# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1679 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1680 --- ## [Query,aggregation and buckets](https://discuss.elastic.co/t/query-aggregation-and-buckets/255897)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 4\ **Last updated:** [November 24, 2020, 6:06pm UTC](https://discuss.elastic.co/t/query-aggregation-and-buckets/255897 "2020-11-24T18:06:58Z")
Hi all. I need a bit of help regarding aggregations and buckets to create visualizations and dashboards. I have metricbeat running on a kubernetes cluster and I need to create alerts in case some pods go down. Not sur… --- ## [Elastic \_count returns incorrect count?](https://discuss.elastic.co/t/elastic-count-returns-incorrect-count/256545)
**Author:** [@witchlightning](https://discuss.elastic.co/u/witchlightning)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 5:04pm UTC](https://discuss.elastic.co/t/elastic-count-returns-incorrect-count/256545 "2020-11-24T17:04:28Z")
I just added a bunch of documents to my index but when I run a count query I see that the count hasn't changed. I've queried the index and seen that the new documents have been added. Here's the query: GET /listings/\_co… --- ## [Match all fields tokens](https://discuss.elastic.co/t/match-all-fields-tokens/256546)
**Author:** [@Anton00](https://discuss.elastic.co/u/Anton00)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 5:07pm UTC](https://discuss.elastic.co/t/match-all-fields-tokens/256546 "2020-11-24T17:07:01Z")
I want to have match when all tokens from query match all field token. For example: field contains text "Red Blue Green" and query that match it should contain 3 token in any order "red", "blue", "green". I've searched a… --- ## [DSL query with string and numeric regex in Kibana](https://discuss.elastic.co/t/dsl-query-with-string-and-numeric-regex-in-kibana/256524)
**Author:** [@saurabh1991](https://discuss.elastic.co/u/saurabh1991)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 5:05pm UTC](https://discuss.elastic.co/t/dsl-query-with-string-and-numeric-regex-in-kibana/256524 "2020-11-24T17:05:14Z")
I am not able to search for the following pattern in Kibana. total-time: x.abcdef sec x value can be in range 0 to 99 a b c d e f values can be in 0 to 9. I tried using query\_string: { "query": { "query\_string… --- ## [Customize coordinate map legend content](https://discuss.elastic.co/t/customize-coordinate-map-legend-content/256493)
**Author:** [@Jugurtha\_BELKALEM](https://discuss.elastic.co/u/Jugurtha_BELKALEM)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 5:04pm UTC](https://discuss.elastic.co/t/customize-coordinate-map-legend-content/256493 "2020-11-24T17:04:21Z")
Hi, I have created a coordinate map for assets tracking. I have used a unique count aggregation to draw a map with different vehicule's trajectory (which works pretty fine). However, map's legend still shows the counts … --- ## [Finding deprecated functions](https://discuss.elastic.co/t/finding-deprecated-functions/256539)
**Author:** [@Tom99](https://discuss.elastic.co/u/Tom99)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 4:50pm UTC](https://discuss.elastic.co/t/finding-deprecated-functions/256539 "2020-11-24T16:50:02Z")
We use ELK 7.10. Start version was 7.7. A version prior to 7.7 was not installed/used. Logfiles will be parsed by filebeat and sent over logstash to elasticsearch. It seems that a specific call in logstash causes a mes… --- ## [Config mails to send me notification of a watcher alert](https://discuss.elastic.co/t/config-mails-to-send-me-notification-of-a-watcher-alert/256540)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 4:41pm UTC](https://discuss.elastic.co/t/config-mails-to-send-me-notification-of-a-watcher-alert/256540 "2020-11-24T16:41:16Z")
\*\*good day \*\* I'm trying to configure the emails to send me notification of a watcher alert, and configure in elasticsearch.yml, runs it without error, but when I run the alert I get this error, also configure the passw… --- ## [Apply a filter to a count on the y-axis of a bar vizualization](https://discuss.elastic.co/t/apply-a-filter-to-a-count-on-the-y-axis-of-a-bar-vizualization/256133)
