# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1637 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1638 --- ## [Indices per website or deleteByQuery](https://discuss.elastic.co/t/indices-per-website-or-deletebyquery/259088)
**Author:** [@adriaan](https://discuss.elastic.co/u/adriaan)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 11:26am UTC](https://discuss.elastic.co/t/indices-per-website-or-deletebyquery/259088 "2020-12-18T11:26:50Z")
I have an analytics business called Simple Analytics. It's powered by Elasticsearch and it works great. We store analytics data for the websites of our customers. We give our customers to option to delete their account a… --- ## [Unsupported parameters for multi fields](https://discuss.elastic.co/t/unsupported-parameters-for-multi-fields/258423)
**Author:** [@S\_Hamdi](https://discuss.elastic.co/u/S_Hamdi)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 11:24am UTC](https://discuss.elastic.co/t/unsupported-parameters-for-multi-fields/258423 "2020-12-18T11:24:23Z")
Hello, I am new to Elastic. I am getting the following error while uploading the ES index template. {"error":{"root\_cause":\[{"type":"mapper\_parsing\_exception","reason":"Mapping definition for \[path\] has unsupported pa… --- ## [Snapshot policy to include closed indices](https://discuss.elastic.co/t/snapshot-policy-to-include-closed-indices/258851)
**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Replies:** 10\ **Last updated:** [December 18, 2020, 11:00am UTC](https://discuss.elastic.co/t/snapshot-policy-to-include-closed-indices/258851 "2020-12-18T11:00:43Z")
The create snapshot API states that the default for expand\_wildcards is all, but our snapshots created through a snapshot policy does not include our closed indices. We have tried with wildcards: PUT \_slm/policy/daily-… --- ## [Geo\_shape index cannot convert by avro (nifi)](https://discuss.elastic.co/t/geo-shape-index-cannot-convert-by-avro-nifi/259064)
**Author:** [@SenalChen](https://discuss.elastic.co/u/SenalChen)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 10:24am UTC](https://discuss.elastic.co/t/geo-shape-index-cannot-convert-by-avro-nifi/259064 "2020-12-18T10:24:28Z")
I use json like this: \[{"scene\_id":"LC81121092020347LGN00","data\_path":112,"data\_row":109,"upper\_left\_lon":95.20724,"upper\_left\_lat":-68.44105,"upper\_right\_lon":99.64702,"upper\_right\_lat":-69.16904,"lower\_right\_lon":97.… --- ## [Dateparse failure](https://discuss.elastic.co/t/dateparse-failure/259001)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 10:09am UTC](https://discuss.elastic.co/t/dateparse-failure/259001 "2020-12-18T10:09:16Z")
I cannot find a way to either debug or fix this. I have provided below the log output and the various grok filters that are used. What can I do to fix this? RAW Log output \`logstash\[23980\]: \[2020-12-17T14:19:12,925… --- ## [Query to get the last x values](https://discuss.elastic.co/t/query-to-get-the-last-x-values/259078)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 10:01am UTC](https://discuss.elastic.co/t/query-to-get-the-last-x-values/259078 "2020-12-18T10:01:28Z")
Hi, Is there a way to query for the last x Values in a field? --- ## [\[Filebeat\] Define custom Ingest Node for Kafka Output](https://discuss.elastic.co/t/filebeat-define-custom-ingest-node-for-kafka-output/259032)
**Author:** [@dacamposol](https://discuss.elastic.co/u/dacamposol)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 9:48am UTC](https://discuss.elastic.co/t/filebeat-define-custom-ingest-node-for-kafka-output/259032 "2020-12-18T09:48:43Z")
Good afternoon guys! I have a question regarding the configuration of the pipelines and Filebeat, when we're using a Kafka as output: When we have ElasticSearch as output, we can just define the pipeline we want to use… --- ## [How can we convert Splunk query into Elastic Query](https://discuss.elastic.co/t/how-can-we-convert-splunk-query-into-elastic-query/259075)
