# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1616 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1617 --- ## [How to run a DSL query in scripted filed](https://discuss.elastic.co/t/how-to-run-a-dsl-query-in-scripted-filed/260359)
**Author:** [@learn\_and\_try](https://discuss.elastic.co/u/learn_and_try)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 5:17pm UTC](https://discuss.elastic.co/t/how-to-run-a-dsl-query-in-scripted-filed/260359 "2021-01-06T17:17:32Z")
I am tried to create a scripted filed that return me a number with all the executed queries I try to execute my query in scripted filed in kibana help me plz to fix it or something else how to do that "query": { "bo… --- ## [(7.10) alert status meaning](https://discuss.elastic.co/t/7-10-alert-status-meaning/260095)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 4:58pm UTC](https://discuss.elastic.co/t/7-10-alert-status-meaning/260095 "2021-01-06T16:58:27Z")
Hello, I am playing with the alert feature of kibana (beta). My alert is in the pending status. What is the meaning? I'd like to see it as active More generally, I did not find a documentation on the status meaning --- ## [Logstash - how to configure CSV filter for joining 2 CSV files based on a common field (mapping - one to many data) and ingest the data into single index](https://discuss.elastic.co/t/logstash-how-to-configure-csv-filter-for-joining-2-csv-files-based-on-a-common-field-mapping-one-to-many-data-and-ingest-the-data-into-single-index/259994)
**Author:** [@Jenisha\_Ramanathan](https://discuss.elastic.co/u/Jenisha_Ramanathan)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 4:51pm UTC](https://discuss.elastic.co/t/logstash-how-to-configure-csv-filter-for-joining-2-csv-files-based-on-a-common-field-mapping-one-to-many-data-and-ingest-the-data-into-single-index/259994 "2021-01-06T16:51:21Z")
Hi Team, I have 2 CVS files which contains one similar column header say "faculty\_id", For the rows which has same "faculty\_id" value, I want the below steps to be done Join/combine the data from both the csv files i… --- ## [Changing Time Filter to consider only dates](https://discuss.elastic.co/t/changing-time-filter-to-consider-only-dates/260363)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 4:50pm UTC](https://discuss.elastic.co/t/changing-time-filter-to-consider-only-dates/260363 "2021-01-06T16:50:45Z")
I'm having an issue with time filter where I have set particular field to have time filter option which is an Date field with format strict\_date\_optional\_time. And in the index documents that only have dates like exampl… --- ## [Filebeat is not sending Logs to Logstash](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/260372)
**Author:** [@Esakkiraj\_Karthi](https://discuss.elastic.co/u/Esakkiraj_Karthi)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/260372 "2021-01-06T16:44:43Z")
We have deployed Filebeat as a daemonset on ELK operator in GKE cluster. Our Filebeat is working fine when we want to send logs directly to Elasticsearch but when it comes to send it via Logstash we are getting an issue.… --- ## [Converting a string field of already ingested documents to an integer field](https://discuss.elastic.co/t/converting-a-string-field-of-already-ingested-documents-to-an-integer-field/260368)
**Author:** [@jsalamanca](https://discuss.elastic.co/u/jsalamanca)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 4:27pm UTC](https://discuss.elastic.co/t/converting-a-string-field-of-already-ingested-documents-to-an-integer-field/260368 "2021-01-06T16:27:11Z")
Hi, I'm trying to convert the type of a field of already ingested documents to another type. The pipeline incorrectly ingested documents with integers as strings, like "1" or "2" (or any other integer as string). I alr… --- ## [How to show missing data in elasticsearch kibana visualization](https://discuss.elastic.co/t/how-to-show-missing-data-in-elasticsearch-kibana-visualization/260335)
**Author:** [@abhinav3](https://discuss.elastic.co/u/abhinav3)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 4:22pm UTC](https://discuss.elastic.co/t/how-to-show-missing-data-in-elasticsearch-kibana-visualization/260335 "2021-01-06T16:22:26Z")
I have few devices which are uploading below json data to elasticsearch. { "\_index": "logs", "\_type": "\_doc", "\_id": "122", "\_version": 7, "\_score": null, "\_source": { "Data": { "FacTotal": 6270126… --- ## [AJAX request to Elasticsearch from Kibana 7.10](https://discuss.elastic.co/t/ajax-request-to-elasticsearch-from-kibana-7-10/260229)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 4\ **Last updated:** [January 6, 2021, 4:20pm UTC](https://discuss.elastic.co/t/ajax-request-to-elasticsearch-from-kibana-7-10/260229 "2021-01-06T16:20:48Z")
