# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1653 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1654 --- ## [Filebeat Processors drop\_event](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856)
**Author:** [@erezhazan1](https://discuss.elastic.co/u/erezhazan1)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856 "2020-12-09T12:50:54Z")
Hey all! I need your help with the following, I'm trying to get this condition to work: If not (message: '^.dstintf="aaaa".' OR message: '^.dstintf="bbb".') AND NOT (message: '^.action="ccc".' AND message: '^.action=… --- ## [Memory issue in elasticsearch](https://discuss.elastic.co/t/memory-issue-in-elasticsearch/258027)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 11\ **Last updated:** [December 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/memory-issue-in-elasticsearch/258027 "2020-12-09T12:50:11Z")
Hi Team, I deployed multi-node cluster few days back and it was working fine. Today I saw elasticsearch service went down due to less memory availability. It is running fine on other two elasticsearch nodes. System ha… --- ## [docFreq for multi\_match with type cross\_fields](https://discuss.elastic.co/t/docfreq-for-multi-match-with-type-cross-fields/258121)
**Author:** [@Lea\_Lacoste](https://discuss.elastic.co/u/Lea_Lacoste)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 12:48pm UTC](https://discuss.elastic.co/t/docfreq-for-multi-match-with-type-cross-fields/258121 "2020-12-09T12:48:49Z")
I am having problems understanding the docFreq for multi\_match queries when using the type cross\_fields. I created a one shard test index, onto which I pushed 4 documents: { "random0": "banana", "random1": "banana", "r… --- ## [Performance Issues during data-ingestion](https://discuss.elastic.co/t/performance-issues-during-data-ingestion/258092)
**Author:** [@M-O](https://discuss.elastic.co/u/M-O)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 12:42pm UTC](https://discuss.elastic.co/t/performance-issues-during-data-ingestion/258092 "2020-12-09T12:42:10Z")
Hi everyone, i am currently testing the elastic stack for observerability use-cases in my company. For testing purposes we build a small elasticsearch cluster (3 nodes) and ingesting http-logs with filebeat. Our PoC-se… --- ## [How to use \<\> these brackets for search in kibana](https://discuss.elastic.co/t/how-to-use-these-brackets-for-search-in-kibana/258075)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 12:24pm UTC](https://discuss.elastic.co/t/how-to-use-these-brackets-for-search-in-kibana/258075 "2020-12-09T12:24:26Z")
Enables the \<\> operators. You can use \<\> to match a numeric range. For example: foo\<1-100\> # matches 'foo1', 'foo2' ... 'foo99', 'foo100' foo\<01-100\> # matches 'foo01', 'foo02' ... 'foo99', 'foo100' How to wr… --- ## [Elasticsearch - error while trying to start service on OpenShift](https://discuss.elastic.co/t/elasticsearch-error-while-trying-to-start-service-on-openshift/258088)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 7\ **Last updated:** [December 9, 2020, 11:27am UTC](https://discuss.elastic.co/t/elasticsearch-error-while-trying-to-start-service-on-openshift/258088 "2020-12-09T11:27:38Z")
Hi, I got following error in Elasticsearch. Elasticsearch is installed on Openshift. Elasticsearch version - 6.4.3. OSS Elasticsearch logs: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated i… --- ## [Nodes constantly turn off and on again](https://discuss.elastic.co/t/nodes-constantly-turn-off-and-on-again/257808)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 6\ **Last updated:** [December 9, 2020, 11:24am UTC](https://discuss.elastic.co/t/nodes-constantly-turn-off-and-on-again/257808 "2020-12-09T11:24:04Z")
Hi guys, I have a 14 nodes of cluster (11 data, 3 master).I am using Elasticsearch and kibana version 7.4.2. When everything is going well, suddenly the nodes started to shut down and the kibana status turns red or yello… --- ## [Querying in Kibana Discover Timesout](https://discuss.elastic.co/t/querying-in-kibana-discover-timesout/256817)
