# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1562 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1563 --- ## [Dynamic Nested Key Value List Aggregation](https://discuss.elastic.co/t/dynamic-nested-key-value-list-aggregation/263841)
**Author:** [@alparslan](https://discuss.elastic.co/u/alparslan)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 10:52am UTC](https://discuss.elastic.co/t/dynamic-nested-key-value-list-aggregation/263841 "2021-02-10T10:52:47Z")
Hi, I have "inputParams" object with dynamic key value pair with the following structure. My purpose is visualizing the "inputParams" field according to key. Keys are not known. It can be change according to process. … --- ## [Logs are not getting logged continuously](https://discuss.elastic.co/t/logs-are-not-getting-logged-continuously/263081)
**Author:** [@Bilal\_Malik](https://discuss.elastic.co/u/Bilal_Malik)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 10:31am UTC](https://discuss.elastic.co/t/logs-are-not-getting-logged-continuously/263081 "2021-02-10T10:31:46Z")
Hi, Elastic search is showing very strange behavior from yesterday, it was working perfectly, but now it is missing logs after every ten minutes. It just logs for 5 minutes then shows a gap for the next 10 minutes. Plea… --- ## [ES 7.8.0 plugin development - onIndexModule questions](https://discuss.elastic.co/t/es-7-8-0-plugin-development-onindexmodule-questions/263848)
**Author:** [@Tom\_Elias](https://discuss.elastic.co/u/Tom_Elias)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 10:16am UTC](https://discuss.elastic.co/t/es-7-8-0-plugin-development-onindexmodule-questions/263848 "2021-02-10T10:16:15Z")
Hello, I am currently developing a plugin for Elasticsearch and trying out the new dense\_vector data type. what i'm currently trying to do is register a PostIndexOperationListener and IndexOperationEventListener object… --- ## [Nested query max value](https://discuss.elastic.co/t/nested-query-max-value/263569)
**Author:** [@sivanzakay](https://discuss.elastic.co/u/sivanzakay)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 10:04am UTC](https://discuss.elastic.co/t/nested-query-max-value/263569 "2021-02-10T10:04:15Z")
For a set of documents like this: { "took" : 1, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 3, "relation" : "eq" }, "ma… --- ## [Filebeat: failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-temporary-bulk-send-failure/263515)
**Author:** [@samiusan](https://discuss.elastic.co/u/samiusan)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 10:07am UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-temporary-bulk-send-failure/263515 "2021-02-10T10:07:08Z")
Hi, I have setup a few hosts at home & and am slowly teaching myself elastic. Problem at the moment is filebeat 7.10.2 are having trouble sending to my elasticsearch instance. Below is the snippet I'm seeing from one o… --- ## [How to do static field in visualization](https://discuss.elastic.co/t/how-to-do-static-field-in-visualization/263834)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 6\ **Last updated:** [February 10, 2021, 9:28am UTC](https://discuss.elastic.co/t/how-to-do-static-field-in-visualization/263834 "2021-02-10T09:28:18Z")
In kibana visualization , for example in last 15 minute the kibana visulization shows that user x has count 10 then after 15 minutes if a user is not using computer then it should show count 0 and yes it should also show… --- ## [Parsing json logs issue](https://discuss.elastic.co/t/parsing-json-logs-issue/263638)
**Author:** [@doogle](https://discuss.elastic.co/u/doogle)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 9:26am UTC](https://discuss.elastic.co/t/parsing-json-logs-issue/263638 "2021-02-10T09:26:52Z")
Hi All, I am rather new to all of this and I have been tasked to get logging working in our environment. We have a smoothwall firewall that we use for webfiltering. I have manged to get most of the logs parsed, however … --- ## [Running tasks get terminated when cluster is upgraded from 6.6.2 to 7.10.2 using full cluster restart upgrade approach](https://discuss.elastic.co/t/running-tasks-get-terminated-when-cluster-is-upgraded-from-6-6-2-to-7-10-2-using-full-cluster-restart-upgrade-approach/263668)