**Author:** [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 9:12am UTC](https://discuss.elastic.co/t/how-can-we-convert-splunk-query-into-elastic-query/259075 "2020-12-18T09:12:38Z")
Hi Folks, Can you please help me to convert below splunk query into elastic query ? It has single index and we need to put two time ranges on similar field(ChannelSessionId) and calculate percentage in both counts. in… --- ## [Refresh data](https://discuss.elastic.co/t/refresh-data/258989)
**Author:** [@mihai.radulescu](https://discuss.elastic.co/u/mihai.radulescu)\ **Replies:** 3\ **Last updated:** [December 18, 2020, 9:03am UTC](https://discuss.elastic.co/t/refresh-data/258989 "2020-12-18T09:03:17Z")
Hello, I have a logstash configuration that is inserting the data from csv files from a specific folder. In the past two weeks I have made numerous changes and the data that I inserted is incomplete. How do I drop ever… --- ## [Should i configured xpack on filebeat?](https://discuss.elastic.co/t/should-i-configured-xpack-on-filebeat/259059)
**Author:** [@Taufik\_Maulana](https://discuss.elastic.co/u/Taufik_Maulana)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 9:03am UTC](https://discuss.elastic.co/t/should-i-configured-xpack-on-filebeat/259059 "2020-12-18T09:03:13Z")
Hi ! I have a question, should i configured xpack on filebeat ? or just in Elasticsearch ? because according to this link it says Verify that the xpack.security.enabled setting is true on each node in your cluster. .… --- ## [SNMP Traffic Utilization graph](https://discuss.elastic.co/t/snmp-traffic-utilization-graph/258978)
**Author:** [@pavansh](https://discuss.elastic.co/u/pavansh)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 9:00am UTC](https://discuss.elastic.co/t/snmp-traffic-utilization-graph/258978 "2020-12-18T09:00:55Z")
I am using SNMP input Plugin to get IfInOctects and OutOctects Can anyone help me to create a chart to show Inbound/Outbound Traffic in Mbps? --- ## [Mapping error while writing to index](https://discuss.elastic.co/t/mapping-error-while-writing-to-index/259068)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 8:13am UTC](https://discuss.elastic.co/t/mapping-error-while-writing-to-index/259068 "2020-12-18T08:13:04Z")
Hello together, i am trying to read, with logstash, from an influxdb via http-poller, that seems to work when writing to an file, but when i write to an index i get the following error: \[2020-12-18T08:59:14,281\]\[WARN \]… --- ## [Elasticsearch SQL ORDER BY Month](https://discuss.elastic.co/t/elasticsearch-sql-order-by-month/256716)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 7\ **Last updated:** [December 18, 2020, 7:57am UTC](https://discuss.elastic.co/t/elasticsearch-sql-order-by-month/256716 "2020-12-18T07:57:10Z")
Hello, I'm almost there getting my vertical bar to work in Canvas based on a SQL query, but I'm having a hard time ordering the monthly buckets chronologically. My SQL query: SELECT COUNT(DISTINCT user.name) AS UniqueU… --- ## [What if all filter not applied ? filter with null FIELD VALUE not NULL value in DOC](https://discuss.elastic.co/t/what-if-all-filter-not-applied-filter-with-null-field-value-not-null-value-in-doc/259063)
**Author:** [@Kajal\_Pandya](https://discuss.elastic.co/u/Kajal_Pandya)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 7:10am UTC](https://discuss.elastic.co/t/what-if-all-filter-not-applied-filter-with-null-field-value-not-null-value-in-doc/259063 "2020-12-18T07:10:01Z")
I have search for subjects..Teacher can add multiple subjects and students can search thode subject and can apply filter on resulted data..student can filter by LEVEL, CURRICULUM, LOCATION.. My query is what if student … --- ## [Control visualization](https://discuss.elastic.co/t/control-visualization/258682)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 5\ **Last updated:** [December 18, 2020, 5:17am UTC](https://discuss.elastic.co/t/control-visualization/258682 "2020-12-18T05:17:50Z")
Hi, Is there any other type of visualization that could do quite the same job as control visualiztion's drop down? Thank you in advance! --- ## [Reset Built-in users](https://discuss.elastic.co/t/reset-built-in-users/259003)
