# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1590 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1591 --- ## [Throttle filter: Notify on throttle](https://discuss.elastic.co/t/throttle-filter-notify-on-throttle/261861)
**Author:** [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)\ **Replies:** 8\ **Last updated:** [January 24, 2021, 4:51pm UTC](https://discuss.elastic.co/t/throttle-filter-notify-on-throttle/261861 "2021-01-24T16:51:15Z")
When using the throttle filter, how would I go about notifying one event once the throttle has triggered? Meaning if I allow 5 events per minute, I'd like to know somehow if there has been a 6th event and send a mail or… --- ## [Canvas SQL: Unexpected result of an SQL query](https://discuss.elastic.co/t/canvas-sql-unexpected-result-of-an-sql-query/259386)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 14\ **Last updated:** [January 24, 2021, 2:49pm UTC](https://discuss.elastic.co/t/canvas-sql-unexpected-result-of-an-sql-query/259386 "2021-01-24T14:49:31Z")
Hello everybody, I am trying to display in canvas the users that have more than 10 authentication failed, so I am using this SQL query: SELECT COUNT(\*) as result\_count FROM ( SELECT user.name, COUNT(\*) as result FROM… --- ## [Bad Request - Specifying types in document get requests is deprecated](https://discuss.elastic.co/t/bad-request-specifying-types-in-document-get-requests-is-deprecated/262024)
**Author:** [@shlomys](https://discuss.elastic.co/u/shlomys)\ **Replies:** 2\ **Last updated:** [January 24, 2021, 12:39pm UTC](https://discuss.elastic.co/t/bad-request-specifying-types-in-document-get-requests-is-deprecated/262024 "2021-01-24T12:39:48Z")
Hi, Since upgrading elastic stack docker containers to 7.10.2 I get the following error whenever trying to open a new transaction with the .net Elastic.Apm 1.7.1 : StatusCode: 400, ReasonPhrase: 'Bad Request', Version:… --- ## [How to index nanoseconds precision events with Logstash (7.10) and type date\_nanos](https://discuss.elastic.co/t/how-to-index-nanoseconds-precision-events-with-logstash-7-10-and-type-date-nanos/262029)
**Author:** [@juan.domenech](https://discuss.elastic.co/u/juan.domenech)\ **Replies:** 0\ **Last updated:** [January 24, 2021, 11:14am UTC](https://discuss.elastic.co/t/how-to-index-nanoseconds-precision-events-with-logstash-7-10-and-type-date-nanos/262029 "2021-01-24T11:14:24Z")
Problem statement Elasticsearch 7.10 supports timestamp with nanoseconds precision (type date\_nanos) Kibana 7.10 visualises these timestamps but Logstash can't handle them yet (precision above milliseconds is lost whe… --- ## [Accessing individual values in a logstash](https://discuss.elastic.co/t/accessing-individual-values-in-a-logstash/262027)
**Author:** [@learner1](https://discuss.elastic.co/u/learner1)\ **Replies:** 0\ **Last updated:** [January 24, 2021, 9:53am UTC](https://discuss.elastic.co/t/accessing-individual-values-in-a-logstash/262027 "2021-01-24T09:53:06Z")
I'm trying to mask some values in the logs but looks like it's not working because of the log format. Here is the format: "\_source": { "log": "2021-01-24 07:15:37 +0000 \[warn\]: #0 dump an error event: error\_cl… --- ## [How to manage data with high update rate?](https://discuss.elastic.co/t/how-to-manage-data-with-high-update-rate/261995)
**Author:** [@alireza\_jazayerei](https://discuss.elastic.co/u/alireza_jazayerei)\ **Replies:** 4\ **Last updated:** [January 24, 2021, 5:34am UTC](https://discuss.elastic.co/t/how-to-manage-data-with-high-update-rate/261995 "2021-01-24T05:34:34Z")
hello everyone I want to implement an advanced search system that has the ability to sort results by their popularity. I feel that update operation is expensive in elastic search. what is the best way to store user like… --- ## [\[Solved\] Data path already locked by another beat](https://discuss.elastic.co/t/solved-data-path-already-locked-by-another-beat/262018)
**Author:** [@jfasajr](https://discuss.elastic.co/u/jfasajr)\ **Replies:** 1\ **Last updated:** [January 24, 2021, 2:33am UTC](https://discuss.elastic.co/t/solved-data-path-already-locked-by-another-beat/262018 "2021-01-24T02:33:40Z")
I'm not particularly sure what to do about the following error. I've read a few things and everyone seems to say that it's either a failed shutdown or second instance. However none of my troubleshooting has rendered resu… --- ## [Errors ("type" : "security\_exception") in running ElasticSearch](https://discuss.elastic.co/t/errors-type-security-exception-in-running-elasticsearch/262004)