**Author:** [@Ganesh\_Sharma](https://discuss.elastic.co/u/Ganesh_Sharma)\ **Replies:** 14\ **Last updated:** [December 9, 2020, 11:07am UTC](https://discuss.elastic.co/t/querying-in-kibana-discover-timesout/256817 "2020-12-09T11:07:48Z")
Guys I have been trying to deploy ELK cluster using ELK Operator method for Azure AKS from here. However after I deploy ELK and access Kibana and add Filebeat index creation I am unable to query anything in the Discover… --- ## [Pick latest data](https://discuss.elastic.co/t/pick-latest-data/256361)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 7\ **Last updated:** [December 9, 2020, 11:06am UTC](https://discuss.elastic.co/t/pick-latest-data/256361 "2020-12-09T11:06:09Z")
Hi, I am bulk inserting my data into an index multiple times in a day. I want to get all data with last timestamp(with last timestamp I inserted.). --- ## [Netflow summarization of duplicate events](https://discuss.elastic.co/t/netflow-summarization-of-duplicate-events/258112)
**Author:** [@Srikanth\_Suresh](https://discuss.elastic.co/u/Srikanth_Suresh)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 11:04am UTC](https://discuss.elastic.co/t/netflow-summarization-of-duplicate-events/258112 "2020-12-09T11:04:07Z")
Hello all! I am currently using Filebeat to send Netflow events into Elasticsearch. At certain time stamps I can observe 100,000 to 3 million events per second. Several of these events have the same data fields such a… --- ## [Scoring plugin, unexpected behavior](https://discuss.elastic.co/t/scoring-plugin-unexpected-behavior/258105)
**Author:** [@iva3682](https://discuss.elastic.co/u/iva3682)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 10:21am UTC](https://discuss.elastic.co/t/scoring-plugin-unexpected-behavior/258105 "2020-12-09T10:21:16Z")
Hey. I am writing a plugin for calculating the distance of the EMD vector for Elastic 7.10.0. I took the repository as an example https://github.com/elastic/elasticsearch/tree/master/plugins/examples/script-expert-scorin… --- ## [Please help with elapsed plugin and timestap difference](https://discuss.elastic.co/t/please-help-with-elapsed-plugin-and-timestap-difference/257628)
**Author:** [@fabryx87](https://discuss.elastic.co/u/fabryx87)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 10:28am UTC](https://discuss.elastic.co/t/please-help-with-elapsed-plugin-and-timestap-difference/257628 "2020-12-09T10:28:03Z")
Hello everyone and thanks for this great Forum! I would need a hand with elastic, I have to make a difference between 2 timestamps that have the logonid in common, but different event.action. unfortunately I don't even… --- ## [Elasticsearch mapping ES2.3 -\> ES 7.8](https://discuss.elastic.co/t/elasticsearch-mapping-es2-3-es-7-8/258078)
**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-es2-3-es-7-8/258078 "2020-12-09T10:13:50Z")
Assume that the defined mapping in ES2.3 has this format. "properties": { "accountId": { "type": "string", "index": "not\_analyzed" } } Is it equivalent to this in ES 7.8 version? "properties": { … --- ## [Timestamp search from file](https://discuss.elastic.co/t/timestamp-search-from-file/257853)
**Author:** [@mihai.radulescu](https://discuss.elastic.co/u/mihai.radulescu)\ **Replies:** 4\ **Last updated:** [December 9, 2020, 9:42am UTC](https://discuss.elastic.co/t/timestamp-search-from-file/257853 "2020-12-09T09:42:41Z")
Hello, I have no experience with Elasticsearch, however I wish to setup an environment to be able to search through some large csv files. The import with logstash works, however I have two issues: timestamp scale is u… --- ## [Timefilter in Canvas does not visually refresh with the newly searched criteria](https://discuss.elastic.co/t/timefilter-in-canvas-does-not-visually-refresh-with-the-newly-searched-criteria/258091)
**Author:** [@faisal.parwani](https://discuss.elastic.co/u/faisal.parwani)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 8:24am UTC](https://discuss.elastic.co/t/timefilter-in-canvas-does-not-visually-refresh-with-the-newly-searched-criteria/258091 "2020-12-09T08:24:09Z")
Hi i have a Canvas with Markdowns, for each markdown have certain query which is used to fetch and show the result (some number) as the content in the markdown. i added a timeFilter with default to 'Last 24 Hours' a… --- ## [I am unable to Start Auditbeat service](https://discuss.elastic.co/t/i-am-unable-to-start-auditbeat-service/257814)
