# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1553 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1554 --- ## [Difference between sharing dashboard as snapshot and saved object](https://discuss.elastic.co/t/difference-between-sharing-dashboard-as-snapshot-and-saved-object/264385)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:33pm UTC](https://discuss.elastic.co/t/difference-between-sharing-dashboard-as-snapshot-and-saved-object/264385 "2021-02-16T12:33:23Z")
Hello All, I use Kibana version 7.9.0. I would like to know the actual difference between sharing/embedding a dashboard URL as a snapshot or a saved object According to the pop-up info : For snapshot, the pop-up says… --- ## [It seems mapping update for "date\_range" field type is not idempotent](https://discuss.elastic.co/t/it-seems-mapping-update-for-date-range-field-type-is-not-idempotent/263034)
**Author:** [@0bivan](https://discuss.elastic.co/u/0bivan)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:21pm UTC](https://discuss.elastic.co/t/it-seems-mapping-update-for-date-range-field-type-is-not-idempotent/263034 "2021-02-16T12:21:49Z")
Hi. Want to confirm the issue before posting it on github. ES does not allow to update date\_range field with exact same mapping settings and responds with 500. Tried with docker container (https://hub.docker.com/\_/elasti… --- ## [Logstash pipeline output and elastic cloud](https://discuss.elastic.co/t/logstash-pipeline-output-and-elastic-cloud/263659)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 10\ **Last updated:** [February 16, 2021, 12:17pm UTC](https://discuss.elastic.co/t/logstash-pipeline-output-and-elastic-cloud/263659 "2021-02-16T12:17:29Z")
Hi all. I have elastic cloud 7.10.2 and we are setting up logstash with a pipilne with input/filter/output. Also we are using helm to deploy. Of course I have cloud.id and cloud.auth and not sure how to configure the … --- ## [7.11.0 release forgot to merge ansible-beats](https://discuss.elastic.co/t/7-11-0-release-forgot-to-merge-ansible-beats/264256)
**Author:** [@strophy](https://discuss.elastic.co/u/strophy)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:03pm UTC](https://discuss.elastic.co/t/7-11-0-release-forgot-to-merge-ansible-beats/264256 "2021-02-16T12:03:31Z")
Hello, who is responsible for merging and releasing this? It seems to have been forgotten compared to previous releases, where it was merged on the same day as the rest of Elastic Stack. --- ## [Create new field from query](https://discuss.elastic.co/t/create-new-field-from-query/263892)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 17\ **Last updated:** [February 16, 2021, 11:57am UTC](https://discuss.elastic.co/t/create-new-field-from-query/263892 "2021-02-16T11:57:03Z")
I got a query which creates a new field sophos.utm.to.domain. That query extracts the full mail domain. The mail address which is stored in sophos.utm.to. My Question: How do I create a new field out of this query? --- ## [Filebeat setup. fail to create the Kibana loader](https://discuss.elastic.co/t/filebeat-setup-fail-to-create-the-kibana-loader/264394)
**Author:** [@DavidEA](https://discuss.elastic.co/u/DavidEA)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 11:47am UTC](https://discuss.elastic.co/t/filebeat-setup-fail-to-create-the-kibana-loader/264394 "2021-02-16T11:47:48Z")
Please tell me, I don't know where to look. When installing filebeat, I do: filebeat setup -e -E output.logstash.enabled = false -E output.elasticsearch.hosts = \['remote\_ip: 9200'\] -E setup.kibana.host = remote\_ip: 560… --- ## [Configure dropwizard modules for same services in different namespaces](https://discuss.elastic.co/t/configure-dropwizard-modules-for-same-services-in-different-namespaces/264162)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 11:36am UTC](https://discuss.elastic.co/t/configure-dropwizard-modules-for-same-services-in-different-namespaces/264162 "2021-02-16T11:36:41Z")
Hi we have multiple services exposing metrics using dropwizard running in kubernetes environment. Same services run in multiple kubernetes. namespaces, so I need to configure metricbeat everytime a new namespace is ad… --- ## [Aggregating sequence of connected events](https://discuss.elastic.co/t/aggregating-sequence-of-connected-events/264421)