**Author:** [@SMH](https://discuss.elastic.co/u/SMH)\ **Replies:** 5\ **Last updated:** [January 24, 2021, 2:17am UTC](https://discuss.elastic.co/t/errors-type-security-exception-in-running-elasticsearch/262004 "2021-01-24T02:17:33Z")
Hi, I have some difficulties when I run the elasticsearch on Windows. I wonder if you could help me in this process to solve the error. My Java version is: java version "1.8.0\_271" I installed elasticsearch, successf… --- ## [Reporting error forbidden kibana](https://discuss.elastic.co/t/reporting-error-forbidden-kibana/261873)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 3\ **Last updated:** [January 23, 2021, 9:47pm UTC](https://discuss.elastic.co/t/reporting-error-forbidden-kibana/261873 "2021-01-23T21:47:35Z")
Hi, I got the error "reporting error forbidden kibana" when I'm trying to download the CSV file from Kibana... I did kibana configurations in https://www.elastic.co/guide/en/kibana/current/secure-reporting.html but I g… --- ## [License Expiry issue in Elasticsearch 7.10.2](https://discuss.elastic.co/t/license-expiry-issue-in-elasticsearch-7-10-2/261982)
**Author:** [@Pritheka](https://discuss.elastic.co/u/Pritheka)\ **Replies:** 1\ **Last updated:** [January 23, 2021, 6:11pm UTC](https://discuss.elastic.co/t/license-expiry-issue-in-elasticsearch-7-10-2/261982 "2021-01-23T18:11:16Z")
I installed 'Elasticsearch-7.10.2' recently. When i run it, i get the below error in the logs. \[ERROR\]\[o.e.x.s.a.f.SecurityActionFilter\] \[LAPTOP-05GRP0LP\] blocking \[cluster:monitor/nodes/stats\] operation due to expired … --- ## [Is there a way to do a project transform in Vega-Lite?](https://discuss.elastic.co/t/is-there-a-way-to-do-a-project-transform-in-vega-lite/261992)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 1\ **Last updated:** [January 23, 2021, 3:04pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-do-a-project-transform-in-vega-lite/261992 "2021-01-23T15:04:55Z")
Hi all, I'm having difficult to transform the data in Vega-Lite, and saw a project transform in the Vega documentation that is not in Vega-Lite. 1- Is it possible to use, is there some workaround? 2- Can I use my Vega… --- ## [ElasticSearch Stream NEW INCOMING documents to clients](https://discuss.elastic.co/t/elasticsearch-stream-new-incoming-documents-to-clients/261763)
**Author:** [@schubec](https://discuss.elastic.co/u/schubec)\ **Replies:** 6\ **Last updated:** [January 23, 2021, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-stream-new-incoming-documents-to-clients/261763 "2021-01-23T13:18:16Z")
Hi! I have this usecase: I receive ca 500 documents of cars (brand, model, color, airbag yes/no, etc.) per second and I am storing these in ElasticSearch. It works perfectly. Then, I have a webclient, which searches f… --- ## [\[Winlogbeat 7.10.1 dashboards\]: could not locate some index pattern fields](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261984)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [January 23, 2021, 9:27am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261984 "2021-01-23T09:27:20Z")
Hello, I am using Elasticsearch, kibana, logstash, and winlogbeat, all version 7.10.1 I configured winlogbeat and run: .\\winlogbeat.exe setup -e and I had no error in my winlogbeat logs, but in kibana there are some da… --- ## [How to dump the index and posting list?](https://discuss.elastic.co/t/how-to-dump-the-index-and-posting-list/261977)
**Author:** [@ralgo](https://discuss.elastic.co/u/ralgo)\ **Replies:** 0\ **Last updated:** [January 23, 2021, 7:01am UTC](https://discuss.elastic.co/t/how-to-dump-the-index-and-posting-list/261977 "2021-01-23T07:01:11Z")
I am writing an analysis plugin for elasticsearch, which maps a sentence to a prefix array. e.g. "EVA EGG京" will be mapped to term array \[E, EV, EVA, E, EG, EGG, 京\]. However, when I search one of \[E，EV，EVA，E, EG，EGG\], t… --- ## [Take incremental snapshot with curator](https://discuss.elastic.co/t/take-incremental-snapshot-with-curator/261975)
**Author:** [@k.naderlu](https://discuss.elastic.co/u/k.naderlu)\ **Replies:** 0\ **Last updated:** [January 23, 2021, 6:05am UTC](https://discuss.elastic.co/t/take-incremental-snapshot-with-curator/261975 "2021-01-23T06:05:08Z")
Hi, I want to take an incremental snapshot in curator v5.8, how I can do this? how I can do this with an action file? --- ## [Update field Object using UpdateQuery](https://discuss.elastic.co/t/update-field-object-using-updatequery/261973)