**Author:** [@SilvrDuck](https://discuss.elastic.co/u/SilvrDuck)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 4:18pm UTC](https://discuss.elastic.co/t/apply-a-filter-to-a-count-on-the-y-axis-of-a-bar-vizualization/256133 "2020-11-24T16:18:37Z")
Hi, I have a collection of timestamped events being part of two categories. I can filter on a field to get the events of any and display them as a histogram aggregated by timestamp. So far so good. I can't plot both on… --- ## [Arm64 docker containers](https://discuss.elastic.co/t/arm64-docker-containers/256508)
**Author:** [@netthier](https://discuss.elastic.co/u/netthier)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 4:04pm UTC](https://discuss.elastic.co/t/arm64-docker-containers/256508 "2020-11-24T16:04:13Z")
Given that elasticsearch already has an arm64 docker image, are arm64 docker images planned for kibana and logstash? --- ## [\[hadoop\] - Snapshots on Sonatype refer to zip instead of jar](https://discuss.elastic.co/t/hadoop-snapshots-on-sonatype-refer-to-zip-instead-of-jar/256532)
**Author:** [@jeroenst](https://discuss.elastic.co/u/jeroenst)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 3:44pm UTC](https://discuss.elastic.co/t/hadoop-snapshots-on-sonatype-refer-to-zip-instead-of-jar/256532 "2020-11-24T15:44:47Z")
Hi, I'm trying to get snapshot versions for elasticsearch-hadoop, however the maven-metadata.xml refers to a zip. It seems everyday 2 releases are made, 1 jar and 1 zip, but only the zip build is referred to. https://o… --- ## [Date filter return \_dateparsefailure](https://discuss.elastic.co/t/date-filter-return-dateparsefailure/256341)
**Author:** [@tong1125](https://discuss.elastic.co/u/tong1125)\ **Replies:** 4\ **Last updated:** [November 24, 2020, 3:28pm UTC](https://discuss.elastic.co/t/date-filter-return-dateparsefailure/256341 "2020-11-24T15:28:40Z")
I'm new to ELK and tried to setup my first pipeline. The input and output works fine. But when I tried to play with date filter, the "@timestamp" field is not replaced with the time in the log file. Seems there is no si… --- ## [Index .tasks missing](https://discuss.elastic.co/t/index-tasks-missing/255687)
**Author:** [@aurimas](https://discuss.elastic.co/u/aurimas)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 3:20pm UTC](https://discuss.elastic.co/t/index-tasks-missing/255687 "2020-11-24T15:20:37Z")
Hi, I am trying to track problematic tasks in Elasticsearch 6.8. And as I understast such tasks should be visable in .tasks index. But it is non existing and I can not find any documentation how to enable it. \_tasks AP… --- ## [Failed to parse field \[input\] of type \[text\]](https://discuss.elastic.co/t/failed-to-parse-field-input-of-type-text/256486)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 2:57pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-input-of-type-text/256486 "2020-11-24T14:57:28Z")
Hi, i have this problem on logstash. On index template i set "input" like "text" and when log arrives from filebeat, my logstash.log said : "failed to parse field \[input\] of type \[text\] in document with id ..." --- ## [Daily index and monthly index query performance difference](https://discuss.elastic.co/t/daily-index-and-monthly-index-query-performance-difference/256522)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 2:54pm UTC](https://discuss.elastic.co/t/daily-index-and-monthly-index-query-performance-difference/256522 "2020-11-24T14:54:36Z")
Hi, I'm wondering the performance difference between daily monthly indices. Lets say i have an index named test and logstash output is configured like this: output { elasticsearch { hosts =\> \["esnode1:9200… --- ## [Encrypt/protect logstash lookup files?](https://discuss.elastic.co/t/encrypt-protect-logstash-lookup-files/256515)
**Author:** [@aerodynamic](https://discuss.elastic.co/u/aerodynamic)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 2:42pm UTC](https://discuss.elastic.co/t/encrypt-protect-logstash-lookup-files/256515 "2020-11-24T14:42:49Z")
Hello, For my companies product we are in the need to encrypt/protect the lookup files used in our pipeline. --- ## [Using "fields.type" in logstash 7.6](https://discuss.elastic.co/t/using-fields-type-in-logstash-7-6/255105)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 2:31pm UTC](https://discuss.elastic.co/t/using-fields-type-in-logstash-7-6/255105 "2020-11-24T14:31:50Z")