**Author:** [@steff1](https://discuss.elastic.co/u/steff1)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 11:25am UTC](https://discuss.elastic.co/t/aggregating-sequence-of-connected-events/264421 "2021-02-16T11:25:48Z")
Lets say I have events like this in my log {type:"approval\_revokation", approval\_id=22} {type:"approval", request\_id=12, approval\_id=22} {type:"control3", request\_id=12} {type:"control2", request\_id=12} {type:"control1"… --- ## [How to debug suggest queries](https://discuss.elastic.co/t/how-to-debug-suggest-queries/264396)
**Author:** [@Fabrizio\_Fortino](https://discuss.elastic.co/u/Fabrizio_Fortino)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 9:16am UTC](https://discuss.elastic.co/t/how-to-debug-suggest-queries/264396 "2021-02-16T09:16:27Z")
I have a suggest query that is not returning a document and I would like to understand the reason. Is there any way to debug why this happens? I tried using the explain API but this does not return back any useful inform… --- ## [“Error” message creates a pop-up \[esaggs\]\>](https://discuss.elastic.co/t/error-message-creates-a-pop-up-esaggs/260803)
**Author:** [@gulshann](https://discuss.elastic.co/u/gulshann)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 11:15am UTC](https://discuss.elastic.co/t/error-message-creates-a-pop-up-esaggs/260803 "2021-02-16T11:15:18Z")
Hi, if I am ideal for more than 10 minutes and then try to interact Dashboard then I am getting a error pop up msg in my widget. I am using kibana v 7.10 --- ## [How to setup XPack for role based acess to kibana using the offical helm charts](https://discuss.elastic.co/t/how-to-setup-xpack-for-role-based-acess-to-kibana-using-the-offical-helm-charts/264415)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 11:06am UTC](https://discuss.elastic.co/t/how-to-setup-xpack-for-role-based-acess-to-kibana-using-the-offical-helm-charts/264415 "2021-02-16T11:06:50Z")
Hello there, We are trying to setup xpack using the official helm chart for rolebased authentification. We don´t have access to our host machiene other than kubectl. Is it possible to do so ? Thanks in advance … --- ## [How to build visualizations based on String fields](https://discuss.elastic.co/t/how-to-build-visualizations-based-on-string-fields/264000)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 10:42am UTC](https://discuss.elastic.co/t/how-to-build-visualizations-based-on-string-fields/264000 "2021-02-16T10:42:52Z")
Hi there. I am trying to figure out a way to work with our data in kibana. Problem is, even tough we have a lot of diffrent lines within the Payload part of our logs wich means its kind of difficult to build filters in … --- ## [Fleet Agent on Windows goes 'Unhealthy' after 7.11 upgrade](https://discuss.elastic.co/t/fleet-agent-on-windows-goes-unhealthy-after-7-11-upgrade/264286)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 6\ **Last updated:** [February 16, 2021, 10:14am UTC](https://discuss.elastic.co/t/fleet-agent-on-windows-goes-unhealthy-after-7-11-upgrade/264286 "2021-02-16T10:14:19Z")
After upgrading Elastic-Agent to 7.11 Windows machines get a 'Unhealty' state in Fleet. Even installing Elastic-Agent on a clean installed Windows machine will get this issue. The 4 Ubuntu servers are doing well. Than… --- ## [Graph Synonym search case sensitive](https://discuss.elastic.co/t/graph-synonym-search-case-sensitive/264094)
**Author:** [@sagar.pattnayak](https://discuss.elastic.co/u/sagar.pattnayak)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 10:11am UTC](https://discuss.elastic.co/t/graph-synonym-search-case-sensitive/264094 "2021-02-16T10:11:44Z")
Hi I have applied graph synonym search and it is working as expected when ever I search on lowercase. However the moment i change the keyword to upper case it is not working as expected. For example I have the terms la… --- ## [How to add multiple filter in Search template](https://discuss.elastic.co/t/how-to-add-multiple-filter-in-search-template/264132)
**Author:** [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 9:45am UTC](https://discuss.elastic.co/t/how-to-add-multiple-filter-in-search-template/264132 "2021-02-16T09:45:57Z")
Hi, I am trying to create search template which will support the multiple term filter for different fields. I have created search template but facing issue for adding comm after each filter. in current case if all the f… --- ## [Shards getting bigger with updates (same number of documents)](https://discuss.elastic.co/t/shards-getting-bigger-with-updates-same-number-of-documents/264329)
