat but get stuck when using the mage GenerateCustomBeat command. Enter the beat name \[examplebeat\]: examplebeat Enter your github name \[your-github-name\]: Enter the beat … --- ## [Central pipeline management - beats strategy](https://discuss.elastic.co/t/central-pipeline-management-beats-strategy/264680)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 10:06am UTC](https://discuss.elastic.co/t/central-pipeline-management-beats-strategy/264680 "2021-02-18T10:06:18Z")
Hi Everybody, we'd like to have some strategy for logstash and beats and we're using centralized pipeline management. Rather we'd like to use it :slight\_smile: The idea is to not configure anything on logstash but only… --- ## [Logstash stuck in \[2021-02-17T12:32:52,208\]\[DEBUG\]\[org.logstash.execution.PeriodicFlush\]\[main\] Pushing flush onto pipeline](https://discuss.elastic.co/t/logstash-stuck-in-2021-02-17t1252-208-debug-org-logstash-execution-periodicflush-main-pushing-flush-onto-pipeline/264559)
**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 9:20am UTC](https://discuss.elastic.co/t/logstash-stuck-in-2021-02-17t1252-208-debug-org-logstash-execution-periodicflush-main-pushing-flush-onto-pipeline/264559 "2021-02-18T09:20:59Z")
i see this message in logs of logstash \[2021-02-17T12:27:27,747\]\[DEBUG\]\[io.netty.util.internal.PlatformDependent0\]\[main\]\[f24f5a6935ca56387219d3b2bfdc6097466486c907605f8a15f69f812d2d4269\] direct buffer constructor: unava… --- ## [Unable to sends data to AWS MSK, Error Message: Kafka publish failed with: circuit breaker is open](https://discuss.elastic.co/t/unable-to-sends-data-to-aws-msk-error-message-kafka-publish-failed-with-circuit-breaker-is-open/263785)
**Author:** [@saroja](https://discuss.elastic.co/u/saroja)\ **Replies:** 3\ **Last updated:** [February 17, 2021, 3:50pm UTC](https://discuss.elastic.co/t/unable-to-sends-data-to-aws-msk-error-message-kafka-publish-failed-with-circuit-breaker-is-open/263785 "2021-02-17T15:50:00Z")
Hello, I have configured a pipeline, that will read the application logs and sends the log messages to individual kafka topic. I have installed filebeat -7.10.0 and configured AWS msk -2.2.1. After starting the filebe… --- ## [About build information we get when running curl request to elasticsearch service](https://discuss.elastic.co/t/about-build-information-we-get-when-running-curl-request-to-elasticsearch-service/264562)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 5\ **Last updated:** [February 18, 2021, 7:15am UTC](https://discuss.elastic.co/t/about-build-information-we-get-when-running-curl-request-to-elasticsearch-service/264562 "2021-02-18T07:15:37Z")
I ran curl request to elasticsearch service and I got information related to build as follow: "build\_hash" : "757314695655ea9a1dc2fecd26d1a43856725e65", "build\_date" : "2020-06-14T19:35:50.234439Z", "build\_snapshot" :… --- ## [Logstash Jdbc Metadata path not creating](https://discuss.elastic.co/t/logstash-jdbc-metadata-path-not-creating/264652)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 6:41am UTC](https://discuss.elastic.co/t/logstash-jdbc-metadata-path-not-creating/264652 "2021-02-18T06:41:11Z")
Hi, I have a database and using jdbc plugin to fetch data from it. I have used sql last value and given metadata path it was getting created at first. I deleted and tried to create again but not creating since then. I m… --- ## [Filters](https://discuss.elastic.co/t/filters/264644)
**Author:** [@Anu6006](https://discuss.elastic.co/u/Anu6006)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 5:12am UTC](https://discuss.elastic.co/t/filters/264644 "2021-02-18T05:12:18Z")
Hi Team, In logstash the filters are not working. The data is coming from azure blob storage. filter { split { field =\> "\[records\]" } split { field =\> "\[records\]\[properties\]\[flows\]" } split { fiel… --- ## [Hardware recommendation about ES to avoid "Data too large"](https://discuss.elastic.co/t/hardware-recommendation-about-es-to-avoid-data-too-large/264643)
