# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1580 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1581 --- ## [I want to except results on a specific date from elastic aggregation](https://discuss.elastic.co/t/i-want-to-except-results-on-a-specific-date-from-elastic-aggregation/262741)
**Author:** [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)\ **Replies:** 0\ **Last updated:** [January 31, 2021, 7:58am UTC](https://discuss.elastic.co/t/i-want-to-except-results-on-a-specific-date-from-elastic-aggregation/262741 "2021-01-31T07:58:42Z")
This is my query that returns results on 19th Oct. GET apachelog/\_search { "size": 0, "aggs": { "NAME": { "terms": { "field": "ext.keyword", "size": 10 } } }, "query": { … --- ## [Advice for a beginner](https://discuss.elastic.co/t/advice-for-a-beginner/262749)
**Author:** [@Shivansh\_Mishra](https://discuss.elastic.co/u/Shivansh_Mishra)\ **Replies:** 1\ **Last updated:** [January 31, 2021, 11:59am UTC](https://discuss.elastic.co/t/advice-for-a-beginner/262749 "2021-01-31T11:59:41Z")
Hi all, I am trying to learn java and want to know about how the enterprise code works so I was thinking of contributing to elastic search so that I can get some mentorship. I am well versed in c# and I wanted to know … --- ## [How to create a custom field formatter plugin in 7.9.x?](https://discuss.elastic.co/t/how-to-create-a-custom-field-formatter-plugin-in-7-9-x/262093)
**Author:** [@nrt.krishna](https://discuss.elastic.co/u/nrt.krishna)\ **Replies:** 2\ **Last updated:** [January 31, 2021, 6:06am UTC](https://discuss.elastic.co/t/how-to-create-a-custom-field-formatter-plugin-in-7-9-x/262093 "2021-01-31T06:06:49Z")
Could somebody provide me an example how to create a plugin for custom field formatters? I had one for 6.x but since the architecture of the plugins changed in 7.9.x I am looking for some help to register my plugin wher… --- ## [Cloud deployment constantly going unhealthy](https://discuss.elastic.co/t/cloud-deployment-constantly-going-unhealthy/262423)
**Author:** [@Supernovasports](https://discuss.elastic.co/u/Supernovasports)\ **Replies:** 17\ **Last updated:** [January 30, 2021, 8:59pm UTC](https://discuss.elastic.co/t/cloud-deployment-constantly-going-unhealthy/262423 "2021-01-30T20:59:35Z")
Hi everyone, I have a deployment which today went unhealthy and after a full restart it works for a few minutes and then goes unhealthy again. From what I can see I haven't filled my storage capacity and I haven't increa… --- ## [Elasticsearch Node Roles Abbreviation](https://discuss.elastic.co/t/elasticsearch-node-roles-abbreviation/262724)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 1\ **Last updated:** [January 30, 2021, 7:46pm UTC](https://discuss.elastic.co/t/elasticsearch-node-roles-abbreviation/262724 "2021-01-30T19:46:03Z")
Currently, I'm running ELK-Stack: 7.10 cluster On my cluster-nodes, I see "cdhilmrstw" as node roles Can anyone please explain/denote what these individual node abbreviations stands for? --- ## [Heap 50% of 30GB no docs yet](https://discuss.elastic.co/t/heap-50-of-30gb-no-docs-yet/261938)
**Author:** [@chrislinx](https://discuss.elastic.co/u/chrislinx)\ **Replies:** 4\ **Last updated:** [January 30, 2021, 6:51pm UTC](https://discuss.elastic.co/t/heap-50-of-30gb-no-docs-yet/261938 "2021-01-30T18:51:00Z")
3 physical Elasticsearch nodes in a cluster. Each node 8 core 64gb ram ubuntu svr 20.04 lts with 2TB M2 storage. 30gb Heap. 600 shards, 1 replica. I will eventually index 10TB on this cluster so 20GB per shard ~12TB. M… --- ## [Elasticsearch fails to start on ubuntu 20.04](https://discuss.elastic.co/t/elasticsearch-fails-to-start-on-ubuntu-20-04/262684)
**Author:** [@josephthejoe](https://discuss.elastic.co/u/josephthejoe)\ **Replies:** 6\ **Last updated:** [January 30, 2021, 6:28pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-on-ubuntu-20-04/262684 "2021-01-30T18:28:58Z")
There seems to be a lot of these types of posts ive gone through a ton of them and havent been able to find one spitting out similar errors to what I have. No logs just the output from systemctl status. lab@siem:~$ syst… --- ## [Suricata - ELK stack](https://discuss.elastic.co/t/suricata-elk-stack/262715)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 3\ **Last updated:** [January 30, 2021, 6:26pm UTC](https://discuss.elastic.co/t/suricata-elk-stack/262715 "2021-01-30T18:26:17Z")
