# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1552 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1553 --- ## [Unable to find source.geo.location in index pattern logstash-\*](https://discuss.elastic.co/t/unable-to-find-source-geo-location-in-index-pattern-logstash/264496)
**Author:** [@Ronnie\_Raraihuru](https://discuss.elastic.co/u/Ronnie_Raraihuru)\ **Replies:** 4\ **Last updated:** [February 17, 2021, 1:53am UTC](https://discuss.elastic.co/t/unable-to-find-source-geo-location-in-index-pattern-logstash/264496 "2021-02-17T01:53:42Z")
Got the above error when trying to view map under Security\>Network in Elastic. Index mapping "mappings" : { "geoip" : { "dynamic" : "true", "properties" : { "city\_name" : { … --- ## [ILM Shrink - All primary on same node fails](https://discuss.elastic.co/t/ilm-shrink-all-primary-on-same-node-fails/264309)
**Author:** [@cwiechmann](https://discuss.elastic.co/u/cwiechmann)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 12:38am UTC](https://discuss.elastic.co/t/ilm-shrink-all-primary-on-same-node-fails/264309 "2021-02-17T00:38:17Z")
Hi All, I'm using ILM-Policies in order to automate the Index-Lifecycle. As part of the Warm-Phase indices should be shrinked. I'm currently running into the following problem reported by: GET /\_cluster/allocation/expl… --- ## [Match multiple 4 digit numbers in field](https://discuss.elastic.co/t/match-multiple-4-digit-numbers-in-field/264494)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 12:28am UTC](https://discuss.elastic.co/t/match-multiple-4-digit-numbers-in-field/264494 "2021-02-17T00:28:35Z")
I need to match only 4 digit number from field "created:". If there are multiple 4 digit numbers I need to take the biggest and save it back to the field. The problem is that the field can contain strings, dashes, dots, … --- ## [How can I do a full backup?](https://discuss.elastic.co/t/how-can-i-do-a-full-backup/264486)
**Author:** [@Solknaar](https://discuss.elastic.co/u/Solknaar)\ **Replies:** 6\ **Last updated:** [February 16, 2021, 11:31pm UTC](https://discuss.elastic.co/t/how-can-i-do-a-full-backup/264486 "2021-02-16T23:31:00Z")
Hi everyone !!! I use Elasticsearch 7.9.2, with Kibana and Beats, (lucene\_version = 8.6.2) in a Linux server (Red Hat Enterprise Linux Server 7.4), with a single node. I got help to make a full backup, but, if possible… --- ## [Python3 + elasticsearch\_dsl good resources/examples simple query problem](https://discuss.elastic.co/t/python3-elasticsearch-dsl-good-resources-examples-simple-query-problem/264199)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 10:57pm UTC](https://discuss.elastic.co/t/python3-elasticsearch-dsl-good-resources-examples-simple-query-problem/264199 "2021-02-16T22:57:21Z")
i'm fighting to get over the hump of gaining competence with elasticsearch\_dsl for python. i'm trying to do my end of the year (2020) reports.. and i have a set of indexes that total about 3/4 of a billion records. i ne… --- ## [Unable to see any data in Consumer Partition Reassignments visualization for \[Metricbeat Kafka\] dashboard in kibana](https://discuss.elastic.co/t/unable-to-see-any-data-in-consumer-partition-reassignments-visualization-for-metricbeat-kafka-dashboard-in-kibana/264489)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 10:30pm UTC](https://discuss.elastic.co/t/unable-to-see-any-data-in-consumer-partition-reassignments-visualization-for-metricbeat-kafka-dashboard-in-kibana/264489 "2021-02-16T22:30:02Z")
I am unable to see any data in the Consumer Partition Reassignments visualization in \[Metricbeat Kafka\] dashboard in kibana. My configuration for the kafka module that I have written in metricbeat.yml is given below: - … --- ## [Elasticsearch Alerting Watcher count mismatch](https://discuss.elastic.co/t/elasticsearch-alerting-watcher-count-mismatch/264417)
**Author:** [@srajus](https://discuss.elastic.co/u/srajus)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 10:00pm UTC](https://discuss.elastic.co/t/elasticsearch-alerting-watcher-count-mismatch/264417 "2021-02-16T22:00:26Z")
Hi I am setting up watcher alerts with multi match criteria .I am getting more than 2400+ count but when use the same multi filter criteria in the discover log section i am getting 113 count. not sure where exactly i a… --- ## [Post incorrectly closed](https://discuss.elastic.co/t/post-incorrectly-closed/264465)