**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\ **Replies:** 19\ **Last updated:** [December 9, 2020, 9:37am UTC](https://discuss.elastic.co/t/i-am-unable-to-start-auditbeat-service/257814 "2020-12-09T09:37:33Z")
HI Team, I am unable to install Auditbeat In my Linux version. I am getting this error: Exiting: 2 errors: 1 error: failed to create audit client: failed to get audit status: operation not permitted; 1 error: unable t… --- ## [Transforms -how to add common fields (i.e. geoip-fields) to the transform output?](https://discuss.elastic.co/t/transforms-how-to-add-common-fields-i-e-geoip-fields-to-the-transform-output/257915)
**Author:** [@hevi](https://discuss.elastic.co/u/hevi)\ **Replies:** 6\ **Last updated:** [December 9, 2020, 9:30am UTC](https://discuss.elastic.co/t/transforms-how-to-add-common-fields-i-e-geoip-fields-to-the-transform-output/257915 "2020-12-09T09:30:56Z")
Basically I have thousands of embedded devices that periodically upload logfiles to a backend we've created and after some preprocessing the log files are ingested into elasticserach using the geoip igestion pipeline. At… --- ## [ES 7.x : Setting threshold for document size and collecting metrics exceeding the same](https://discuss.elastic.co/t/es-7-x-setting-threshold-for-document-size-and-collecting-metrics-exceeding-the-same/258077)
**Author:** [@dinesh\_gnanasamy](https://discuss.elastic.co/u/dinesh_gnanasamy)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 9:29am UTC](https://discuss.elastic.co/t/es-7-x-setting-threshold-for-document-size-and-collecting-metrics-exceeding-the-same/258077 "2020-12-09T09:29:59Z")
Hi, Is there any way of setting a global parameter across indices in ES to the effect of defining the limit of size of each document and if the document size in any index exceeding this limit (either as result of indexi… --- ## [Algorithmic complexity of bool queries](https://discuss.elastic.co/t/algorithmic-complexity-of-bool-queries/258084)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 8:46am UTC](https://discuss.elastic.co/t/algorithmic-complexity-of-bool-queries/258084 "2020-12-09T08:46:15Z")
I've been searching all over the net to get an understanding of the algorithmic complexity / rough big-O of bool queries for Elasticsearch, but I have come up dry so I'm asking here. (Note: this is not a question about c… --- ## [Unable to get gte and lte from elastic Java API in range query](https://discuss.elastic.co/t/unable-to-get-gte-and-lte-from-elastic-java-api-in-range-query/257781)
**Author:** [@AKASH\_DUBEY1](https://discuss.elastic.co/u/AKASH_DUBEY1)\ **Replies:** 22\ **Last updated:** [December 9, 2020, 8:47am UTC](https://discuss.elastic.co/t/unable-to-get-gte-and-lte-from-elastic-java-api-in-range-query/257781 "2020-12-09T08:47:57Z")
Hi , I am using RestHighLevelclient to get data from elastic.I am using below query BoolQueryBuilder boolQuery=QueryBuilders.boolQuery(); boolQuery.must(QueryBuilders.rangeQuery("ipFromLong").gte(ipLong)); boolQuery.… --- ## [Resource upper bounds on keyword sorting](https://discuss.elastic.co/t/resource-upper-bounds-on-keyword-sorting/258095)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 8:47am UTC](https://discuss.elastic.co/t/resource-upper-bounds-on-keyword-sorting/258095 "2020-12-09T08:47:26Z")
I was reading through the docs on fielddata and came about this: It usually doesn’t make sense to enable fielddata on text fields. Field data is stored in the heap with the field data cache because it is expensive to c… --- ## [EdgeGram Search trouble](https://discuss.elastic.co/t/edgegram-search-trouble/258070)
**Author:** [@murilozilli](https://discuss.elastic.co/u/murilozilli)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 8:30am UTC](https://discuss.elastic.co/t/edgegram-search-trouble/258070 "2020-12-09T08:30:15Z")
I am very new to ES so I am probably getting something wrong but this is my mapping and settings: { "locations":{ "mappings":{ "locations":{ "\_meta":{ … --- ## [Pin filter in a specific dashboard](https://discuss.elastic.co/t/pin-filter-in-a-specific-dashboard/257199)
**Author:** [@yaelg](https://discuss.elastic.co/u/yaelg)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 8:29am UTC](https://discuss.elastic.co/t/pin-filter-in-a-specific-dashboard/257199 "2020-12-09T08:29:55Z")
Hey everyone, I'm quite new to ELK so my question might be trivial. I am working with multiple dashboards. Is there a way to pin a filter only in one dashboards? whenever I pin a filter, it applies it to all dashboards… --- ## [Price sort not working in elasticsearch 7.9.3 version](https://discuss.elastic.co/t/price-sort-not-working-in-elasticsearch-7-9-3-version/257970)