Hi! I need to implement a IDS solution. I already have suriata running on a powerful physical serve, but i need to have the ELK stack on a different machine. Do you guys recommend any minimum system requirements for th… --- ## [How to get only one field from elasticsearch in the output](https://discuss.elastic.co/t/how-to-get-only-one-field-from-elasticsearch-in-the-output/261379)
**Author:** [@devil\_hacks](https://discuss.elastic.co/u/devil_hacks)\ **Replies:** 2\ **Last updated:** [January 30, 2021, 6:18pm UTC](https://discuss.elastic.co/t/how-to-get-only-one-field-from-elasticsearch-in-the-output/261379 "2021-01-30T18:18:41Z")
I am having my log data pushed into elasticssearch looks like given below: { "took": 5, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0, "failed": 0 }… --- ## [Unable to search nested object with correct format](https://discuss.elastic.co/t/unable-to-search-nested-object-with-correct-format/262615)
**Author:** [@ycbencheng](https://discuss.elastic.co/u/ycbencheng)\ **Replies:** 1\ **Last updated:** [January 30, 2021, 5:39pm UTC](https://discuss.elastic.co/t/unable-to-search-nested-object-with-correct-format/262615 "2021-01-30T17:39:46Z")
Hi ELK community, I'm unable to get the nested prospects obj within the vehicle index. Here is the suppose index obj - { "\_index" : "vehicles", "\_type" : "\_doc", "\_id" : "3MZBxxxxxxx", … --- ## [Text '24/07/2018 11:04' could not be parsed at index 0](https://discuss.elastic.co/t/text-24-07-2018-11-04-could-not-be-parsed-at-index-0/262597)
**Author:** [@yash\_watwani](https://discuss.elastic.co/u/yash_watwani)\ **Replies:** 1\ **Last updated:** [January 30, 2021, 5:31pm UTC](https://discuss.elastic.co/t/text-24-07-2018-11-04-could-not-be-parsed-at-index-0/262597 "2021-01-30T17:31:26Z")
My row kinda look like this Opened\_Date 25/07/2017 16:01 02/11/2017 13:49 06/11/2017 20:36 09/11/2017 18:46 13/11/2017 13:51 22/11/2017 08:26 22/11/2017 09:16 24/11/2017 09:31 I am trying to run this query SELECT DATE… --- ## [Vega: Handle a situation where data-set returned is empty](https://discuss.elastic.co/t/vega-handle-a-situation-where-data-set-returned-is-empty/262210)
**Author:** [@ege](https://discuss.elastic.co/u/ege)\ **Replies:** 14\ **Last updated:** [January 30, 2021, 3:10pm UTC](https://discuss.elastic.co/t/vega-handle-a-situation-where-data-set-returned-is-empty/262210 "2021-01-30T15:10:06Z")
When querying for data, there are situations where the returned data-set is empty for certain time ranges. Such a situation occurred in Vega (returned an empty array) and I tried to create a condition using expressions t… --- ## [Code location pointer](https://discuss.elastic.co/t/code-location-pointer/262688)
**Author:** [@mbenitez](https://discuss.elastic.co/u/mbenitez)\ **Replies:** 2\ **Last updated:** [January 30, 2021, 2:34pm UTC](https://discuss.elastic.co/t/code-location-pointer/262688 "2021-01-30T14:34:35Z")
Hello, I was wondering if someone here in the community could help me with some code location pointers. I am working on a project, and as part of the project I am looking at the Elasticsearch source code. I am interest… --- ## [How do i get the message field?](https://discuss.elastic.co/t/how-do-i-get-the-message-field/262711)
**Author:** [@walid\_lakehal](https://discuss.elastic.co/u/walid_lakehal)\ **Replies:** 4\ **Last updated:** [January 30, 2021, 2:05pm UTC](https://discuss.elastic.co/t/how-do-i-get-the-message-field/262711 "2021-01-30T14:05:37Z")
Hello , i am trying to get the "message" field to use it in a web site dashboard , in this example it's just the result of an ls command --- ## [Metricbeat/mysql module data not showing](https://discuss.elastic.co/t/metricbeat-mysql-module-data-not-showing/262648)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 2\ **Last updated:** [January 30, 2021, 1:15pm UTC](https://discuss.elastic.co/t/metricbeat-mysql-module-data-not-showing/262648 "2021-01-30T13:15:32Z")
I have the mysql module enabled on a number of mysql hosts. I see this appearing in the logs: "metricbeat":{"mysql":{"status":{"events":7,"success":7}}} When I go to kibana and search for mysql I don't see any values i… --- ## [Theoretical IMPORTANT questions about architecture of elasticsearch](https://discuss.elastic.co/t/theoretical-important-questions-about-architecture-of-elasticsearch/262596)