**Author:** [@yabhishek](https://discuss.elastic.co/u/yabhishek)\ **Replies:** 7\ **Last updated:** [February 10, 2021, 9:26am UTC](https://discuss.elastic.co/t/running-tasks-get-terminated-when-cluster-is-upgraded-from-6-6-2-to-7-10-2-using-full-cluster-restart-upgrade-approach/263668 "2021-02-10T09:26:39Z")
Hi I tried to upgrade my elasticsearch cluster running version 6.6.2 to version 7.10.2 using full cluster restart upgrade approach. Before performing upgrade, I had some tasks running as can be seen in the following ou… --- ## [Search Error - All Shards failed](https://discuss.elastic.co/t/search-error-all-shards-failed/263817)
**Author:** [@Hyun\_Choi](https://discuss.elastic.co/u/Hyun_Choi)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 8:28am UTC](https://discuss.elastic.co/t/search-error-all-shards-failed/263817 "2021-02-10T08:28:22Z")
After parsing JSON log with the filter I used below filter { if \[type\] == "vizql\_cpp" or \[type\] == "vizql\_tabprotosrv" { json { source =\> "message" } mutate { rename =\>… --- ## [Start from zero with a new cluster](https://discuss.elastic.co/t/start-from-zero-with-a-new-cluster/263843)
**Author:** [@grillo](https://discuss.elastic.co/u/grillo)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 8:12am UTC](https://discuss.elastic.co/t/start-from-zero-with-a-new-cluster/263843 "2021-02-10T08:12:14Z")
Hi all, I've been working with this ELK solution for a few years and I can't restart all the nodes in a cluster to ... start from zero with a new cluster 1st - Delete all stored data I can delete indexes ... (from com… --- ## [Common properties on docs](https://discuss.elastic.co/t/common-properties-on-docs/263412)
**Author:** [@Faycal](https://discuss.elastic.co/u/Faycal)\ **Replies:** 4\ **Last updated:** [February 10, 2021, 8:09am UTC](https://discuss.elastic.co/t/common-properties-on-docs/263412 "2021-02-10T08:09:44Z")
Hello all, i'm new on this community. I have an index of "hits" and for each document we have two parameters: user genre example: doc1 user:john genre:rock doc2 user:john genre:rap doc3 user:bruce genre:ro… --- ## [\[error\]\[data\]\[elasticsearch\] \[TimeoutError\]: Request timed out](https://discuss.elastic.co/t/error-data-elasticsearch-timeouterror-request-timed-out/263830)
**Author:** [@tushar1092](https://discuss.elastic.co/u/tushar1092)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 8:01am UTC](https://discuss.elastic.co/t/error-data-elasticsearch-timeouterror-request-timed-out/263830 "2021-02-10T08:01:01Z")
I am trying to install Kibana on my windows machine, it keeps giving me error. I have also tried to delete all Kibana task - curl -XDELETE http://localhost:9200/.kibana\* But still getting this error. Below are the logs.… --- ## [Xpack from msi](https://discuss.elastic.co/t/xpack-from-msi/262279)
**Author:** [@Tino23](https://discuss.elastic.co/u/Tino23)\ **Replies:** 6\ **Last updated:** [February 10, 2021, 7:57am UTC](https://discuss.elastic.co/t/xpack-from-msi/262279 "2021-02-10T07:57:18Z")
please help me fix this installed my search using msi version elasticsearch-7.10.2 Unexpected response code \[405\] from calling GET http://127.0.0.1:9200/\_security/\_authenticate?pretty It doesn't look like the X-Pack se… --- ## [State tracker file update - JDBC input plugin](https://discuss.elastic.co/t/state-tracker-file-update-jdbc-input-plugin/263268)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 7:28am UTC](https://discuss.elastic.co/t/state-tracker-file-update-jdbc-input-plugin/263268 "2021-02-10T07:28:27Z")
Would like to know when the state tracker file get's updated. We are using the jdbc input plugin and modified date from the table has been used as the state tracker field. Would like to know when the state tracker files… --- ## [ELastic credentials not working for Elasticsearch Endpoints of elastic cloud deployement](https://discuss.elastic.co/t/elastic-credentials-not-working-for-elasticsearch-endpoints-of-elastic-cloud-deployement/263837)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 7:01am UTC](https://discuss.elastic.co/t/elastic-credentials-not-working-for-elasticsearch-endpoints-of-elastic-cloud-deployement/263837 "2021-02-10T07:01:10Z")
