# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=161 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 162 --- ## [Elasticsearch Watcher - socket\_timeout\_exception when trying to send a .pdf email attachment generated from a Dashboard](https://discuss.elastic.co/t/elasticsearch-watcher-socket-timeout-exception-when-trying-to-send-a-pdf-email-attachment-generated-from-a-dashboard/367260)
**Author:** [@ameindel](https://discuss.elastic.co/u/ameindel)\ **Replies:** 5\ **Last updated:** [September 30, 2024, 7:22pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-socket-timeout-exception-when-trying-to-send-a-pdf-email-attachment-generated-from-a-dashboard/367260 "2024-09-30T19:22:59Z")
Hello there! I have been tasked with setting up a Watcher that will email a pdf attachment that is generated from a dashboard. After creating the Watcher and letting it run, I get repeated errors that point to a 'socke… --- ## [Shard allocation](https://discuss.elastic.co/t/shard-allocation/368035)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 7\ **Last updated:** [September 30, 2024, 6:43pm UTC](https://discuss.elastic.co/t/shard-allocation/368035 "2024-09-30T18:43:53Z")
Hi I have a 9 data nodes, what kind of settings should I use for insure allocation one index with 9 shards and 1 replica for (one primary shard per data node)??? --- ## [Regexp - Case Insensitive Not working?](https://discuss.elastic.co/t/regexp-case-insensitive-not-working/367259)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [September 30, 2024, 6:28pm UTC](https://discuss.elastic.co/t/regexp-case-insensitive-not-working/367259 "2024-09-30T18:28:30Z")
Hello, I am use a regexp query to locate a directory in a 'file.directory' When I try to run this: " { "regexp": { "file.directory": { "case\_insensitive": true, "value": "////home.\*" } } } Exp… --- ## [Elastic Agent with Custom Logs capturing mapping errors in event logs](https://discuss.elastic.co/t/elastic-agent-with-custom-logs-capturing-mapping-errors-in-event-logs/366815)
**Author:** [@jeffabar](https://discuss.elastic.co/u/jeffabar)\ **Replies:** 6\ **Last updated:** [September 30, 2024, 5:55pm UTC](https://discuss.elastic.co/t/elastic-agent-with-custom-logs-capturing-mapping-errors-in-event-logs/366815 "2024-09-30T17:55:53Z")
I have an elastic agent running in a docker container with a custom logs integration. The elastic agent generates this warning when ingesting logs: 2024-09-11 11:14:59 {"log.level":"warn","@timestamp":"2024-09-11T15:14:… --- ## [Change/specify custom analyzer to existing index or how to reindex with custom analyzer](https://discuss.elastic.co/t/change-specify-custom-analyzer-to-existing-index-or-how-to-reindex-with-custom-analyzer/368032)
**Author:** [@Wilson\_Chen](https://discuss.elastic.co/u/Wilson_Chen)\ **Replies:** 1\ **Last updated:** [September 30, 2024, 4:09pm UTC](https://discuss.elastic.co/t/change-specify-custom-analyzer-to-existing-index-or-how-to-reindex-with-custom-analyzer/368032 "2024-09-30T16:09:27Z")
Hi, I've indexed over 10 million documents and realized some of the fields should use specific custom analyzers (per language). The index has over 50 fields, like below: { ..... "title": "blah", "japaneseTitl… --- ## [Issue with ElasticSearch 7.1X to be migration from RHEL7 to RHEL8 host](https://discuss.elastic.co/t/issue-with-elasticsearch-7-1x-to-be-migration-from-rhel7-to-rhel8-host/367109)
**Author:** [@ChezPatron](https://discuss.elastic.co/u/ChezPatron)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 1:29pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-7-1x-to-be-migration-from-rhel7-to-rhel8-host/367109 "2024-09-25T13:29:53Z")
I am migrating Elasticsearch nodes on 7.1X from Aqulion 7 to Aqulion 8 hosts. But I am getting below error. I know solution provided on different other threads is given as below but this doesn't help us. So, please provi… --- ## [ES|QL Table panel, column default width](https://discuss.elastic.co/t/es-ql-table-panel-column-default-width/368031)