**Author:** [@cmcruzata](https://discuss.elastic.co/u/cmcruzata)\ **Replies:** 0\ **Last updated:** [January 23, 2021, 5:09am UTC](https://discuss.elastic.co/t/update-field-object-using-updatequery/261973 "2021-01-23T05:09:42Z")
Hi, I need to create an update query to update the relation inside the index, given the relation ID: @Entity @Document(indexName = "employees", shards = 3) public class Employee { @Id @GeneratedV… --- ## [Setting id field in client request and also using date name processor](https://discuss.elastic.co/t/setting-id-field-in-client-request-and-also-using-date-name-processor/261968)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 0\ **Last updated:** [January 23, 2021, 1:05am UTC](https://discuss.elastic.co/t/setting-id-field-in-client-request-and-also-using-date-name-processor/261968 "2021-01-23T01:05:03Z")
Hi all, I had a question about sending id field in the client request and also using the date name processor to create indices based on a field value. So here is my use case , I want to produce daily indices based on a… --- ## [Download Kibana Report from outside Kibana](https://discuss.elastic.co/t/download-kibana-report-from-outside-kibana/260582)
**Author:** [@ssarnava](https://discuss.elastic.co/u/ssarnava)\ **Replies:** 4\ **Last updated:** [January 22, 2021, 11:00pm UTC](https://discuss.elastic.co/t/download-kibana-report-from-outside-kibana/260582 "2021-01-22T23:00:31Z")
Hi, I am using ELK 7.9.0 version. I am able to generate dashboard report from Kibana and can download that report from inside Kibana. But my requirement is little different. I have to trigger CSV dashboard report genera… --- ## [Filebeat AWS s3 input -- SQS required?](https://discuss.elastic.co/t/filebeat-aws-s3-input-sqs-required/261963)
**Author:** [@klutch27](https://discuss.elastic.co/u/klutch27)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 10:55pm UTC](https://discuss.elastic.co/t/filebeat-aws-s3-input-sqs-required/261963 "2021-01-22T22:55:21Z")
I have log files in s3, and I'd like to use filebeat to ship them to logstash. I'm not using AWS SQS, so I have no queue\_url. Is it possible for me to consume log files from my s3 bucket, without using SQS? I was hoping… --- ## [Mapper\_parsing\_exception](https://discuss.elastic.co/t/mapper-parsing-exception/261871)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 3\ **Last updated:** [January 22, 2021, 10:05pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception/261871 "2021-01-22T22:05:01Z")
Hello Team, I have been getting this issue no matter what. I have applied mutate (convert,rename) json but still get the following issue. "reason"=\>"Could not dynamically add mapping for field \[app.kubernetes.io/name\].… --- ## [Subset match query](https://discuss.elastic.co/t/subset-match-query/261847)
**Author:** [@Josue-Salas](https://discuss.elastic.co/u/Josue-Salas)\ **Replies:** 3\ **Last updated:** [January 22, 2021, 10:03pm UTC](https://discuss.elastic.co/t/subset-match-query/261847 "2021-01-22T22:03:42Z")
Hi everyone, Thanks for reading. Here's my problem. I have the following documents: "course #1": { "requirements": \[ { "name": "AWS EC2 certification", "type": "certification" … --- ## [Elasticsearch service - Kibana link results in 404](https://discuss.elastic.co/t/elasticsearch-service-kibana-link-results-in-404/261862)
**Author:** [@Mike\_Connor](https://discuss.elastic.co/u/Mike_Connor)\ **Replies:** 5\ **Last updated:** [January 22, 2021, 8:43pm UTC](https://discuss.elastic.co/t/elasticsearch-service-kibana-link-results-in-404/261862 "2021-01-22T20:43:47Z")
A few hours ago, my kibana session expired or I got kicked out. Now when I click the link from the deployment page on clould.elastic.co, I end up with a raw 404. A callback error? I have been having a bunch of problem… --- ## [Can't get filebeat log data into Elasticsearch](https://discuss.elastic.co/t/cant-get-filebeat-log-data-into-elasticsearch/261943)