**Author:** [@Charly\_ROCH](https://discuss.elastic.co/u/Charly_ROCH)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 3:57am UTC](https://discuss.elastic.co/t/reset-built-in-users/259003 "2020-12-18T03:57:34Z")
I am building elasticsearch cluster with SSL following this tutorial : My first node is a debian with elastic running as a service. I ran the command : bin/elasticsearch-setup-passwords auto But when listing users w… --- ## [Filebeat S3 input support for AWS WAF logs (support application/octet-stream)](https://discuss.elastic.co/t/filebeat-s3-input-support-for-aws-waf-logs-support-application-octet-stream/258981)
**Author:** [@rubal033](https://discuss.elastic.co/u/rubal033)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 1:54am UTC](https://discuss.elastic.co/t/filebeat-s3-input-support-for-aws-waf-logs-support-application-octet-stream/258981 "2020-12-18T01:54:03Z")
As of now, there is Filebeat s3 input that doesn't support AWS WAF logs. AWS WAF logs use Kinesis Firehose to get to S3 and the "Content-type" is set to "application/octet-stream". Due to this, the logs didn't get expand… --- ## [Logstash Pipeline issue (I'm an idiot or something)](https://discuss.elastic.co/t/logstash-pipeline-issue-im-an-idiot-or-something/259042)
**Author:** [@SigmazGFX](https://discuss.elastic.co/u/SigmazGFX)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 1:15am UTC](https://discuss.elastic.co/t/logstash-pipeline-issue-im-an-idiot-or-something/259042 "2020-12-18T01:15:15Z")
Hey gang. I am working with our dev team and they are dumping custom logging into the windows events Using winlogbeat to ship the log entries into logstash i am trying to set up a central pipeline to handle the differen… --- ## [Effective Way to Remove Existing Duplicate Documents in ElasticSearch](https://discuss.elastic.co/t/effective-way-to-remove-existing-duplicate-documents-in-elasticsearch/258798)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 11\ **Last updated:** [December 17, 2020, 11:31pm UTC](https://discuss.elastic.co/t/effective-way-to-remove-existing-duplicate-documents-in-elasticsearch/258798 "2020-12-17T23:31:15Z")
Hi Everyone, Using aggregation, I am able query out doc\_count: 272152 of duplicates instances in my elasticsearch database. The problem now is if I were to simply run a \_delete\_by\_query, it will delete everything inclu… --- ## [Kibana visualization to plot field values on y-axis without docs aggregation](https://discuss.elastic.co/t/kibana-visualization-to-plot-field-values-on-y-axis-without-docs-aggregation/259002)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 11:25pm UTC](https://discuss.elastic.co/t/kibana-visualization-to-plot-field-values-on-y-axis-without-docs-aggregation/259002 "2020-12-17T23:25:37Z")
hi guys, i am unable to find which visualization will plot below in KIBANA . on Y-axis : Plot values of field called "Logs" ( Don't plot the count of documents having field logs) on X-axis: timestamp My JSON documen… --- ## [Ingested Pipelines](https://discuss.elastic.co/t/ingested-pipelines/259037)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 15\ **Last updated:** [December 17, 2020, 10:47pm UTC](https://discuss.elastic.co/t/ingested-pipelines/259037 "2020-12-17T22:47:57Z")
Hi! I've updated Elastic Stack and now I have an error and I don't know how to manage it. Before I was using ingested pipelines and everything was just fine and now when I want to use them again I get this error Cause… --- ## [Convert String to date format](https://discuss.elastic.co/t/convert-string-to-date-format/258899)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 25\ **Last updated:** [December 17, 2020, 9:29pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899 "2020-12-17T21:29:12Z")
Hi All, I am using ELK7.6.2 Trying to convert "createdTime" field from String to date format. Added following filter in my logstash config file: date { match =\> \["createdTime", "YYYY-MM-dd HH:mm:ss.SSS"\] target =\> "cr… --- ## [Kibana Index Management](https://discuss.elastic.co/t/kibana-index-management/259028)