**Author:** [@cgame](https://discuss.elastic.co/u/cgame)\ **Replies:** 2\ **Last updated:** [September 30, 2024, 3:32pm UTC](https://discuss.elastic.co/t/es-ql-table-panel-column-default-width/368031 "2024-09-30T15:32:38Z")
Hi, when creating a table from ES|QL query, is it possible to preset columns widths, or auto-adapt to content ? Also is there a way to colorize cells and/or text in cells ? Thanks, --- ## [Sum of max value over time interval](https://discuss.elastic.co/t/sum-of-max-value-over-time-interval/368030)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [September 30, 2024, 3:07pm UTC](https://discuss.elastic.co/t/sum-of-max-value-over-time-interval/368030 "2024-09-30T15:07:40Z")
I have color total\_value @timestamp red 90 X red 90 X blue 80 X yellow 70 X red 90 … --- ## [RRF score in Hybrid Search](https://discuss.elastic.co/t/rrf-score-in-hybrid-search/368012)
**Author:** [@Shilpi95](https://discuss.elastic.co/u/Shilpi95)\ **Replies:** 6\ **Last updated:** [September 30, 2024, 3:05pm UTC](https://discuss.elastic.co/t/rrf-score-in-hybrid-search/368012 "2024-09-30T15:05:12Z")
Hi Team, I'm working on hybrid search using elastic. Below is the code snippet I'm using- search\_query = { "size": k, "query": { 'bool': { 'should': { 'mu… --- ## [Warning: regular expression has redundant nested repeat operator in grok-pure.rb file](https://discuss.elastic.co/t/warning-regular-expression-has-redundant-nested-repeat-operator-in-grok-pure-rb-file/368027)
**Author:** [@Mahesh\_Kumar1](https://discuss.elastic.co/u/Mahesh_Kumar1)\ **Replies:** 0\ **Last updated:** [September 30, 2024, 2:40pm UTC](https://discuss.elastic.co/t/warning-regular-expression-has-redundant-nested-repeat-operator-in-grok-pure-rb-file/368027 "2024-09-30T14:40:44Z")
After migration to the logstash 8.xx version i have a new warning while running the logstash server. How to fix it?? "/logstash-8.15.1/vendor/bundle/jruby/3.1.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:127: warning: regul… --- ## [You are in a modal dialog. Press Escape or tap/click outside the dialog on the shadowed overlay to close. You can still continue tabbing through the page headers in addition to the dialog. Error details TypeError: Cannot read properties of undefined (read](https://discuss.elastic.co/t/you-are-in-a-modal-dialog-press-escape-or-tap-click-outside-the-dialog-on-the-shadowed-overlay-to-close-you-can-still-continue-tabbing-through-the-page-headers-in-addition-to-the-dialog-error-details-typeerror-cannot-read-properties-of-undefined-read/368024)
**Author:** [@techtuga](https://discuss.elastic.co/u/techtuga)\ **Replies:** 0\ **Last updated:** [September 30, 2024, 2:16pm UTC](https://discuss.elastic.co/t/you-are-in-a-modal-dialog-press-escape-or-tap-click-outside-the-dialog-on-the-shadowed-overlay-to-close-you-can-still-continue-tabbing-through-the-page-headers-in-addition-to-the-dialog-error-details-typeerror-cannot-read-properties-of-undefined-read/368024 "2024-09-30T14:16:02Z")
Kibana 8.15.1: Elasticsearch 8.15.1: APM Server 8.15.1: Brave and Edge: Upgrade from 8.9.1 to 8.15.1: Hi Community, We are facing some issues on Kibana, regarding the visualization of the Mappings of Indices, if we… --- ## [Why can't Builders be reused after being build()-t](https://discuss.elastic.co/t/why-cant-builders-be-reused-after-being-build-t/367999)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 2\ **Last updated:** [September 30, 2024, 1:15pm UTC](https://discuss.elastic.co/t/why-cant-builders-be-reused-after-being-build-t/367999 "2024-09-30T13:15:59Z")