Hi, I am using free trial of Elastic cloud for a POC purpose. I have created one test-observability-v1 deployment. I have got ES endpoints, Kibana end points and APM end points affet deployement. Also there one e… --- ## [Elastic clould price calculator. RAM size?](https://discuss.elastic.co/t/elastic-clould-price-calculator-ram-size/263742)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 6:11am UTC](https://discuss.elastic.co/t/elastic-clould-price-calculator-ram-size/263742 "2021-02-10T06:11:32Z")
Hi folks, i am trying to use the this calculator: https://cloud.elastic.co/pricing and trying to size my cloud cluster and compare it to my current on prem cluster. I know from the documentation that it is recomended t… --- ## [I want to create Snapshots of indices on External Hard Drive](https://discuss.elastic.co/t/i-want-to-create-snapshots-of-indices-on-external-hard-drive/263801)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 5\ **Last updated:** [February 10, 2021, 5:46am UTC](https://discuss.elastic.co/t/i-want-to-create-snapshots-of-indices-on-external-hard-drive/263801 "2021-02-10T05:46:18Z")
Hi , I have created NFS location in my cluster that is accessible from all the nodes. I checked it through terminal, The Repository has read and write both permissions. But when i create a repository from kibana termi… --- ## [Logstash is creating data streams instead of indices in ES](https://discuss.elastic.co/t/logstash-is-creating-data-streams-instead-of-indices-in-es/263824)
**Author:** [@naveenj](https://discuss.elastic.co/u/naveenj)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 4:41am UTC](https://discuss.elastic.co/t/logstash-is-creating-data-streams-instead-of-indices-in-es/263824 "2021-02-10T04:41:31Z")
elasticsearch { host =\> "localhost" index\_type =\> "logs-%{\[kubernetes\]\[labels\]\[app\]}" } I am using above configuration in logstash Helm chat values.yml file for OKD setup. filebeat -\>logstash -\>ES Some logs … --- ## [Can I add custom SVGs as symbols on ElasticSearch Kibana Maps?](https://discuss.elastic.co/t/can-i-add-custom-svgs-as-symbols-on-elasticsearch-kibana-maps/263309)
**Author:** [@irwazr](https://discuss.elastic.co/u/irwazr)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 11:43pm UTC](https://discuss.elastic.co/t/can-i-add-custom-svgs-as-symbols-on-elasticsearch-kibana-maps/263309 "2021-02-09T23:43:17Z")
Hi all, We have a map view taking a GeoJSON feed and plotting points according to long/lat. It works really well, but the out of the box symbols provided don't match our data use-case (weather events etc). I'm capable… --- ## [Sub-queries in KQL Kibana](https://discuss.elastic.co/t/sub-queries-in-kql-kibana/263505)
**Author:** [@Montek\_Singh](https://discuss.elastic.co/u/Montek_Singh)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 11:29pm UTC](https://discuss.elastic.co/t/sub-queries-in-kql-kibana/263505 "2021-02-09T23:29:51Z")
I am using ELK stack to perform some analysis on my data. My index pattern has 2 types of data The ID of the product clicked The ID of the product sold I would like to first find all the IDs sold out and based on that… --- ## [Hour Scripted Field](https://discuss.elastic.co/t/hour-scripted-field/263416)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 10:53pm UTC](https://discuss.elastic.co/t/hour-scripted-field/263416 "2021-02-09T22:53:33Z")
I am trying to create a scripted field that is the hourly value of each document. The ultimate goal is to filter by specific hours of the day for multiple days (hence why I can't just use the date range on the dashboard… --- ## [File storage](https://discuss.elastic.co/t/file-storage/263813)
**Author:** [@Jcroy](https://discuss.elastic.co/u/Jcroy)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 10:09pm UTC](https://discuss.elastic.co/t/file-storage/263813 "2021-02-09T22:09:46Z")
Hey everyone, I’m trying figure out the best way to configure a backup solution for 8 nodes. I want to have anything older than 30 days be sent to local file storage. Is the best way to do this to use snapshots? --- ## [Getting bucket size from response](https://discuss.elastic.co/t/getting-bucket-size-from-response/263188)