**Author:** [@thnk2wn](https://discuss.elastic.co/u/thnk2wn)\ **Replies:** 3\ **Last updated:** [January 22, 2021, 6:50pm UTC](https://discuss.elastic.co/t/cant-get-filebeat-log-data-into-elasticsearch/261943 "2021-01-22T18:50:45Z")
I'm trying out file beats but can't seem to get the data into Elasticsearch. I don't see issues on the filebeat side but don't see the data in Elasticsearch. My demo repo is at https://github.com/thnk2wn/elastic-logging-… --- ## [How to split value in different coloum in data table](https://discuss.elastic.co/t/how-to-split-value-in-different-coloum-in-data-table/261624)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 6\ **Last updated:** [January 22, 2021, 6:32pm UTC](https://discuss.elastic.co/t/how-to-split-value-in-different-coloum-in-data-table/261624 "2021-01-22T18:32:00Z")
Hi, I am using ELK 7.10v. I have a use case where I want to show " Total brokerage amout of clients monthly wise." I have 3 fields :- client\_id, time and brokerage . I want my data table to look like this: Client… --- ## [Logstash ruby filter math on very large numbers](https://discuss.elastic.co/t/logstash-ruby-filter-math-on-very-large-numbers/261950)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 6:26pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-math-on-very-large-numbers/261950 "2021-01-22T18:26:18Z")
Hello, I am trying to do some math on some very large numbers in logstash and it appears that the .to\_f is not large enough as its giving me very inaccurate information. is there anything larger than a float I can use? … --- ## [Large shards are not moving from old ES version nodes to new ES version nodes](https://discuss.elastic.co/t/large-shards-are-not-moving-from-old-es-version-nodes-to-new-es-version-nodes/261864)
**Author:** [@163satish](https://discuss.elastic.co/u/163satish)\ **Replies:** 7\ **Last updated:** [January 22, 2021, 6:19pm UTC](https://discuss.elastic.co/t/large-shards-are-not-moving-from-old-es-version-nodes-to-new-es-version-nodes/261864 "2021-01-22T18:19:57Z")
I have 6.8 cluster which is being upgraded to 7.6 cluster. Shard relocation on all the shards which are smaller in size is completed which is basically moving from 6.8 to 7.6 data nodes. The large shards for some of the … --- ## [Planned change of license to SSPL](https://discuss.elastic.co/t/planned-change-of-license-to-sspl/261279)
**Author:** [@johann-petrak](https://discuss.elastic.co/u/johann-petrak)\ **Replies:** 3\ **Last updated:** [January 22, 2021, 5:50pm UTC](https://discuss.elastic.co/t/planned-change-of-license-to-sspl/261279 "2021-01-22T17:50:52Z")
I think the planned change from Apache 2 to SSPL for ES and Kibana will not just motivate myself to seriously look for other solutions. (see https://www.elastic.co/blog/licensing-change) SSPL seems to be extremely rest… --- ## [Error while starting kibana plugin examples in kibana version 7.10.0](https://discuss.elastic.co/t/error-while-starting-kibana-plugin-examples-in-kibana-version-7-10-0/261780)
**Author:** [@rajarshi\_h](https://discuss.elastic.co/u/rajarshi_h)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 5:10pm UTC](https://discuss.elastic.co/t/error-while-starting-kibana-plugin-examples-in-kibana-version-7-10-0/261780 "2021-01-22T17:10:08Z")
Hi, I am not able to run the example kibana plugins that are available on the open source kibana repository for version 7.10.0 using the command "yarn start --run-examples" and I am getting the error that "Definition of… --- ## [Elasticsearch NEST query not behaving like the equivalent query in Kibana Dev Tools](https://discuss.elastic.co/t/elasticsearch-nest-query-not-behaving-like-the-equivalent-query-in-kibana-dev-tools/261867)
**Author:** [@jonsagara](https://discuss.elastic.co/u/jonsagara)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 5:05pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-query-not-behaving-like-the-equivalent-query-in-kibana-dev-tools/261867 "2021-01-22T17:05:13Z")
I'm trying to construct a query against my index that will use function\_score to boost records where fields have certain values. In Kibana Dev Tools, I have the following query that returns 3 hits as expected: GET /myin… --- ## [Creating job: anomaly in the event rate of beats](https://discuss.elastic.co/t/creating-job-anomaly-in-the-event-rate-of-beats/261889)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 4:38pm UTC](https://discuss.elastic.co/t/creating-job-anomaly-in-the-event-rate-of-beats/261889 "2021-01-22T16:38:52Z")
Hello, I would like to create a job to detect when there is anomaly in the number of event send by beats, mostly to detect if one of the beat stop sending logs to my ELK cluster (and to detect the name of the machine wh… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1589) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1591)