In previous version of Kiabana I was able to do ajax post requests to the elasticsearch instance by using the following URL structure: http://localhost:5601/cdp/elasticsearch/\_msearch and pass in my query object data. Th… --- ## [Logs not visible in kibana - Could not index event to Elasticsearch. 400](https://discuss.elastic.co/t/logs-not-visible-in-kibana-could-not-index-event-to-elasticsearch-400/260306)
**Author:** [@jsec](https://discuss.elastic.co/u/jsec)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 4:15pm UTC](https://discuss.elastic.co/t/logs-not-visible-in-kibana-could-not-index-event-to-elasticsearch-400/260306 "2021-01-06T16:15:36Z")
Dears, I've just saw that logs aren't comming anymore from beats to kibana since 1 month. In the syslog, I saw the following warning: Could not index event to Elasticsearch. 400 Validation Failed: 1: this action would… --- ## [Denormalizing with filter in Logstash](https://discuss.elastic.co/t/denormalizing-with-filter-in-logstash/259846)
**Author:** [@Tim\_Zachow](https://discuss.elastic.co/u/Tim_Zachow)\ **Replies:** 7\ **Last updated:** [January 6, 2021, 4:09pm UTC](https://discuss.elastic.co/t/denormalizing-with-filter-in-logstash/259846 "2021-01-06T16:09:58Z")
Hello dear community, it's nice to be able to post my first topic. So I just started to work with Elasticsearch. Thus I'm very inexperienced and after some time I sadly was not able to find a solution by myself. I nee… --- ## [Shard routing and consistency in Elasticsearch](https://discuss.elastic.co/t/shard-routing-and-consistency-in-elasticsearch/260361)
**Author:** [@peterol](https://discuss.elastic.co/u/peterol)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 4:08pm UTC](https://discuss.elastic.co/t/shard-routing-and-consistency-in-elasticsearch/260361 "2021-01-06T16:08:13Z")
Hello everyone, I have two questions regarding comprehension of shard routing and consistency in Elasticsearch. I read this documentation Reading and Writing documents and made the conclusion that Elasticsearch is even… --- ## [New Index is not getting Updated in Alias](https://discuss.elastic.co/t/new-index-is-not-getting-updated-in-alias/260313)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 4:03pm UTC](https://discuss.elastic.co/t/new-index-is-not-getting-updated-in-alias/260313 "2021-01-06T16:03:41Z")
Hi Experts, I created Index Pattern as xyz-\* and created alias for this index pattern as abc using following command POST /\_aliases { "actions" : \[ { "add" : { "index" : "xyz-\*", "alias" : "abc" } } \] } If new… --- ## [Jdbc postgres nested object solution](https://discuss.elastic.co/t/jdbc-postgres-nested-object-solution/258875)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 3:57pm UTC](https://discuss.elastic.co/t/jdbc-postgres-nested-object-solution/258875 "2021-01-06T15:57:34Z")
Does someone have this working? I am getting an Exception using a row\_to\_json sql statement. "Exception when executing JDBC query {:exception=\>"Java::OrgLogstash::MissingConverterException: Missing Converter handling f… --- ## [Could not able to open UI for some of the index-pattern](https://discuss.elastic.co/t/could-not-able-to-open-ui-for-some-of-the-index-pattern/260298)
**Author:** [@savan.chovatiya](https://discuss.elastic.co/u/savan.chovatiya)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 3:53pm UTC](https://discuss.elastic.co/t/could-not-able-to-open-ui-for-some-of-the-index-pattern/260298 "2021-01-06T15:53:25Z")
Hi, We have created some index-pattern using Kibana API. Now when we are trying to open some index-pattern from Management-\>Index Patterns then the page is not loading and it remains empty. We observed that it happe… --- ## [Date Labels in Graphs](https://discuss.elastic.co/t/date-labels-in-graphs/260206)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 4\ **Last updated:** [January 6, 2021, 3:48pm UTC](https://discuss.elastic.co/t/date-labels-in-graphs/260206 "2021-01-06T15:48:10Z")
