# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1599 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1600 --- ## [Create scripted field](https://discuss.elastic.co/t/create-scripted-field/261360)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 12:00pm UTC](https://discuss.elastic.co/t/create-scripted-field/261360 "2021-01-18T12:00:59Z")
Hi togehter!!! Hi all. i am new to Kibana and i want to create a scripted field to do the following calculation. how can it be done. Thank you in advance. StartupIOCount = StartupIOPS \* StartupTimeMs / 1000 --- ## [The Sort Script of ES 7.4.2 is very poor](https://discuss.elastic.co/t/the-sort-script-of-es-7-4-2-is-very-poor/261418)
**Author:** [@PandaXu](https://discuss.elastic.co/u/PandaXu)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 11:46am UTC](https://discuss.elastic.co/t/the-sort-script-of-es-7-4-2-is-very-poor/261418 "2021-01-18T11:46:57Z")
hi , all, Our ES has been upgraded from ES 5.3.2 to 7.4.2. When you encounter a script performance problem, the execution of the same script in 7.4.2 is at least twice as slow as that in ES 5.3.2. The main method is t… --- ## [Remove Deprecation warnings in Elasticsearch nodejs client](https://discuss.elastic.co/t/remove-deprecation-warnings-in-elasticsearch-nodejs-client/260385)
**Author:** [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)\ **Replies:** 4\ **Last updated:** [January 18, 2021, 10:14am UTC](https://discuss.elastic.co/t/remove-deprecation-warnings-in-elasticsearch-nodejs-client/260385 "2021-01-18T10:14:59Z")
Hi I'm using node10 (in AWS Lambda), the 7.9 nodejs client version and a 7.9.3 ES cluster (in Elasticsearch service from cloud.elastic.co). Every time I'm calling Elasticsearch I get this in the error log: (node:8) De… --- ## [Rank Feature vs. Decay](https://discuss.elastic.co/t/rank-feature-vs-decay/261403)
**Author:** [@shaigbdb](https://discuss.elastic.co/u/shaigbdb)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 10:10am UTC](https://discuss.elastic.co/t/rank-feature-vs-decay/261403 "2021-01-18T10:10:05Z")
Hi, I'm trying rank feature for a rank field, and comparing the results to a function score using a gauss decay function on a similarly-valued float field. The results are pre-filtered with a geo\_distance query in both … --- ## [Update Dataset with Information comming delayed](https://discuss.elastic.co/t/update-dataset-with-information-comming-delayed/261397)
**Author:** [@michaelpietzsch](https://discuss.elastic.co/u/michaelpietzsch)\ **Replies:** 4\ **Last updated:** [January 18, 2021, 10:07am UTC](https://discuss.elastic.co/t/update-dataset-with-information-comming-delayed/261397 "2021-01-18T10:07:21Z")
Hello dear elastic users, im currently having an issue implementing a logic which updates fields after they have been stored in the elastic. Let me try to explain this to the best of my ability: Theres a log entrance … --- ## [Specific visualization in full screen](https://discuss.elastic.co/t/specific-visualization-in-full-screen/261244)
**Author:** [@cecoi\_gheorghe](https://discuss.elastic.co/u/cecoi_gheorghe)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 9:16am UTC](https://discuss.elastic.co/t/specific-visualization-in-full-screen/261244 "2021-01-18T09:16:43Z")
Hi, I wanted to ask if I can make specific visualization by default to be in full screen mode when I have more visualization in one dashboard. kibana version is 7.9. Thank you in advance --- ## [Make create-metricset error 127](https://discuss.elastic.co/t/make-create-metricset-error-127/261298)
**Author:** [@MatteoM](https://discuss.elastic.co/u/MatteoM)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 9:02am UTC](https://discuss.elastic.co/t/make-create-metricset-error-127/261298 "2021-01-18T09:02:08Z")
Hi there, I'm trying to create a new metric beat and to do this I followed the official guide for dev Creating a Metricset | Beats Developer Guide \[7.16\] | Elastic I cloneed the beat repository with git and moved out i… --- ## [Aggregate on a sequence item in EQL](https://discuss.elastic.co/t/aggregate-on-a-sequence-item-in-eql/259116)
**Author:** [@jayden.mckay](https://discuss.elastic.co/u/jayden.mckay)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 8:48am UTC](https://discuss.elastic.co/t/aggregate-on-a-sequence-item-in-eql/259116 "2021-01-18T08:48:44Z")
Hi all :slight\_smile: I am trying to run an EQL search where the first item must occur X amount of times or more before the second item in the sequence will be ran. Anyone know how I can do this? AKA for the example be… --- ## [Translate: Unquoted fields do not allow \\r or \\n (line 1)](https://discuss.elastic.co/t/translate-unquoted-fields-do-not-allow-r-or-n-line-1/260904)