I keep getting caught out by Error: java.lang.IllegalStateException: Object builders can only be used once errors. This is my fault for creating a builder outside of the query lambda and then calling builder.build() ins… --- ## [Is it a bad idea to push all traffic from logstash into the ingest nodes?](https://discuss.elastic.co/t/is-it-a-bad-idea-to-push-all-traffic-from-logstash-into-the-ingest-nodes/367184)
**Author:** [@calvin1](https://discuss.elastic.co/u/calvin1)\ **Replies:** 2\ **Last updated:** [September 30, 2024, 10:52am UTC](https://discuss.elastic.co/t/is-it-a-bad-idea-to-push-all-traffic-from-logstash-into-the-ingest-nodes/367184 "2024-09-30T10:52:58Z")
Hi It appears that the normal path is to use either logstash OR ingest nodes for inbound traffic. in these two forms: beats clients -\> ingest -\> hot data nodes or beats clients -\> logstash -\> hot data nodes But is … --- ## [I'm trying to find elastic search cost compared to Azure AI search | how it works](https://discuss.elastic.co/t/im-trying-to-find-elastic-search-cost-compared-to-azure-ai-search-how-it-works/368014)
**Author:** [@haider\_ali](https://discuss.elastic.co/u/haider_ali)\ **Replies:** 0\ **Last updated:** [September 30, 2024, 10:32am UTC](https://discuss.elastic.co/t/im-trying-to-find-elastic-search-cost-compared-to-azure-ai-search-how-it-works/368014 "2024-09-30T10:32:38Z")
https://cloud.elastic.co/pricing?elektra=pricing-page I'm calculating here but didn't know what selections I needed. --- ## [Search a field with a lookup value list](https://discuss.elastic.co/t/search-a-field-with-a-lookup-value-list/367974)
**Author:** [@Wilson\_Chen](https://discuss.elastic.co/u/Wilson_Chen)\ **Replies:** 4\ **Last updated:** [September 30, 2024, 10:14am UTC](https://discuss.elastic.co/t/search-a-field-with-a-lookup-value-list/367974 "2024-09-30T10:14:08Z")
Hi, I guess my use case is quite the opposite than normal case. I have a document, where it has a field, like below: { 'productCategoryId': 2 } And in my system, I have a list of product types, like below: 1 = f… --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/366844)
**Author:** [@BINDUN26](https://discuss.elastic.co/u/BINDUN26)\ **Replies:** 3\ **Last updated:** [September 30, 2024, 10:13am UTC](https://discuss.elastic.co/t/filebeat-error/366844 "2024-09-30T10:13:32Z")
the file beat:active(exited). why? --- ## [Need help in writing aggregate query](https://discuss.elastic.co/t/need-help-in-writing-aggregate-query/367982)
**Author:** [@vkrishna](https://discuss.elastic.co/u/vkrishna)\ **Replies:** 3\ **Last updated:** [September 30, 2024, 7:59am UTC](https://discuss.elastic.co/t/need-help-in-writing-aggregate-query/367982 "2024-09-30T07:59:13Z")
Hi Team, I need help in writing below aggregate query. Use co.elastic.clients.elasticsearch.core.SearchRequest co.elastic.clients.elasticsearch.\_types.query\_dsl.Query. I want to convert below sql query to elastic quer… --- ## [Unexpected higher total ops \[7\] compared to expected \[6\]](https://discuss.elastic.co/t/unexpected-higher-total-ops-7-compared-to-expected-6/367988)
**Author:** [@Chanaka\_Liyanarachch](https://discuss.elastic.co/u/Chanaka_Liyanarachch)\ **Replies:** 1\ **Last updated:** [September 30, 2024, 5:59am UTC](https://discuss.elastic.co/t/unexpected-higher-total-ops-7-compared-to-expected-6/367988 "2024-09-30T05:59:15Z")
I'm getting the below error from time to time and every time, the master node Goes down due to the below error, \[2024-09-24T15:39:12,682\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[xxx-xxx-xxxx-elasticsearch-m… --- ## [Logstash doesn't deliver input to output](https://discuss.elastic.co/t/logstash-doesnt-deliver-input-to-output/367976)