**Author:** [@strophy](https://discuss.elastic.co/u/strophy)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 6:38pm UTC](https://discuss.elastic.co/t/post-incorrectly-closed/264465 "2021-02-16T18:38:37Z")
@Mario\_Castro closed my post regarding an unmerged PR to release Elastic Beats 7.11.0 on Ansible Galaxy, since the general release was on February 10, 2021. From his comment, he seems to think this is my PR. It's not my … --- ## [Security scans report version of Jackson-dataformat-cobr 2.10.4](https://discuss.elastic.co/t/security-scans-report-version-of-jackson-dataformat-cobr-2-10-4/264439)
**Author:** [@avifmontier](https://discuss.elastic.co/u/avifmontier)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 9:46pm UTC](https://discuss.elastic.co/t/security-scans-report-version-of-jackson-dataformat-cobr-2-10-4/264439 "2021-02-16T21:46:02Z")
Jackson-dataformat-cobr 2.10.4 used by elasticsearch-x-content 7.9.x seems to have security issues: CVE-2020-28491 CVE-2020-25649 Those issue seems to be fixed in later version of Jackson. Is there an intention to up… --- ## [A JSON array consists of objects - how to deal with?](https://discuss.elastic.co/t/a-json-array-consists-of-objects-how-to-deal-with/264464)
**Author:** [@awer1967](https://discuss.elastic.co/u/awer1967)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 9:33pm UTC](https://discuss.elastic.co/t/a-json-array-consists-of-objects-how-to-deal-with/264464 "2021-02-16T21:33:42Z")
Hi ! I strongly apologize for a possibly stupid, kinda "it-has-been-asked-a-lot-of-time", question. Nevertheless I have to ask for help because I have completely stuck with . So that I have a JSON array consist of ob… --- ## [Update Aliases API](https://discuss.elastic.co/t/update-aliases-api/264369)
**Author:** [@Oscar\_Lopez](https://discuss.elastic.co/u/Oscar_Lopez)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 9:19pm UTC](https://discuss.elastic.co/t/update-aliases-api/264369 "2021-02-16T21:19:56Z")
I have an index\_pattern called metricbeat- \* which I create an alias called alias\_metricbeat. Through the elasticsearch API I want to condition so that certain users do not perform filters of more than three months in th… --- ## [Threads stuck waiting for response](https://discuss.elastic.co/t/threads-stuck-waiting-for-response/264189)
**Author:** [@aouji](https://discuss.elastic.co/u/aouji)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 8:19pm UTC](https://discuss.elastic.co/t/threads-stuck-waiting-for-response/264189 "2021-02-16T20:19:58Z")
Hi, We are running a ES cluster 7.7 and have a service accessing it through the Java rest client (7.7.0). The service is a high traffic springboot application deployed in our organization's kubernetes clusters. From ti… --- ## [Elastic stores string in numeric (long) field](https://discuss.elastic.co/t/elastic-stores-string-in-numeric-long-field/264102)
**Author:** [@Yaniv\_Bogdanov](https://discuss.elastic.co/u/Yaniv_Bogdanov)\ **Replies:** 6\ **Last updated:** [February 16, 2021, 7:31pm UTC](https://discuss.elastic.co/t/elastic-stores-string-in-numeric-long-field/264102 "2021-02-16T19:31:02Z")
Hello, I noticed that elastic allows to store a string value in a numeric field that was mapped as long (as the string can be parsed as a number). I'm not sure if this is a bug or a feature (and if it has a setting to … --- ## [Best way to export data do SQL database](https://discuss.elastic.co/t/best-way-to-export-data-do-sql-database/264462)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 7:16pm UTC](https://discuss.elastic.co/t/best-way-to-export-data-do-sql-database/264462 "2021-02-16T19:16:22Z")
Hi, could you help me advice What tools/techniques do you recommend to export data to SQL Database. (PostgreSQL/Oracle or any other) I need aggregations results export to SQL database (continuous query). I supposed… --- ## [Extract nested json](https://discuss.elastic.co/t/extract-nested-json/264062)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 7:13pm UTC](https://discuss.elastic.co/t/extract-nested-json/264062 "2021-02-16T19:13:23Z")
I have the following nested json that I'm trying to pull out into top level fields so I can use mutate to add and modify, These events are picked from an awscloudwatch stream with filebeat v7.10.2 then fed to a logstash… --- ## [Storm and ElasticStack with external ZooKeeper Server](https://discuss.elastic.co/t/storm-and-elasticstack-with-external-zookeeper-server/264363)