**Author:** [@111433](https://discuss.elastic.co/u/111433)\ **Replies:** 6\ **Last updated:** [January 30, 2021, 9:47am UTC](https://discuss.elastic.co/t/theoretical-important-questions-about-architecture-of-elasticsearch/262596 "2021-01-30T09:47:06Z")
Hello, we are developing a searching engine with elasticsearch and already have 3 nodes on dedicated servers for each. We almost have read the documentation, but faced to a couple of problems. about our servers: we ha… --- ## [Cat allocation disk.indices higher than disk.used or disk.total](https://discuss.elastic.co/t/cat-allocation-disk-indices-higher-than-disk-used-or-disk-total/262709)
**Author:** [@LJRamsey](https://discuss.elastic.co/u/LJRamsey)\ **Replies:** 0\ **Last updated:** [January 30, 2021, 9:24am UTC](https://discuss.elastic.co/t/cat-allocation-disk-indices-higher-than-disk-used-or-disk-total/262709 "2021-01-30T09:24:01Z")
Hello, We have a cluster that was upgraded priori this week from version 5.6.16 to version 6.8.13 and upgrade succeeded and everything was running as expected. One day later one of the data node reached disk watermark … --- ## [Where in kibana i can analyze logs coming from logstash , logs that are off line](https://discuss.elastic.co/t/where-in-kibana-i-can-analyze-logs-coming-from-logstash-logs-that-are-off-line/262705)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 2\ **Last updated:** [January 30, 2021, 9:11am UTC](https://discuss.elastic.co/t/where-in-kibana-i-can-analyze-logs-coming-from-logstash-logs-that-are-off-line/262705 "2021-01-30T09:11:12Z")
Hello all i have elastic search which have 2 modes or 2 streams of logs first is the filebeat real-time logs which i can analyze in the kibana logs section. The second is online logs that are uploaded to s3 and they a… --- ## [Problem in deploying an Elasticsearch cluster](https://discuss.elastic.co/t/problem-in-deploying-an-elasticsearch-cluster/262703)
**Author:** [@AayushPatel](https://discuss.elastic.co/u/AayushPatel)\ **Replies:** 1\ **Last updated:** [January 30, 2021, 8:02am UTC](https://discuss.elastic.co/t/problem-in-deploying-an-elasticsearch-cluster/262703 "2021-01-30T08:02:30Z")
Hi I tried to deploy an ELasticsearch cluster by first installing 3 master nodes (stacks 7.9) everything is fine but when I try to connect the nodes to each other some weird situation occurs. at first all the nodes wo… --- ## [Boundary Search x miles from original Boundary](https://discuss.elastic.co/t/boundary-search-x-miles-from-original-boundary/256239)
**Author:** [@mecham](https://discuss.elastic.co/u/mecham)\ **Replies:** 1\ **Last updated:** [January 30, 2021, 7:15am UTC](https://discuss.elastic.co/t/boundary-search-x-miles-from-original-boundary/256239 "2021-01-30T07:15:38Z")
I can across this article and found it very useful: I am trying to achieve something a little different and I thought you might be able to advise. On Rightmove.co.uk you can perform a radius search: https://www.righ… --- ## [Return the top k hits from each bucket after aggregation?](https://discuss.elastic.co/t/return-the-top-k-hits-from-each-bucket-after-aggregation/262687)
**Author:** [@sabetai](https://discuss.elastic.co/u/sabetai)\ **Replies:** 2\ **Last updated:** [January 30, 2021, 12:25am UTC](https://discuss.elastic.co/t/return-the-top-k-hits-from-each-bucket-after-aggregation/262687 "2021-01-30T00:25:17Z")
I'd like the top k hits from each index to be returned, I'm using the following query: GET /index-\*/\_search { "query": { "multi\_match": { "query": "word1 word2", "type": "phrase", "fields": \["fie… --- ## [Logstash 7.2.0 install error](https://discuss.elastic.co/t/logstash-7-2-0-install-error/188356)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 11:33pm UTC](https://discuss.elastic.co/t/logstash-7-2-0-install-error/188356 "2021-01-29T23:33:41Z")
I was upgrading whole stack to 7.2.0 and got following error Updating / installing... 1:logstash-1:7.2.0-1 ################################# \[ 17%\] Using provided startup.options file: /etc/logstash/star… --- ## [JSON Parsing Of Filtered Syslog JSON Objects Fails](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959)