**Author:** [@srinivasape](https://discuss.elastic.co/u/srinivasape)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 9:01pm UTC](https://discuss.elastic.co/t/kibana-index-management/259028 "2020-12-17T21:01:03Z")
Hello EveryBody! I use Kibana for index management in elasticsearch (7.6.1). When i show index stats, the json says: I willl wait for any answer. Thanks. --- ## [Master node not discovered yet after upgrade from 6.8 to 7.10](https://discuss.elastic.co/t/master-node-not-discovered-yet-after-upgrade-from-6-8-to-7-10/258915)
**Author:** [@David\_Tomasheski](https://discuss.elastic.co/u/David_Tomasheski)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 8:01pm UTC](https://discuss.elastic.co/t/master-node-not-discovered-yet-after-upgrade-from-6-8-to-7-10/258915 "2020-12-17T20:01:28Z")
In order to deal with the Chrome Samesite cookies issue I have just upgraded ES and Kibana from 6.7 to 6.8 and that went fine. I then went to upgrade ES to 7.10 and now I am getting The below error message. I had followe… --- ## [Using ILM for Timeseries Data with a Static Write Index](https://discuss.elastic.co/t/using-ilm-for-timeseries-data-with-a-static-write-index/259023)
**Author:** [@Karl\_Falconer](https://discuss.elastic.co/u/Karl_Falconer)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 7:27pm UTC](https://discuss.elastic.co/t/using-ilm-for-timeseries-data-with-a-static-write-index/259023 "2020-12-17T19:27:43Z")
We are using a Ruby wrapper library called Searchkick which provides great functionality for searching within our application environment. However it is not great with managing Timeseries data. Our objective is to be ab… --- ## [Logstash 7.10 Error](https://discuss.elastic.co/t/logstash-7-10-error/259022)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 7:23pm UTC](https://discuss.elastic.co/t/logstash-7-10-error/259022 "2020-12-17T19:23:46Z")
I' ve installed last version of Logstash and gives me this error for ingested pipelines: \[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[....\] Encountered a retryable error. Will Retry with exponential backoff {:code=\>40… --- ## [Filtering Nested Child Objects](https://discuss.elastic.co/t/filtering-nested-child-objects/258791)
**Author:** [@mgncl](https://discuss.elastic.co/u/mgncl)\ **Replies:** 5\ **Last updated:** [December 17, 2020, 7:16pm UTC](https://discuss.elastic.co/t/filtering-nested-child-objects/258791 "2020-12-17T19:16:21Z")
I am trying to fine tune the query on a nested collection. The nested collection should match all the criteria and the size of the collection. I created a sample data set to the mimic my use case. Index { "map… --- ## [Snapsot Deletion Times Out](https://discuss.elastic.co/t/snapsot-deletion-times-out/259029)
**Author:** [@pooja\_shukla](https://discuss.elastic.co/u/pooja_shukla)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 6:58pm UTC](https://discuss.elastic.co/t/snapsot-deletion-times-out/259029 "2020-12-17T18:58:10Z")
1) Snapshot deletion is timing out using elasticsearch python client client.snapshot.delete(repository="repo\_name", snapshot="snapshot\_name") 2) We are using curator to delete old snapshot beyond a certain date, curato… --- ## [How to config hot-warm arch in elasticsearch 7.9.1](https://discuss.elastic.co/t/how-to-config-hot-warm-arch-in-elasticsearch-7-9-1/258904)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 6:52pm UTC](https://discuss.elastic.co/t/how-to-config-hot-warm-arch-in-elasticsearch-7-9-1/258904 "2020-12-17T18:52:20Z")
Configurations of hot-warm arch in elasticsearch is only changing elasticsearch.yml? --- ## [Adding new field based on AND Condition](https://discuss.elastic.co/t/adding-new-field-based-on-and-condition/259010)
**Author:** [@errupeshmca](https://discuss.elastic.co/u/errupeshmca)\ **Replies:** 3\ **Last updated:** [December 17, 2020, 6:19pm UTC](https://discuss.elastic.co/t/adding-new-field-based-on-and-condition/259010 "2020-12-17T18:19:19Z")
Hi have below coloumns columns =\> \[ "Order Key","Cust #","Doc Type","Doc #","Order #","Order Type","Order Complete?","Order Date","Total Order Value","Total Dollar Value","TotalOrderReceivedToday","Inv #","Inv Date","Ex… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1636) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1638)