**Author:** [@EHE](https://discuss.elastic.co/u/EHE)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 8:31am UTC](https://discuss.elastic.co/t/translate-unquoted-fields-do-not-allow-r-or-n-line-1/260904 "2021-01-18T08:31:01Z")
Hello, I am struggling with a translation dilemma, I have been researching for hrs for answers, but i havent found the right one for my issue, and i do not know why i am getting this error: Translate: Unquoted fields d… --- ## [Logstash-7.10.0 repositories available for APT doesn't have release file](https://discuss.elastic.co/t/logstash-7-10-0-repositories-available-for-apt-doesnt-have-release-file/261392)
**Author:** [@saroja](https://discuss.elastic.co/u/saroja)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 7:50am UTC](https://discuss.elastic.co/t/logstash-7-10-0-repositories-available-for-apt-doesnt-have-release-file/261392 "2021-01-18T07:50:24Z")
Hi All, i am unable to install logstash-7.10.0 package from APT repository. To download and install logstash-7.10.0, used the following steps for APT distributions. Download and install the Public Signing Key: $ wg… --- ## [Metric Visualization in Kibana](https://discuss.elastic.co/t/metric-visualization-in-kibana/261374)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 7:42am UTC](https://discuss.elastic.co/t/metric-visualization-in-kibana/261374 "2021-01-18T07:42:44Z")
Here I am showing special characters used in specific subject line. Each special character is separated by comma ( which is also a special character) it may lead to confusion that even those commas are used in sentence… --- ## [Overwrite an index in logstash](https://discuss.elastic.co/t/overwrite-an-index-in-logstash/261345)
**Author:** [@hallaoui](https://discuss.elastic.co/u/hallaoui)\ **Replies:** 4\ **Last updated:** [January 18, 2021, 7:33am UTC](https://discuss.elastic.co/t/overwrite-an-index-in-logstash/261345 "2021-01-18T07:33:45Z")
Hi All, I am collecting alarms status from an oracle database every 5 minutes using logstash and load them into an index, the thing is that the remote DB will contain alarms only if the alarms are still open and I would… --- ## [Getting the message Failed to update shard information for ClusterInfoUpdateJob in the es master logs](https://discuss.elastic.co/t/getting-the-message-failed-to-update-shard-information-for-clusterinfoupdatejob-in-the-es-master-logs/261274)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 7:33am UTC](https://discuss.elastic.co/t/getting-the-message-failed-to-update-shard-information-for-clusterinfoupdatejob-in-the-es-master-logs/261274 "2021-01-18T07:33:18Z")
We are using elasticsearch 7.8.0 on centos 7. There are three data pods in the cluster we are restarting one of the data pod. Suddenly, elasticsearch curl to service stopped working and the following error observes in th… --- ## [How to print the values or grok expression and the line it is working on and file name and path](https://discuss.elastic.co/t/how-to-print-the-values-or-grok-expression-and-the-line-it-is-working-on-and-file-name-and-path/261385)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 6:49am UTC](https://discuss.elastic.co/t/how-to-print-the-values-or-grok-expression-and-the-line-it-is-working-on-and-file-name-and-path/261385 "2021-01-18T06:49:39Z")
i try to find how to print to log the name of the log file and the line the grok expretion is working on right now . here the logstash config : input { s3 { "access\_key\_id" =\> "xxxx" "secret\_acces… --- ## [How to use nginx's host overwrite logstash's host information when send it by filebeat?](https://discuss.elastic.co/t/how-to-use-nginxs-host-overwrite-logstashs-host-information-when-send-it-by-filebeat/261369)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 2:04am UTC](https://discuss.elastic.co/t/how-to-use-nginxs-host-overwrite-logstashs-host-information-when-send-it-by-filebeat/261369 "2021-01-18T02:04:09Z")
Now using filebeat and logstash sending nginx's json log on k8s. The nginx's configuration likes nginx.conf http { log\_format bucket escape=json '{' '"request\_id": "$request\_id",' '"method": "$… --- ## [How to insert data in index-pattern for field with 'Keyword' type using Index API](https://discuss.elastic.co/t/how-to-insert-data-in-index-pattern-for-field-with-keyword-type-using-index-api/261381)