I'm using line graph and use histogram over month to display a monthly view. The date labels showing in the graph are not showing Monthly Dates ie. 01/12/2020, 01/11/2020 so on and so forth when selecting absolute time … --- ## [Can not find a table field](https://discuss.elastic.co/t/can-not-find-a-table-field/260287)
**Author:** [@phongnd2910](https://discuss.elastic.co/u/phongnd2910)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 3:30pm UTC](https://discuss.elastic.co/t/can-not-find-a-table-field/260287 "2021-01-06T15:30:20Z")
Hi everyone, Please help me to solve this situation I could not find a field in the enhanced table I thought the problem is from the length of the value Thank everyone --- ## [If in json nested field](https://discuss.elastic.co/t/if-in-json-nested-field/260343)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 3:22pm UTC](https://discuss.elastic.co/t/if-in-json-nested-field/260343 "2021-01-06T15:22:08Z")
Hi, I am trying to use logstash to create a field of dns.type based on the types within dns.answers. This is from event.code 22 from sysmon. i have tried: if "AAAA" in \[dns\]\[answers\] { mutate { … --- ## [Formulate query for comparing timestamps](https://discuss.elastic.co/t/formulate-query-for-comparing-timestamps/260334)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 11:56am UTC](https://discuss.elastic.co/t/formulate-query-for-comparing-timestamps/260334 "2021-01-06T11:56:10Z")
Hi I want to write a query to compare two timestamp in bellow Image: I want a query, to check this two Timestamp... (Only hour and minute) and return the log if there are not equal.... Can you help me how can I wr… --- ## [How to stop and remove filebeat from kubernetes? (eks)](https://discuss.elastic.co/t/how-to-stop-and-remove-filebeat-from-kubernetes-eks/259957)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 13\ **Last updated:** [January 6, 2021, 3:03pm UTC](https://discuss.elastic.co/t/how-to-stop-and-remove-filebeat-from-kubernetes-eks/259957 "2021-01-06T15:03:16Z")
Hello i installed filebeat from this link : and its working. now i like to remove it from the eks cluster. how can i stop it and remove it ? no info in documents Thanks --- ## [Canvas doesn't support Type "IP"](https://discuss.elastic.co/t/canvas-doesnt-support-type-ip/259568)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 6\ **Last updated:** [January 6, 2021, 3:01pm UTC](https://discuss.elastic.co/t/canvas-doesnt-support-type-ip/259568 "2021-01-06T15:01:50Z")
Hello, I tried to add a table which contains some suspicious IP addresses and I am getting an error Canvas doesn't not support type IP So as it's till now a limitation on canvas, I decided to create a dashboard, and th… --- ## [Custom metricbeat index,ilm](https://discuss.elastic.co/t/custom-metricbeat-index-ilm/260249)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 3:00pm UTC](https://discuss.elastic.co/t/custom-metricbeat-index-ilm/260249 "2021-01-06T15:00:33Z")
I have follwing setting on metricbeat.yml setup.template.enabled: true setup.template.overwrite: true output.elasticsearch.index: "hou\_metricbeat\_insite-%{\[agent.version\]}-%{+yyyy.MM.dd}" setup.template.name: "hou\_me… --- ## [ML Datafeed lookback retrieved no data](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/260104)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 11\ **Last updated:** [January 6, 2021, 2:50pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/260104 "2021-01-06T14:50:41Z")
I am trying to run the integrated jobs for winlogbeat data, and most of them are having an error Datafeed lookback retrieved no data. I already had the same problem using Elasticsearch version 8.0.0 from code source, So… --- ## [Shards not relocating to warm nodes](https://discuss.elastic.co/t/shards-not-relocating-to-warm-nodes/260198)
**Author:** [@Smrithin\_N\_S](https://discuss.elastic.co/u/Smrithin_N_S)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 2:34pm UTC](https://discuss.elastic.co/t/shards-not-relocating-to-warm-nodes/260198 "2021-01-06T14:34:27Z")
I have a deployment with hot-warm architecture enabled. Below is the ILM policy being used. PUT \_ilm/policy/apm-rollover-30-days { "policy": { "phases": { "hot": { "min\_age":… --- ## [Markdown hyperlink changes when I click on it](https://discuss.elastic.co/t/markdown-hyperlink-changes-when-i-click-on-it/260199)