**Author:** [@evgeniy](https://discuss.elastic.co/u/evgeniy)\ **Replies:** 3\ **Last updated:** [September 30, 2024, 6:13am UTC](https://discuss.elastic.co/t/logstash-doesnt-deliver-input-to-output/367976 "2024-09-30T06:13:15Z")
I don't understand why logstash doesn't deliver input data to output. logstash is running in docker, alongside kibana and elastic. logstash.conf input { file { mode =\> "read" codec =\> "json\_lines" add\_fi… --- ## [Issue with Extracting "trace\_id" from Logs in Elasticsearch Using Filebeat Pipeline](https://discuss.elastic.co/t/issue-with-extracting-trace-id-from-logs-in-elasticsearch-using-filebeat-pipeline/367185)
**Author:** [@helloworld466](https://discuss.elastic.co/u/helloworld466)\ **Replies:** 5\ **Last updated:** [September 30, 2024, 6:03am UTC](https://discuss.elastic.co/t/issue-with-extracting-trace-id-from-logs-in-elasticsearch-using-filebeat-pipeline/367185 "2024-09-30T06:03:03Z")
I am currently pushing logs to the Elasticsearch from Filebeat. I’m trying to extract the trace\_id from the message field and store the value in a separate field. The message field has the value: 2024-09-23 10:00:915 \[h… --- ## [Data Table Equivalent to Display 200,000 rows of data](https://discuss.elastic.co/t/data-table-equivalent-to-display-200-000-rows-of-data/366951)
**Author:** [@ManiS](https://discuss.elastic.co/u/ManiS)\ **Replies:** 10\ **Last updated:** [September 30, 2024, 4:24am UTC](https://discuss.elastic.co/t/data-table-equivalent-to-display-200-000-rows-of-data/366951 "2024-09-30T04:24:57Z")
Hi all, I'm trying to create a Data Table visualization based on an Index that has around 200,000 rows of data. However, when the data table index tries to display the visualization, it is failing with the following err… --- ## [Configuring cipher\_suites works but ssl.cipher\_suites not working](https://discuss.elastic.co/t/configuring-cipher-suites-works-but-ssl-cipher-suites-not-working/360346)
**Author:** [@teja\_tata](https://discuss.elastic.co/u/teja_tata)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 7:16am UTC](https://discuss.elastic.co/t/configuring-cipher-suites-works-but-ssl-cipher-suites-not-working/360346 "2024-05-28T07:16:03Z")
I want to configure particular cipher suites to be used by filebeat to connect with logstash. While using ssl.cipher\_suites I was getting below error log {"log.level":"error","@timestamp":"2024-05-28T06:28:10.029Z","lo… --- ## [Remove access to the menu on the left of the kibana 8.15 screen](https://discuss.elastic.co/t/remove-access-to-the-menu-on-the-left-of-the-kibana-8-15-screen/366215)
**Author:** [@johnwood](https://discuss.elastic.co/u/johnwood)\ **Replies:** 3\ **Last updated:** [September 30, 2024, 12:15am UTC](https://discuss.elastic.co/t/remove-access-to-the-menu-on-the-left-of-the-kibana-8-15-screen/366215 "2024-09-30T00:15:18Z")
I have successfully limited users' access to the dashboards and set a default route to the first dashboard. The final thing I need to do is to stop them using the menu on the left and selecting Analytics\>Dashboards and … --- ## [Tried to setup password but elasticsearch stucks](https://discuss.elastic.co/t/tried-to-setup-password-but-elasticsearch-stucks/367980)
**Author:** [@Sena1](https://discuss.elastic.co/u/Sena1)\ **Replies:** 0\ **Last updated:** [September 29, 2024, 8:51pm UTC](https://discuss.elastic.co/t/tried-to-setup-password-but-elasticsearch-stucks/367980 "2024-09-29T20:51:20Z")
I am trying to set up Elasticsearch on AWS EC2. It ran correctly at the beginning, but when I tried to set up the password, it got stuck. Initially, I was able to set a password using the interactive command, but then it… --- ## [How to do batched fetching with jdbc\_streaming?](https://discuss.elastic.co/t/how-to-do-batched-fetching-with-jdbc-streaming/367265)