**Author:** [@savan.chovatiya](https://discuss.elastic.co/u/savan.chovatiya)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 5:58am UTC](https://discuss.elastic.co/t/how-to-insert-data-in-index-pattern-for-field-with-keyword-type-using-index-api/261381 "2021-01-18T05:58:33Z")
Hello, Index-pattern contains two fields like below. {"name":"aws\_region","type":"string","count":11,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"aws\_region.keyword","type"… --- ## [The performance of Script Based Sorting in ES 7.4.2 verison is very poor](https://discuss.elastic.co/t/the-performance-of-script-based-sorting-in-es-7-4-2-verison-is-very-poor/261241)
**Author:** [@PandaXu](https://discuss.elastic.co/u/PandaXu)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 5:55am UTC](https://discuss.elastic.co/t/the-performance-of-script-based-sorting-in-es-7-4-2-verison-is-very-poor/261241 "2021-01-18T05:55:09Z")
Hello, all, Recently , We compare the query performance of two versions of ES cluster. One is 5.3.2, and the other is 7.4.2. The index settings, mapping and the amout of data , is exactly the same.I find that the que… --- ## [Pipieline Agrregation](https://discuss.elastic.co/t/pipieline-agrregation/260286)
**Author:** [@Reyhaneh\_Sedehi](https://discuss.elastic.co/u/Reyhaneh_Sedehi)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 5:52am UTC](https://discuss.elastic.co/t/pipieline-agrregation/260286 "2021-01-18T05:52:07Z")
I have fiels as product\_score for each products\_Id field,also have a filed name category for each of product\_id . I want to visualize as Meters for get Maximum of the sum of product\_score for each category. How could I u… --- ## [How can I get a list of users, roles, spaces, etc](https://discuss.elastic.co/t/how-can-i-get-a-list-of-users-roles-spaces-etc/261370)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [January 18, 2021, 3:37am UTC](https://discuss.elastic.co/t/how-can-i-get-a-list-of-users-roles-spaces-etc/261370 "2021-01-18T03:37:01Z")
Hello, Is there a way to list all users, their roles, assigned spaces, etc? Also, in a table format (CSV)? I know Get User API, but it is limited and showing in JSON only. Thanks! --- ## [Elasticsearch7.x have serious performance problems](https://discuss.elastic.co/t/elasticsearch7-x-have-serious-performance-problems/261362)
**Author:** [@gaocx2000cn](https://discuss.elastic.co/u/gaocx2000cn)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 12:47am UTC](https://discuss.elastic.co/t/elasticsearch7-x-have-serious-performance-problems/261362 "2021-01-18T00:47:05Z")
Elasticsearch7.x have serious performance problems. We have a indexes set which have total 3800M doc, 5000G bytes. 1. Searching performance We run a lot of queries against Elasticsearch6.2.1 and Elasticsearch7.9.2 clu… --- ## [I want to add more nodes in my existing cluster](https://discuss.elastic.co/t/i-want-to-add-more-nodes-in-my-existing-cluster/261233)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 7\ **Last updated:** [January 17, 2021, 10:50pm UTC](https://discuss.elastic.co/t/i-want-to-add-more-nodes-in-my-existing-cluster/261233 "2021-01-17T22:50:26Z")
Hi, I have 3 Node cluster (7.9.2) with elasticsearch license. I want to add more 5 Data nodes on my existing cluster. Do I need to have License for extra nodes also? Please Help me with this situation Thanks Regard… --- ## [Seamingly sporadic increases in indexing latency](https://discuss.elastic.co/t/seamingly-sporadic-increases-in-indexing-latency/261166)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 21\ **Last updated:** [January 17, 2021, 10:29pm UTC](https://discuss.elastic.co/t/seamingly-sporadic-increases-in-indexing-latency/261166 "2021-01-17T22:29:30Z")
We have a setup where Flink is writing to Elasticsearch, and at sporadic moments latency increases due to volume of IOPS. Looking for suggestions. Attached are some graphs, when IOPS are high, indexing latency is high, … --- ## [Need help regarding relevancy score sorting in elastic search](https://discuss.elastic.co/t/need-help-regarding-relevancy-score-sorting-in-elastic-search/261361)