Upgrading from 5.6 to 7.6, how can i use the "fields.type" in logstash to filter out data and also in output section. We had "type" field earlier configured however i believe its not longer supported now. input { beat… --- ## [Return missing ids from given list](https://discuss.elastic.co/t/return-missing-ids-from-given-list/256365)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 5\ **Last updated:** [November 24, 2020, 2:29pm UTC](https://discuss.elastic.co/t/return-missing-ids-from-given-list/256365 "2020-11-24T14:29:40Z")
Hi, Is there a way, we can return only those ids which is not found in a given list. For eaxample list to search \[1,2,3,4,5,6,7,8,9,10\] and query will return etc \[2,3,8,10\] list of missing ids in ES index. Thanks in … --- ## [Getting error in logstash output email plugin?](https://discuss.elastic.co/t/getting-error-in-logstash-output-email-plugin/256471)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 2:26pm UTC](https://discuss.elastic.co/t/getting-error-in-logstash-output-email-plugin/256471 "2020-11-24T14:26:40Z")
Error : \[2020-11-24T14:24:59,453\]\[ERROR\]\[logstash.outputs.email \]\[main\] Something happen while delivering an email {:exception=\>#\ **Author:** [@Chen\_Levi](https://discuss.elastic.co/u/Chen_Levi)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 2:08pm UTC](https://discuss.elastic.co/t/metrics-and-alerts-for-elasticsearch/256319 "2020-11-24T14:08:24Z") Hi Im trying to do pretty simple thing for our ElasticSearch cluster (Elastic.co) and i cant seems to find the right way of doing so. i have an Elasticsearch cluster managed by Elastic.co and i've used to monitor it us… --- ## [7.10.0 Loading Data Animation](https://discuss.elastic.co/t/7-10-0-loading-data-animation/256381)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 1:55pm UTC](https://discuss.elastic.co/t/7-10-0-loading-data-animation/256381 "2020-11-24T13:55:53Z")
Is absolutely terrible for user experience. As an experienced administrator/user, even I forget to look up in the top left corner for the tiny spinning circle, instead I'm left wondering for a moment if the data has loa… --- ## [How can I check how many shards I have for an index?](https://discuss.elastic.co/t/how-can-i-check-how-many-shards-i-have-for-an-index/256510)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 1:50pm UTC](https://discuss.elastic.co/t/how-can-i-check-how-many-shards-i-have-for-an-index/256510 "2020-11-24T13:50:17Z")
I'm using this command curl -X GET http://elasticsearch:9200/my-index-\*/\_settings?pretty and I'm getting "number\_of\_shards": "1". Which doesn't make much sense, because when the index is created on runtime, no settin… --- ## [Elasticsearch service times out, although cluster appears to be working properly](https://discuss.elastic.co/t/elasticsearch-service-times-out-although-cluster-appears-to-be-working-properly/256391)
**Author:** [@jtbis](https://discuss.elastic.co/u/jtbis)\ **Replies:** 6\ **Last updated:** [November 24, 2020, 12:28pm UTC](https://discuss.elastic.co/t/elasticsearch-service-times-out-although-cluster-appears-to-be-working-properly/256391 "2020-11-24T12:28:04Z")
I am facing an issue where systemd doesn't appear to realize that Elasticsearch has started successfully after updating to 6.8.0. The cluster shows green, the application can write to it and there are no errors in the l… --- ## [Average of a string text variable](https://discuss.elastic.co/t/average-of-a-string-text-variable/256166)
**Author:** [@amitvermancl](https://discuss.elastic.co/u/amitvermancl)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 12:27pm UTC](https://discuss.elastic.co/t/average-of-a-string-text-variable/256166 "2020-11-24T12:27:46Z")
Hi All, I am new to elastic search SQL , and canvas side of world. I have a variable 'message' in which data comes in 't' text format and it has time duration coming in. I need to take the average of that variable an… --- ## [error\_class=Fluent::Plugin::ElasticsearchOutput::RecoverableRequestFailure error="could not push logs to Elasticsearch cluster](https://discuss.elastic.co/t/error-class-fluent-recoverablerequestfailure-error-could-not-push-logs-to-elasticsearch-cluster/256388)