**Author:** [@InfosecAtom](https://discuss.elastic.co/u/InfosecAtom)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 10:42pm UTC](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959 "2021-01-29T22:42:45Z")
I am using the following config and seeing no output. Non-JSON object containing Syslog entries, as well as JSON object containing Syslog entries, are both being dropped. If I comment out the JSON parse then the JSON obj… --- ## [vSphere module fields](https://discuss.elastic.co/t/vsphere-module-fields/262692)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 10:34pm UTC](https://discuss.elastic.co/t/vsphere-module-fields/262692 "2021-01-29T22:34:34Z")
I read somewhere that the vSphere module is in beta version. Is that true? Is there a plan to collect more metrics in vSphere module as the current fields are very limited? --- ## [Is it possible to add to @metadata in Filebeat?](https://discuss.elastic.co/t/is-it-possible-to-add-to-metadata-in-filebeat/262561)
**Author:** [@Alex\_Nelson](https://discuss.elastic.co/u/Alex_Nelson)\ **Replies:** 6\ **Last updated:** [January 29, 2021, 9:21pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-to-metadata-in-filebeat/262561 "2021-01-29T21:21:05Z")
I have the following processors: - add\_fields: target: '@metadata' fields: index\_prefix: 'flow\_metadata\_event' which gives me the following using output.console (note there are 2 object … --- ## [Logstash is not ingesting data in real time](https://discuss.elastic.co/t/logstash-is-not-ingesting-data-in-real-time/262642)
**Author:** [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:23pm UTC](https://discuss.elastic.co/t/logstash-is-not-ingesting-data-in-real-time/262642 "2021-01-29T20:23:11Z")
Hi Everyone, I am ingesting data from thousands of file with logstash into elasticsearch and files are parallely updating and updating records are not ingesting in real time. Please help me out what i need to change se… --- ## [What is the proper design pattern for plugins that must submit multiple requests to Elasticsearch?](https://discuss.elastic.co/t/what-is-the-proper-design-pattern-for-plugins-that-must-submit-multiple-requests-to-elasticsearch/262190)
**Author:** [@davemoore](https://discuss.elastic.co/u/davemoore)\ **Replies:** 13\ **Last updated:** [January 29, 2021, 8:18pm UTC](https://discuss.elastic.co/t/what-is-the-proper-design-pattern-for-plugins-that-must-submit-multiple-requests-to-elasticsearch/262190 "2021-01-29T20:18:47Z")
Question for plugin authors What is the proper way to implement a REST handler in a custom ActionPlugin (a.k.a. API extension plugin) that must wait for the response of multiple Elasticsearch requests before returning a… --- ## [Kibana unable to authenticate](https://discuss.elastic.co/t/kibana-unable-to-authenticate/260830)
**Author:** [@Daniel\_J1996](https://discuss.elastic.co/u/Daniel_J1996)\ **Replies:** 9\ **Last updated:** [January 29, 2021, 8:08pm UTC](https://discuss.elastic.co/t/kibana-unable-to-authenticate/260830 "2021-01-29T20:08:29Z")
Hello, I have been running into an issue with my Kibana dashboard. Currently, it shows "Kibana server is not ready yet". When I use the journalctl -xe command, I see the following error for Kibana: \["warning","plugins"… --- ## [Redis in elk](https://discuss.elastic.co/t/redis-in-elk/262076)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 3:22pm UTC](https://discuss.elastic.co/t/redis-in-elk/262076 "2021-01-29T15:22:21Z")
Hi, I have this elk stack running, 8 datanodes, 4 ingestnodes, 4 logstashes en a shitload of applications that send data from multiple servers via filebeat. The size of these applications vary from 4 servers to 24 on … --- ## [Filebeat Bug: exclude\_lines](https://discuss.elastic.co/t/filebeat-bug-exclude-lines/262611)
**Author:** [@Peter\_Boos](https://discuss.elastic.co/u/Peter_Boos)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 7:39pm UTC](https://discuss.elastic.co/t/filebeat-bug-exclude-lines/262611 "2021-01-29T19:39:49Z")
BUG report filebeat version : filebeat-7.10.1-2021.01.13-000001 problem : The exclude\_lines option in filebeat.yml does not work. Example item to be filtered out : 2021-01-27T02:08:31.775-0500#011INFO#011log/harvest… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1579) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1581)