**Author:** [@Fahimeh\_Kh](https://discuss.elastic.co/u/Fahimeh_Kh)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 2:24pm UTC](https://discuss.elastic.co/t/markdown-hyperlink-changes-when-i-click-on-it/260199 "2021-01-06T14:24:10Z")
Hi community I'm having the following issue. I made a markdown widget to use it as tabs in various kibana dashboards. I inserted each dashboard's url as a separate hyperlink. the problem is no matter which dashboard url … --- ## [Getting exceptions : search.SearchPhaseExecutionException: all shards failed and ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/2/no master](https://discuss.elastic.co/t/getting-exceptions-search-searchphaseexecutionexception-all-shards-failed-and-clusterblockexception-blocked-by-service-unavailable-2-no-master/260347)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 1:41pm UTC](https://discuss.elastic.co/t/getting-exceptions-search-searchphaseexecutionexception-all-shards-failed-and-clusterblockexception-blocked-by-service-unavailable-2-no-master/260347 "2021-01-06T13:41:28Z")
i followed the quickstart tutorial both elasticsearch and filebeat installation on Kubernetes the app working for few minutes but then the kibana doesn't respond and when i look at the elasticsearch logs i can see those… --- ## [Getting Hash value in sort response, ES json response is invalid](https://discuss.elastic.co/t/getting-hash-value-in-sort-response-es-json-response-is-invalid/260346)
**Author:** [@Sravanti](https://discuss.elastic.co/u/Sravanti)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 1:20pm UTC](https://discuss.elastic.co/t/getting-hash-value-in-sort-response-es-json-response-is-invalid/260346 "2021-01-06T13:20:08Z")
I'm using icu\_collation for phonebook sort, but getting a hash value in sort response in below search query GET testindex1/\_search { "sort": \[ { "id.sort\_en": { "order": "ASC", "unmapped\_type… --- ## [“\[geo\_distance\] malformed query, expected \[END\_OBJECT\] but found \[FIELD\_NAME\]”](https://discuss.elastic.co/t/geo-distance-malformed-query-expected-end-object-but-found-field-name/260341)
**Author:** [@learn\_and\_try](https://discuss.elastic.co/u/learn_and_try)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 1:28pm UTC](https://discuss.elastic.co/t/geo-distance-malformed-query-expected-end-object-but-found-field-name/260341 "2021-01-06T13:28:05Z")
I am tried to create search queary with a values in 15m radios and between 3 weeks. I tried to execute this query: \> "query": { \> "bool": { \> "must": { \> "match\_all": {} \> } \> , "filter": \[ \> { \> "geo… --- ## [Boolean parameters in token filters are stringified, breaking elasticsearch\_dsl analysis comparison](https://discuss.elastic.co/t/boolean-parameters-in-token-filters-are-stringified-breaking-elasticsearch-dsl-analysis-comparison/260342)
**Author:** [@LeoMcA](https://discuss.elastic.co/u/LeoMcA)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 12:59pm UTC](https://discuss.elastic.co/t/boolean-parameters-in-token-filters-are-stringified-breaking-elasticsearch-dsl-analysis-comparison/260342 "2021-01-06T12:59:50Z")
Heya, I'm not sure if this is a bug with elastic itself or with the elasticsearch\_dsl python library, so posting here before filing an issue on github. If you set up a token filter with a boolean parameter, that paramet… --- ## [Automatic alerting on forcast (machine learning)](https://discuss.elastic.co/t/automatic-alerting-on-forcast-machine-learning/260248)
**Author:** [@Landry](https://discuss.elastic.co/u/Landry)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 12:59pm UTC](https://discuss.elastic.co/t/automatic-alerting-on-forcast-machine-learning/260248 "2021-01-06T12:59:28Z")
Hello, How can we automate machine learning forcast execution in order to notify customers when some unusual events will occurs in the next days. We have a machine learning job that detect anomalies on our datas. Actua… --- ## [Encoded bytes are incorrect length issue](https://discuss.elastic.co/t/encoded-bytes-are-incorrect-length-issue/260228)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 10:01am UTC](https://discuss.elastic.co/t/encoded-bytes-are-incorrect-length-issue/260228 "2021-01-06T10:01:49Z")
Hi, my elasticsearch 7.7.1 sometimes returns encoded bytes are incorrect length error with 400. It's only sometimes, can you tell me the meaning? What can be couse of it? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1615) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1617)