**Author:** [@AaronNGray](https://discuss.elastic.co/u/AaronNGray)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 6:32pm UTC](https://discuss.elastic.co/t/storm-and-elasticstack-with-external-zookeeper-server/264363 "2021-02-16T18:32:44Z")
I am trying to create a docker-compose script that marries ElasticStack with Storm for the purposes of StormCrawler development. I have a storm script that includes a ZooKeeper server. I tried combining this with the… --- ## [Difference between aggregating on analyzed text field (using field data), compared to aggregating on high cardinality non-analyzed field](https://discuss.elastic.co/t/difference-between-aggregating-on-analyzed-text-field-using-field-data-compared-to-aggregating-on-high-cardinality-non-analyzed-field/264444)
**Author:** [@bagge](https://discuss.elastic.co/u/bagge)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 6:06pm UTC](https://discuss.elastic.co/t/difference-between-aggregating-on-analyzed-text-field-using-field-data-compared-to-aggregating-on-high-cardinality-non-analyzed-field/264444 "2021-02-16T18:06:08Z")
Hi, We are seeing performance problems with our elasticsearch cluster. Our setup is running ES 6.6 with 6 nodes total where 2 are master and 4 are data. Each data node has 32GB memory and 16 available to the heap. We h… --- ## [Elasticsearch - How to start the instance/cluster with Gold or Platinum license](https://discuss.elastic.co/t/elasticsearch-how-to-start-the-instance-cluster-with-gold-or-platinum-license/264337)
**Author:** [@Pramodh\_Bettadapura](https://discuss.elastic.co/u/Pramodh_Bettadapura)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 5:32pm UTC](https://discuss.elastic.co/t/elasticsearch-how-to-start-the-instance-cluster-with-gold-or-platinum-license/264337 "2021-02-16T17:32:10Z")
Is their a way to statically start the Elasticsearch instances with Gold or Platinum license. or is it only enabled on calling "PUT \_license" API with license JSON --- ## [Conditional N-gram token filter?](https://discuss.elastic.co/t/conditional-n-gram-token-filter/264460)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 5:21pm UTC](https://discuss.elastic.co/t/conditional-n-gram-token-filter/264460 "2021-02-16T17:21:19Z")
Could we have conditional N-gram token filter? Tell me yes or no ? More explanation : I have a text "The animal is cute" I want to know if it is possible to have min\_gram=3 if word.length\>=3 and min\_gram=2 if word.len… --- ## [How to prevent query execution within certain hours of the day?](https://discuss.elastic.co/t/how-to-prevent-query-execution-within-certain-hours-of-the-day/264456)
**Author:** [@mattinVS](https://discuss.elastic.co/u/mattinVS)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 4:23pm UTC](https://discuss.elastic.co/t/how-to-prevent-query-execution-within-certain-hours-of-the-day/264456 "2021-02-16T16:23:49Z")
Hi, I'd like to prevent the execution of a query within certain hours of the day. The solution that comes into my mind is to use a painless script filter for this like "query": { "bool": { "filter": \[ … --- ## [Can I conditionally trigger a processor based on the current nested iteration or execute a plugin in script?](https://discuss.elastic.co/t/can-i-conditionally-trigger-a-processor-based-on-the-current-nested-iteration-or-execute-a-plugin-in-script/262288)
**Author:** [@dswitzer](https://discuss.elastic.co/u/dswitzer)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 4:17pm UTC](https://discuss.elastic.co/t/can-i-conditionally-trigger-a-processor-based-on-the-current-nested-iteration-or-execute-a-plugin-in-script/262288 "2021-02-16T16:17:48Z")
Is there a way to process an attachment conditionally for a nested object that's represented by an array? I looked into the foreach processor with a conditional if, but the ctx object does not appear to hold a reference… --- ## [Difference b/w Aggregate & joinaggregate in vega-lite](https://discuss.elastic.co/t/difference-b-w-aggregate-joinaggregate-in-vega-lite/263826)
**Author:** [@Yashaswini](https://discuss.elastic.co/u/Yashaswini)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 4:12pm UTC](https://discuss.elastic.co/t/difference-b-w-aggregate-joinaggregate-in-vega-lite/263826 "2021-02-16T16:12:16Z")
When I use aggregate i'm getting value as 0, but when I use joinaggregate i'm proper value. Why is this happening ? { "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "width": 400, data: { … --- ## [Startup Docker race condition](https://discuss.elastic.co/t/startup-docker-race-condition/264365)