**Author:** [@magesh\_kumar](https://discuss.elastic.co/u/magesh_kumar)\ **Replies:** 11\ **Last updated:** [December 9, 2020, 8:27am UTC](https://discuss.elastic.co/t/price-sort-not-working-in-elasticsearch-7-9-3-version/257970 "2020-12-09T08:27:12Z")
Hi everyone, Currently I am using the Elasticsearch 7.9.3 version. the issue is price sort works wrong after upgrading the old version. Price data's are mixed with double , integer. Please let me know what happened in t… --- ## [How to calculate weighted score depending on order of an array field](https://discuss.elastic.co/t/how-to-calculate-weighted-score-depending-on-order-of-an-array-field/258071)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 8:12am UTC](https://discuss.elastic.co/t/how-to-calculate-weighted-score-depending-on-order-of-an-array-field/258071 "2020-12-09T08:12:26Z")
I would like to search by an array field, and give weight depending on where the value appears in the arrays. For example, I have 3 documents like this: { "foo": \[1, 2, 3\] } { "foo": \[2, 3, 4\] } { "foo": \[3, 4, 5\] } a… --- ## [Data is lost when outputting to file](https://discuss.elastic.co/t/data-is-lost-when-outputting-to-file/258089)
**Author:** [@lon](https://discuss.elastic.co/u/lon)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 8:06am UTC](https://discuss.elastic.co/t/data-is-lost-when-outputting-to-file/258089 "2020-12-09T08:06:00Z")
\[Please excuse my poor English...\] If output the file to the same file with a line codec of the file output, the data will be lost. my logstash.conf input { beats { port =\> "5044" } } … --- ## [Logs of elastic stack components should go to their respective log file](https://discuss.elastic.co/t/logs-of-elastic-stack-components-should-go-to-their-respective-log-file/257732)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 4\ **Last updated:** [December 9, 2020, 7:48am UTC](https://discuss.elastic.co/t/logs-of-elastic-stack-components-should-go-to-their-respective-log-file/257732 "2020-12-09T07:48:19Z")
Hi Team, I am seeing logs of elastic stack components such as Kibana, Logstash, filebeat are going everywhere like in /var/log/message , /var/log/daemon, journal.log and flooding filesystem. how to make sure logs of el… --- ## [Downgrade elasticsearch to previous version](https://discuss.elastic.co/t/downgrade-elasticsearch-to-previous-version/258083)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 7:42am UTC](https://discuss.elastic.co/t/downgrade-elasticsearch-to-previous-version/258083 "2020-12-09T07:42:44Z")
Hi All, I am planning to upgrade my 6 node elk cluster from 7.7 to 7.10. I am just looking for a scenario when two nodes are upgraded and 3rd node fails. So is there a way to downgrade all the nodes back to v7.7 --- ## [Filebeat doesn\`t collect logs from Kubernetes cronjobs](https://discuss.elastic.co/t/filebeat-doesn-t-collect-logs-from-kubernetes-cronjobs/257859)
**Author:** [@malcolm666](https://discuss.elastic.co/u/malcolm666)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 7:06am UTC](https://discuss.elastic.co/t/filebeat-doesn-t-collect-logs-from-kubernetes-cronjobs/257859 "2020-12-09T07:06:06Z")
Hi. I use filebeat 7.6.1 and k8s autodiscovery that works good for each pod. Example: filebeat.autodiscover: providers: - type: kubernetes templates: - condition: … --- ## [In my filebeat enable system module and application logs](https://discuss.elastic.co/t/in-my-filebeat-enable-system-module-and-application-logs/257985)
**Author:** [@prakash22](https://discuss.elastic.co/u/prakash22)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 7:01am UTC](https://discuss.elastic.co/t/in-my-filebeat-enable-system-module-and-application-logs/257985 "2020-12-09T07:01:01Z")
I am sending these logs to logstash. But here both application, system logs are going to one index. But I want send to two indexes. This is logstash pipeline. input { beats { port =\> 5044 ssl =\> false } } output … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1652) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1654)