**Author:** [@jmliu1983](https://discuss.elastic.co/u/jmliu1983)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 4:01am UTC](https://discuss.elastic.co/t/hardware-recommendation-about-es-to-avoid-data-too-large/264643 "2021-02-18T04:01:08Z")
I'm using ES in a machine which has 12G physical memory, when running lower size of data, everything is OK. But as long as the data size and document counts increasing, circuit breaker happens more and more frequently. … --- ## [Elasticsearch Topology Design](https://discuss.elastic.co/t/elasticsearch-topology-design/264638)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 4\ **Last updated:** [February 18, 2021, 3:59am UTC](https://discuss.elastic.co/t/elasticsearch-topology-design/264638 "2021-02-18T03:59:50Z")
Hello Elasticsearch big-brain experts, I have been testing out Elasticsearch as a log vaulting, auditing tool, and SEIM for the last few months and my company has authorized the purchase of hardware to build a cluster. … --- ## [Empty server certificate chain does anybody know what to do i'm new to elastic? repeatedly getting these errors](https://discuss.elastic.co/t/empty-server-certificate-chain-does-anybody-know-what-to-do-im-new-to-elastic-repeatedly-getting-these-errors/264537)
**Author:** [@Jerin\_Joy](https://discuss.elastic.co/u/Jerin_Joy)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 2:56am UTC](https://discuss.elastic.co/t/empty-server-certificate-chain-does-anybody-know-what-to-do-im-new-to-elastic-repeatedly-getting-these-errors/264537 "2021-02-18T02:56:47Z")
"stacktrace": \["io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chain", "at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471) ~\[… --- ## [Best visualization for showing single image from url formatted field?](https://discuss.elastic.co/t/best-visualization-for-showing-single-image-from-url-formatted-field/264502)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 2:40am UTC](https://discuss.elastic.co/t/best-visualization-for-showing-single-image-from-url-formatted-field/264502 "2021-02-18T02:40:28Z")
Hi, I'm using a scripted field formatted as a url to display some images. This works surprisingly well except outside of discovery the only visualization I seem to be able to use with this field is the table visualizati… --- ## [Filebeat - 7.10.2 - Flooding Syslog with CIFS Errors](https://discuss.elastic.co/t/filebeat-7-10-2-flooding-syslog-with-cifs-errors/263587)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 2:27am UTC](https://discuss.elastic.co/t/filebeat-7-10-2-flooding-syslog-with-cifs-errors/263587 "2021-02-18T02:27:19Z")
Previously I was running Filebeat 7.5 on Ubuntu 18.04. I have installed Filebeat 7.10.2 on Ubuntu 20, and now my syslog is flooded with this message while filebeat is running: CIFS VFS: Close unmatched open The config… --- ## [Working with wildcards](https://discuss.elastic.co/t/working-with-wildcards/264583)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 2:15am UTC](https://discuss.elastic.co/t/working-with-wildcards/264583 "2021-02-18T02:15:13Z")
Hello, When i search in kibana with the following expression: message: ".pdf' to SFTP rejected folder (/in/ORDERS/.rejected)" I get successfully the results that i want (see image 1) image 1 But, when i search in… --- ## [Filebeat Cisco Umbrella Fileset](https://discuss.elastic.co/t/filebeat-cisco-umbrella-fileset/262731)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 1:36am UTC](https://discuss.elastic.co/t/filebeat-cisco-umbrella-fileset/262731 "2021-02-18T01:36:05Z")
Hi. I'm trying to set up the Filebeat Cisco module with the Umbrella fileset. I understand that they do not yet support Cisco managed S3 instances but I see that you can set the input to be file. I can't find anything ab… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1548) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1550)