**Author:** [@marcineq](https://discuss.elastic.co/u/marcineq)\ **Replies:** 13\ **Last updated:** [February 16, 2021, 8:42am UTC](https://discuss.elastic.co/t/shards-getting-bigger-with-updates-same-number-of-documents/264329 "2021-02-16T08:42:23Z")
Hi all I have a ES 7 cluster of couple of EC2 instances, the index has 6 shards and each shard has 2 replicas (so 1+2 x 6 = 18 shards for an index). When I create the index each shard size is around 25-30gb and we hold … --- ## [Top\_hits aggregation performance problem](https://discuss.elastic.co/t/top-hits-aggregation-performance-problem/264336)
**Author:** [@ozgun](https://discuss.elastic.co/u/ozgun)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 8:31am UTC](https://discuss.elastic.co/t/top-hits-aggregation-performance-problem/264336 "2021-02-16T08:31:51Z")
Hello everyone, I've a query which returns response in 3k-4k ms. When i remove top\_hits aggregations it reduces to 60-70 ms. Why is top\_hits aggregation so slow? How can i speed up my query? Is there any alternative to … --- ## [Pin ES Documents at specific position](https://discuss.elastic.co/t/pin-es-documents-at-specific-position/264386)
**Author:** [@Venkata\_Naresh](https://discuss.elastic.co/u/Venkata_Naresh)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 7:21am UTC](https://discuss.elastic.co/t/pin-es-documents-at-specific-position/264386 "2021-02-16T07:21:39Z")
I have some documents in ES Index in which I have a requirement to pin the documents at specific index positions irrespective of their score based on the ids. I tried pinned query but it fetching and pinning the documen… --- ## [How to change max payload size on cloud Kibana](https://discuss.elastic.co/t/how-to-change-max-payload-size-on-cloud-kibana/264308)
**Author:** [@harmanpa](https://discuss.elastic.co/u/harmanpa)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 7:11am UTC](https://discuss.elastic.co/t/how-to-change-max-payload-size-on-cloud-kibana/264308 "2021-02-16T07:11:59Z")
I am trying to use filebeat to send logs to elastic cloud, however on calling "filebeat setup" I get the following error: Response: {"statusCode":413,"error":"Request Entity Too Large","message":"Payload content length … --- ## [\[SQL Translate API\] Wrong query generated when querying for nested fields](https://discuss.elastic.co/t/sql-translate-api-wrong-query-generated-when-querying-for-nested-fields/264083)
**Author:** [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 6:32am UTC](https://discuss.elastic.co/t/sql-translate-api-wrong-query-generated-when-querying-for-nested-fields/264083 "2021-02-16T06:32:24Z")
Hi folks, I have an index with documents that are customer centric. Every document has customer ID, array of orders, within orders array we have an items array. Both orders and items fields are of type nested. There is … --- ## [Elastic Cloud Elasticsearch with nginx reverse proxy](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-with-nginx-reverse-proxy/264152)
**Author:** [@CrystalDesignDR](https://discuss.elastic.co/u/CrystalDesignDR)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 5:59am UTC](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-with-nginx-reverse-proxy/264152 "2021-02-16T05:59:31Z")
Hi, I'm trying to use nginx to have a better looking domain name for elastic cloud, APM reverse proxy works so far, however the elasticsearch endpoint wont work, any ideas? I've also tried everything listed here Nginx… --- ## [Unable to start elasticsearch](https://discuss.elastic.co/t/unable-to-start-elasticsearch/264313)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 5:51am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch/264313 "2021-02-16T05:51:34Z")
Hi, I am unable to start Elasticsearch on docker. Refer following screenshot for error. Can anyone help me to solve this error. Elasticsearch version - 6.4.3 Thanks --- ## [Transform Hour and date](https://discuss.elastic.co/t/transform-hour-and-date/264347)