**Author:** [@David\_Essien](https://discuss.elastic.co/u/David_Essien)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 11:22am UTC](https://discuss.elastic.co/t/error-class-fluent-recoverablerequestfailure-error-could-not-push-logs-to-elasticsearch-cluster/256388 "2020-11-24T11:22:49Z")
I am getting this error from the fluentd pods and they keep restarting. Not sure of what the cause is. Any help would be appreciated. /usr/local/bundle/gems/fluentd-1.11.4/lib/fluent/plugin\_helper/http\_server/compat… --- ## [Cloudwatch logs input plugin not streaming all log groups](https://discuss.elastic.co/t/cloudwatch-logs-input-plugin-not-streaming-all-log-groups/252300)
**Author:** [@sainath](https://discuss.elastic.co/u/sainath)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 11:22am UTC](https://discuss.elastic.co/t/cloudwatch-logs-input-plugin-not-streaming-all-log-groups/252300 "2020-11-24T11:22:18Z")
Hi , I am using cloudwatch log input plugin to stream logs to ES using logstash. below is my configuration. input { cloudwatch\_logs { log\_group =\> \[ "/aws" \] log\_group\_prefix =\> true access\_k… --- ## [How to change logstash jdbc last run default timezone to local](https://discuss.elastic.co/t/how-to-change-logstash-jdbc-last-run-default-timezone-to-local/256490)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 10:57am UTC](https://discuss.elastic.co/t/how-to-change-logstash-jdbc-last-run-default-timezone-to-local/256490 "2020-11-24T10:57:59Z")
I am using logstash to sync data between sql server and elasticsearch. how to change timezone from UTC to LOCAL. when i run logstash .conf jdbc lastrun 'logstash-7.10.0/.logstash\_jdbc\_last\_run' getting update with UTC… --- ## [Help - Custom GeoIP Target / Updating Template/Index](https://discuss.elastic.co/t/help-custom-geoip-target-updating-template-index/255874)
**Author:** [@marcasino](https://discuss.elastic.co/u/marcasino)\ **Replies:** 9\ **Last updated:** [November 24, 2020, 10:48am UTC](https://discuss.elastic.co/t/help-custom-geoip-target-updating-template-index/255874 "2020-11-24T10:48:05Z")
Hi, I'm a beginner and have been trying to use the geoip function in logstash to allow me to visualise the IP addresses being blocked by my home firewall. However, I've now run into the problem that a number of people … --- ## [Installing plugin](https://discuss.elastic.co/t/installing-plugin/255999)
**Author:** [@omerf](https://discuss.elastic.co/u/omerf)\ **Replies:** 8\ **Last updated:** [November 24, 2020, 10:36am UTC](https://discuss.elastic.co/t/installing-plugin/255999 "2020-11-24T10:36:45Z")
I have a plugin generated with the dev version, and I want to install it to kibana 7.8.0. I ran the scripts and it installed fine. This is the error when opening Kibana after the installation. I built the plugin with… --- ## [Packetbeat does not point to a write index](https://discuss.elastic.co/t/packetbeat-does-not-point-to-a-write-index/256478)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 9:56am UTC](https://discuss.elastic.co/t/packetbeat-does-not-point-to-a-write-index/256478 "2020-11-24T09:56:43Z")
Hello, I tried to edit packetbeat Policy, and then from index management on Kibana I removed the policy from that index and then added it again (to take on consideration the new configuration), unfortunately I a gettin… --- ## [Elasticsearch concurrent request handling with optimistic locking in Java UpdateRequest with Upsert](https://discuss.elastic.co/t/elasticsearch-concurrent-request-handling-with-optimistic-locking-in-java-updaterequest-with-upsert/256477)
**Author:** [@blackOcean](https://discuss.elastic.co/u/blackOcean)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 9:47am UTC](https://discuss.elastic.co/t/elasticsearch-concurrent-request-handling-with-optimistic-locking-in-java-updaterequest-with-upsert/256477 "2020-11-24T09:47:16Z")
Concurrent request handling I have one use case where application can get concurrent requests to update single document. Earlier I was using IndexRequest with External versionining but IndexRequest I was facing problem … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1678) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1680)