**Author:** [@tman5](https://discuss.elastic.co/u/tman5)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 3:27pm UTC](https://discuss.elastic.co/t/startup-docker-race-condition/264365 "2021-02-16T15:27:48Z")
Facing an issue when a server reboots with Filebeat 7.10 and Docker. Filebeat will start slightly before Docker and not pick up Docker container logs. If you restart Filebeat, it will then pick them up. I could set start… --- ## [Can I delete a data-stream backing index?](https://discuss.elastic.co/t/can-i-delete-a-data-stream-backing-index/264449)
**Author:** [@gkman](https://discuss.elastic.co/u/gkman)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 3:00pm UTC](https://discuss.elastic.co/t/can-i-delete-a-data-stream-backing-index/264449 "2021-02-16T15:00:53Z")
I have a few data-streams configured in my Elasticsearch cluster (with ILM policy). Suppose I run into storage problems and etc. and I want to prematurely delete a few backing indices of the data-streams- Is it possible… --- ## [Panic: runtime error: invalid memory address or nil pointer dereference in ecctl 1.1.0](https://discuss.elastic.co/t/panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference-in-ecctl-1-1-0/263808)
**Author:** [@bbaronas](https://discuss.elastic.co/u/bbaronas)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 2:18pm UTC](https://discuss.elastic.co/t/panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference-in-ecctl-1-1-0/263808 "2021-02-16T14:18:29Z")
I am trying to output an upload template for my Elastic Cloud deployment using ecctl. However, when I run ecctl deployment show \ --generate-update-payload \> update.json using my actual deployment id I get … --- ## [Duplicate Issue - document\_id, how to prevent overwriting of entries](https://discuss.elastic.co/t/duplicate-issue-document-id-how-to-prevent-overwriting-of-entries/264404)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 1:44pm UTC](https://discuss.elastic.co/t/duplicate-issue-document-id-how-to-prevent-overwriting-of-entries/264404 "2021-02-16T13:44:57Z")
Hi All, Some background information: I have duplicate entries in my elasticsearch indexes. Have used document\_id which prevented duplicates from appearing. But the issue with this is that it overwrites and updates the… --- ## [Highlight query in URI](https://discuss.elastic.co/t/highlight-query-in-uri/263543)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 1:39pm UTC](https://discuss.elastic.co/t/highlight-query-in-uri/263543 "2021-02-16T13:39:11Z")
Hi, I want to use highlight in URI query. Ex. http://myservername.com:9200/myindex/\_search?q=myfieldname:searchvalue&highlight=myfieldname But this is not working. I want to use URI search with highlight but not get… --- ## [Problem Using Filebeat for logging ssh log in](https://discuss.elastic.co/t/problem-using-filebeat-for-logging-ssh-log-in/264412)
**Author:** [@Skriix](https://discuss.elastic.co/u/Skriix)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 1:10pm UTC](https://discuss.elastic.co/t/problem-using-filebeat-for-logging-ssh-log-in/264412 "2021-02-16T13:10:11Z")
Hi, SSh logs are not being shown in the kibana, I am pushing my logs to the ES Only I am using the following configuration, OS - Ubuntu 20.04 ES - 7.11.0 LogStash - 7.11.0 Kibana - 7.11.0 FileBeat - 7.11.0 The en… --- ## [Elasticsearch backup & restore issue](https://discuss.elastic.co/t/elasticsearch-backup-restore-issue/264324)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 1:07pm UTC](https://discuss.elastic.co/t/elasticsearch-backup-restore-issue/264324 "2021-02-16T13:07:25Z")
Hi all, I'm trying to do backup and restore of elasticsearch data. I have taken backup of my elasticsearch data. But when i try to restore my backup, it gives errror that "cannot restore index \[ilm-history-3-000001\] b… --- ## [Dead letter queue not printing logs for events failed to get indexed in Elasticsearch](https://discuss.elastic.co/t/dead-letter-queue-not-printing-logs-for-events-failed-to-get-indexed-in-elasticsearch/263967)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:42pm UTC](https://discuss.elastic.co/t/dead-letter-queue-not-printing-logs-for-events-failed-to-get-indexed-in-elasticsearch/263967 "2021-02-16T12:42:30Z")
Objective: print log/event in a log file which are failed to index in Elasticsearch. I am ingesting logs via SQS input and few messages are getting failed to index in Elasticsearch. I have debug logs and it shows the fo… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1551) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1553)