**Author:** [@araujonelson](https://discuss.elastic.co/u/araujonelson)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 9:46pm UTC](https://discuss.elastic.co/t/getting-bucket-size-from-response/263188 "2021-02-09T21:46:45Z")
Hello there. Is there any way to get the bucket size (number of buckets) generated from a terms aggregation? I'm using the Java High Level client but couldn't find anything. P.S: What I'm trying to get is the number 3 … --- ## [Logstash Aggregation and IF/Else](https://discuss.elastic.co/t/logstash-aggregation-and-if-else/263777)
**Author:** [@govind94](https://discuss.elastic.co/u/govind94)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 4:57pm UTC](https://discuss.elastic.co/t/logstash-aggregation-and-if-else/263777 "2021-02-09T16:57:00Z")
I have SOP named GIS which have 3 jobs and getting 3 events {"jobName":"BIS43683","JobStatus":"COMPLETE","@timestamp":"2020-02-08T23:00:47.958Z","JobSystemStatus":"COMPLETE"} {"jobName":"BIS43595","JobStatus":"COMPLETE… --- ## [Logstash Filter - regez](https://discuss.elastic.co/t/logstash-filter-regez/263806)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 9:33pm UTC](https://discuss.elastic.co/t/logstash-filter-regez/263806 "2021-02-09T21:33:06Z")
Hi, Please help me with the if condition filter in logstash for same KQL querymentioned below. message: \*.url.\* and not \*failover\* Below logstash filter is not working filter{ if (\[message\] != ‘.\\.url\\..’ and \[messa… --- ## [Issue with deserializing MultilineStringGeoShape](https://discuss.elastic.co/t/issue-with-deserializing-multilinestringgeoshape/263670)
**Author:** [@rckreddy](https://discuss.elastic.co/u/rckreddy)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 9:10pm UTC](https://discuss.elastic.co/t/issue-with-deserializing-multilinestringgeoshape/263670 "2021-02-09T21:10:34Z")
Please see the code below. Results when calling ElasticSearch. "\_source": { "TEST1": 450304485, "TEST2": 1612465007053, "GEOMETRY": { "TYPE": "MultiLineString", "COORDINATES": \[ \[ \[ -83.01273, 39.94391 \], \[ … --- ## [Kibana realm-specific login URL (or another way to pre-select the realm)?](https://discuss.elastic.co/t/kibana-realm-specific-login-url-or-another-way-to-pre-select-the-realm/263533)
**Author:** [@ngrigoriev](https://discuss.elastic.co/u/ngrigoriev)\ **Replies:** 5\ **Last updated:** [February 9, 2021, 9:07pm UTC](https://discuss.elastic.co/t/kibana-realm-specific-login-url-or-another-way-to-pre-select-the-realm/263533 "2021-02-09T21:07:45Z")
Hi! I am trying to define several authc providers/realms in Elastic + Kibana but I do not want my clients to select a realm. Instead, I would like to drive them to a particular one that corresponds to them. Is there a w… --- ## [404 Not found only for filebeat](https://discuss.elastic.co/t/404-not-found-only-for-filebeat/258876)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 7\ **Last updated:** [February 9, 2021, 8:05pm UTC](https://discuss.elastic.co/t/404-not-found-only-for-filebeat/258876 "2021-02-09T20:05:09Z")
Hi, We are trying to send our filebeat logs to an elasticsearch cluster but we get this error: 2020-12-16T15:32:37.816+0100 ERROR \[esclientleg\] eslegclient/connection.go:261 error connecting to Elasticsearch a… --- ## [Grok test works - Grok through pipeline doesn't](https://discuss.elastic.co/t/grok-test-works-grok-through-pipeline-doesnt/262867)
**Author:** [@mgevans](https://discuss.elastic.co/u/mgevans)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 8:01pm UTC](https://discuss.elastic.co/t/grok-test-works-grok-through-pipeline-doesnt/262867 "2021-02-09T20:01:28Z")
Hi Folks, I have updated the out-of-the-box Metricbeat IIS module 7.10 pipeline with a slightly different Grok for one of our IIS servers. When I test the Grok it works fine (dev tools and Grok test GUI and Pipeline ed… --- ## [Trying to drop event if mount\_point is /](https://discuss.elastic.co/t/trying-to-drop-event-if-mount-point-is/263798)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 7:32pm UTC](https://discuss.elastic.co/t/trying-to-drop-event-if-mount-point-is/263798 "2021-02-09T19:32:50Z")
I have try all different kind of options but nothing seems to work. anyone has doe this before. how do I do this? processors: - drop\_event.when.equals: system.filesystem.mount\_point: '/' processors: - drop\_event.wh… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1561) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1563)