**Author:** [@Soumya\_Ranjan\_Sahoo](https://discuss.elastic.co/u/Soumya_Ranjan_Sahoo)\ **Replies:** 0\ **Last updated:** [January 17, 2021, 9:57pm UTC](https://discuss.elastic.co/t/need-help-regarding-relevancy-score-sorting-in-elastic-search/261361 "2021-01-17T21:57:25Z")
\### Settings for Indexing ### import requests import json import logging settings = { 'settings': { 'index': { 'number\_of\_shards': 1, 'number\_of\_replicas': 1, … --- ## [How does one restore just missing backups from a snapshot](https://discuss.elastic.co/t/how-does-one-restore-just-missing-backups-from-a-snapshot/261308)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [January 17, 2021, 9:10pm UTC](https://discuss.elastic.co/t/how-does-one-restore-just-missing-backups-from-a-snapshot/261308 "2021-01-17T21:10:55Z")
I am recovering from a disaster with my cluster and I have a lost about 150 out of 500 indexes. What I would like to do is restore just the missing ones from kibana but not the ones that are OK. Is there a way to do t… --- ## [\[Logstash\] elasticsearch filter error on mark logs](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293)
**Author:** [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)\ **Replies:** 3\ **Last updated:** [January 17, 2021, 8:25pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293 "2021-01-17T20:25:29Z")
Hello, I have two pipeline one main, listen filebeat and put data in elastic, and other with post process, the input is elastic, have one elastic filter (bellow), and put back data in elastic with updates. The main goa… --- ## [Can't curl a just installed elastic in a vm - time out issues](https://discuss.elastic.co/t/cant-curl-a-just-installed-elastic-in-a-vm-time-out-issues/261359)
**Author:** [@Simon\_Poirier](https://discuss.elastic.co/u/Simon_Poirier)\ **Replies:** 2\ **Last updated:** [January 17, 2021, 7:39pm UTC](https://discuss.elastic.co/t/cant-curl-a-just-installed-elastic-in-a-vm-time-out-issues/261359 "2021-01-17T19:39:27Z")
Hi there, I have a VM with Elastic and kibana working fine in an 20.04 ubuntu. I am now trying to send curl operations on the rest api, from my host, but i got timed out. in the vm it's working fine. when i do : sudo … --- ## [How does Elasticsearch map Integer doc IDs to shards](https://discuss.elastic.co/t/how-does-elasticsearch-map-integer-doc-ids-to-shards/261329)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 7\ **Last updated:** [January 17, 2021, 6:58pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-map-integer-doc-ids-to-shards/261329 "2021-01-17T18:58:59Z")
How does Elasticsearch map Integer doc IDs to shards? What algorithm does it use? I've been digging around but haven't seemed to find the answer. For context, every document we have has an id that's a row id from postg… --- ## [Lines chart visualization problem](https://discuss.elastic.co/t/lines-chart-visualization-problem/261356)
**Author:** [@Tim\_Zachow](https://discuss.elastic.co/u/Tim_Zachow)\ **Replies:** 2\ **Last updated:** [January 17, 2021, 6:56pm UTC](https://discuss.elastic.co/t/lines-chart-visualization-problem/261356 "2021-01-17T18:56:54Z")
Good day everyone, I successfully loaded a data set into my elasticsearch index about import data of a given country. As you can see, it seems bugged since not every line is getting visualized correctly. I'm fairly ce… --- ## [Elasticsearch: Failed to obtain node locks](https://discuss.elastic.co/t/elasticsearch-failed-to-obtain-node-locks/260102)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 12\ **Last updated:** [January 17, 2021, 6:34pm UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-obtain-node-locks/260102 "2021-01-17T18:34:45Z")
Kibana version : 7.8.0 Elasticsearch version : 7.8.0 APM Server version : 7.8.0 Hi Team My elasticsearch server is up and running from more than 2-3 months. All of a sudden it's down today. When I tried to debug I se… --- ## [Logstash read previous events fields from elasticsearch in case of high events rate](https://discuss.elastic.co/t/logstash-read-previous-events-fields-from-elasticsearch-in-case-of-high-events-rate/260756)
**Author:** [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Replies:** 3\ **Last updated:** [January 17, 2021, 6:29pm UTC](https://discuss.elastic.co/t/logstash-read-previous-events-fields-from-elasticsearch-in-case-of-high-events-rate/260756 "2021-01-17T18:29:06Z")
Hello In case of high events rate, if I have multiple events (with predefined order) and I want to copy field from the first event to the subsequent events using logstash elasticsearch filter Is there a way to guarante… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1598) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1600)