**Author:** [@Jelssy\_Pomar\_Alvan](https://discuss.elastic.co/u/Jelssy_Pomar_Alvan)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 5:13am UTC](https://discuss.elastic.co/t/transform-hour-and-date/264347 "2021-02-16T05:13:39Z")
Hello, I am new to Kibana, I have a Table with 2 columns (dateini and date end) with format "dd / mm / yyyy hh: mm: ss". I need to change this format to "hh: mm: ss" and then do a subtraction of these 2 fields and displa… --- ## [Formato de Hora y Fecha](https://discuss.elastic.co/t/formato-de-hora-y-fecha/264346)
**Author:** [@Jelssy\_Pomar\_Alvan](https://discuss.elastic.co/u/Jelssy_Pomar_Alvan)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 4:55am UTC](https://discuss.elastic.co/t/formato-de-hora-y-fecha/264346 "2021-02-16T04:55:44Z")
Hola, soy nueva en Kibana, tengo una Tabla con 2 columnas (fechaini y fechafin) con formato "dd/mm/yyyy hh:mm:ss" . Necesito cambiar este formato a "hh:mm:ss" y luego hacer una resta de estos 2 campos. Por ejemplo: 19:… --- ## [Creating a visualization for Top CPU hits over last 24 hours](https://discuss.elastic.co/t/creating-a-visualization-for-top-cpu-hits-over-last-24-hours/264374)
**Author:** [@kamal\_thapa](https://discuss.elastic.co/u/kamal_thapa)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 4:23am UTC](https://discuss.elastic.co/t/creating-a-visualization-for-top-cpu-hits-over-last-24-hours/264374 "2021-02-16T04:23:33Z")
Hello, I am new to Elasticsearch. We have 50 servers to monitor and It is essential for us to find the top CPU hits over last 24 hours. The diagram should show the top CPU hit with timestamp. What visualization would be … --- ## [Syslog output date format](https://discuss.elastic.co/t/syslog-output-date-format/264366)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 7\ **Last updated:** [February 16, 2021, 3:38am UTC](https://discuss.elastic.co/t/syslog-output-date-format/264366 "2021-02-16T03:38:39Z")
Hi, I am running Windows logs successfully to our SIEM using a kafka input and a logstash syslog output. The logs are parsing perfectly in the SIEM. When running a virtually identical pipeline to poll a different topi… --- ## [LogStash::ConfigurationError", :message=\>"Expected one of \[A-Za-z0-9\_-\]](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 15\ **Last updated:** [February 16, 2021, 3:27am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315 "2021-02-16T03:27:30Z")
Hi Guys, Good Day!! I am facing the issue while staring the logstash. LogStash::ConfigurationError", :message=\>"Expected one of \[A-Za-z0-9\_-\] \[ \\t\\r\\n\], "#", "{", \[A-Za-z0-9\_\], "}" at line 49, column 31 (byte 1290) af… --- ## [Understanding implications of \`index: false\` with \`type: keyword\`](https://discuss.elastic.co/t/understanding-implications-of-index-false-with-type-keyword/264352)
**Author:** [@workmanw](https://discuss.elastic.co/u/workmanw)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 1:14am UTC](https://discuss.elastic.co/t/understanding-implications-of-index-false-with-type-keyword/264352 "2021-02-16T01:14:37Z")
Hello, I have a pretty simple use case that has been discussed at length on this forum, I'm storing a large block of text that I just want to reside in my source document, not be indexed at all. Originally this field wa… --- ## [Customise labels of pie in AWS ES Kibana](https://discuss.elastic.co/t/customise-labels-of-pie-in-aws-es-kibana/264372)
**Author:** [@markk](https://discuss.elastic.co/u/markk)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 1:12am UTC](https://discuss.elastic.co/t/customise-labels-of-pie-in-aws-es-kibana/264372 "2021-02-16T01:12:00Z")
Good day, I am using AWS ES Kibana and I created a pie chart to figure out the number of 1's and 0's of a certain field ("approved"). This was created with Metrics - Aggregation: Count, Buckets - Split Slices, Aggregati… --- ## [Recommanded setting for 3 nodes elasticsearch](https://discuss.elastic.co/t/recommanded-setting-for-3-nodes-elasticsearch/264293)
**Author:** [@nawanop-AMNB](https://discuss.elastic.co/u/nawanop-AMNB)\ **Replies:** 1\ **Last updated:** [February 15, 2021, 10:42pm UTC](https://discuss.elastic.co/t/recommanded-setting-for-3-nodes-elasticsearch/264293 "2021-02-15T22:42:24Z")
I'm new at elasticsearch , so I need some advice to build 3 nodes elasticsearch on small production which can handle about 2-3 tps when it peaks option 1: 3 nodes 1.1 node 1: - master: true - data: false - RAM 4 GB … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1552) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1554)