**Author:** [@mxu](https://discuss.elastic.co/u/mxu)\ **Replies:** 2\ **Last updated:** [September 29, 2024, 12:14am UTC](https://discuss.elastic.co/t/how-to-do-batched-fetching-with-jdbc-streaming/367265 "2024-09-29T00:14:00Z")
I have to use jdbc\_streaming to get data from postgres database. With large number of records, logstash runs OOM. Instead of increasing heap size, I'd like to batched read as jdbc input would do. have been trying differ… --- ## [How do I connect Elastic (using ECK + Azure) to snapshot repository using secondary storage account?](https://discuss.elastic.co/t/how-do-i-connect-elastic-using-eck-azure-to-snapshot-repository-using-secondary-storage-account/367266)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 0\ **Last updated:** [September 27, 2024, 10:04pm UTC](https://discuss.elastic.co/t/how-do-i-connect-elastic-using-eck-azure-to-snapshot-repository-using-secondary-storage-account/367266 "2024-09-27T22:04:18Z")
We use ECK + Azure. I am able to connect the pods to primary storage accounts, but I cannot figure out how to connect to the RA-GRS or just a GRS geo redundant storage (some times referred as blob\_secondary). I tried … --- ## [String Field contains duration/conversion](https://discuss.elastic.co/t/string-field-contains-duration-conversion/367262)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [September 27, 2024, 7:06pm UTC](https://discuss.elastic.co/t/string-field-contains-duration-conversion/367262 "2024-09-27T19:06:39Z")
Hello, I have this string field "time.connected" Examples: How do I make this field in a duration field? is there a way to convert this? --- ## [Showing Max Value Per Unique Host](https://discuss.elastic.co/t/showing-max-value-per-unique-host/367258)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [September 27, 2024, 5:38pm UTC](https://discuss.elastic.co/t/showing-max-value-per-unique-host/367258 "2024-09-27T17:38:16Z")
I have a dataset that records the application version installed on a host. There are multiple records for each host, one for each version of the application that's been installed. Something like \[ { "hostname": … --- ## [Fleet Integration Custom Log File "1 Error" with No Context of the Error](https://discuss.elastic.co/t/fleet-integration-custom-log-file-1-error-with-no-context-of-the-error/367253)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 1\ **Last updated:** [September 27, 2024, 3:55pm UTC](https://discuss.elastic.co/t/fleet-integration-custom-log-file-1-error-with-no-context-of-the-error/367253 "2024-09-27T15:55:20Z")
We ran into an issue where the Custom logs integration was at version 2.3.1 and apparently at some point you were able to use a dash (-) in the dataset name. You are not able to do this anymore as you can only use a per… --- ## [Drilldown to dashboard, set control's value](https://discuss.elastic.co/t/drilldown-to-dashboard-set-controls-value/367246)
**Author:** [@cgame](https://discuss.elastic.co/u/cgame)\ **Replies:** 2\ **Last updated:** [September 27, 2024, 2:44pm UTC](https://discuss.elastic.co/t/drilldown-to-dashboard-set-controls-value/367246 "2024-09-27T14:44:54Z")
Hi, In Kibana is it possible when creating a drill-down to a dashboard which contains a control, to set a value for said control ? The point is to use the same source dashboard for multiple drill-down links, each displa… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=160) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=162)