# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1692 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1693 --- ## [Sort Discover Search Table 7.10](https://discuss.elastic.co/t/sort-discover-search-table-7-10/255708)
**Author:** [@weand](https://discuss.elastic.co/u/weand)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 8:36pm UTC](https://discuss.elastic.co/t/sort-discover-search-table-7-10/255708 "2020-11-17T20:36:28Z")
Hi, it seems sorting in the Discover Search Table does not work in anymore in recent Releases. Tested with 7.9 and 7.10. Is that a known bug ? Cheers Andreas --- ## [Elasticsearch heap dump phd](https://discuss.elastic.co/t/elasticsearch-heap-dump-phd/255572)
**Author:** [@perezs](https://discuss.elastic.co/u/perezs)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 8:12pm UTC](https://discuss.elastic.co/t/elasticsearch-heap-dump-phd/255572 "2020-11-17T20:12:33Z")
Does Elasticsearch have plugin's to analyze Java heap dumps phd format? --- ## [Filebeat doesn't work with AWS ES domain](https://discuss.elastic.co/t/filebeat-doesnt-work-with-aws-es-domain/255683)
**Author:** [@hairongGao](https://discuss.elastic.co/u/hairongGao)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 8:12pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-work-with-aws-es-domain/255683 "2020-11-17T20:12:09Z")
Hi Team, I've been trying to make filebeat working with AWS ES domain , but I keep getting this error: 2020-11-17T11:42:25.740Z ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(ela… --- ## [Elasticsearch winlogbeat field host.ip value issue](https://discuss.elastic.co/t/elasticsearch-winlogbeat-field-host-ip-value-issue/255660)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 8:09pm UTC](https://discuss.elastic.co/t/elasticsearch-winlogbeat-field-host-ip-value-issue/255660 "2020-11-17T20:09:28Z")
winlogbeat version 7.2.0 host.ip : 10.33.55.5 But winlogbeat version 7.10.0 host.ip field show: fe80::95f4:40d4:80a3:8cd, 10.33.55.5, fe80::399f:e9ad:5f5a:9511, 169.254.149.17, fe80::dc91:96a:a1b8:82e3, 169.254.130.22… --- ## [Accessing nested fields in ruby filter for math](https://discuss.elastic.co/t/accessing-nested-fields-in-ruby-filter-for-math/255740)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 7:30pm UTC](https://discuss.elastic.co/t/accessing-nested-fields-in-ruby-filter-for-math/255740 "2020-11-17T19:30:54Z")
Hello, I am having issues with this bit of code where I am trying to add 3 nested fields together and place them in a new nested field. here is my bit of ruby code ruby { code =\> "event.set('\[device\]\[disconnect\]\[dura… --- ## [Backwards update for transform data](https://discuss.elastic.co/t/backwards-update-for-transform-data/255668)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 7:16pm UTC](https://discuss.elastic.co/t/backwards-update-for-transform-data/255668 "2020-11-17T19:16:21Z")
Hello I wonder what's the best practices , in case of a failed transform (for example if a new index was created with wrong mapping or any reason), of completing the missing data. example: created a new transform at 2… --- ## [Elastisearch daterange filter - days of week](https://discuss.elastic.co/t/elastisearch-daterange-filter-days-of-week/255750)
**Author:** [@shifra](https://discuss.elastic.co/u/shifra)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 6:51pm UTC](https://discuss.elastic.co/t/elastisearch-daterange-filter-days-of-week/255750 "2020-11-17T18:51:28Z")
Hi! This is my first time on this forum, I hope my question is clear. Please let me know if I should add any details. My goal: Implement a filter on days of week and time I'm trying to implement a filter for open hour… --- ## [Sort array before concatenated fingerprint hash?](https://discuss.elastic.co/t/sort-array-before-concatenated-fingerprint-hash/255602)
**Author:** [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Replies:** 5\ **Last updated:** [November 17, 2020, 6:56pm UTC](https://discuss.elastic.co/t/sort-array-before-concatenated-fingerprint-hash/255602 "2020-11-17T18:56:02Z")
I have src\_ip and dst\_ip fields. I have copied both those values to "\[fw\]\[talkers\]" field to produce this: "fw": { "talkers": \[ "172.16.216.118", "172.23.253.22" \] Now I run fingerprint on this value to pr… --- ## [Kubernetes.container.memory.usage.bytes doesn't match pmap](https://discuss.elastic.co/t/kubernetes-container-memory-usage-bytes-doesnt-match-pmap/255748)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 6:48pm UTC](https://discuss.elastic.co/t/kubernetes-container-memory-usage-bytes-doesnt-match-pmap/255748 "2020-11-17T18:48:20Z")
None of the metric sets listed above closely match: pmap \ which is the size of the process. I have tried working set, rss and usage.bytes, and none seem to match this. What is the correct metric to use for memor… --- ## [Python3 Large Query Cardinality & Query return different results](https://discuss.elastic.co/t/python3-large-query-cardinality-query-return-different-results/255717)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 6:45pm UTC](https://discuss.elastic.co/t/python3-large-query-cardinality-query-return-different-results/255717 "2020-11-17T18:45:44Z")
hi, i'm using python3 and the elasticsearch library to query some very large ES indexes. I've been following this blog post as a reference: I'm getting some results i dont understand, the Cardnality returns a certa… --- ## [FVH Highlighter Not Being Used By Default](https://discuss.elastic.co/t/fvh-highlighter-not-being-used-by-default/255743)
**Author:** [@jdouty](https://discuss.elastic.co/u/jdouty)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 6:12pm UTC](https://discuss.elastic.co/t/fvh-highlighter-not-being-used-by-default/255743 "2020-11-17T18:12:16Z")
Hi everyone! I've been playing around with the FVH and noticed the highlighter isn't behaving as it's described in the term vector documention. Down at the bottom of that page it shows that you can use the default high… --- ## [Elastic Agent Linux Install Directory](https://discuss.elastic.co/t/elastic-agent-linux-install-directory/255595)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 6:10pm UTC](https://discuss.elastic.co/t/elastic-agent-linux-install-directory/255595 "2020-11-17T18:10:12Z")
Hi all, I installed Elastic Agent from /tmp/elastic-agent-7.10.0-linux-x86\_64. I now see a metricbeat running from /tmp/elastic-agent-7.10.0-linux-x86\_64/data/elastic-agent-1428d5. Is this intended? Why are downloaded … --- ## [Filebeat fortinet module not indexing after upgrading it and kibana to 7.10.0,](https://discuss.elastic.co/t/filebeat-fortinet-module-not-indexing-after-upgrading-it-and-kibana-to-7-10-0/255739)
**Author:** [@jonjon](https://discuss.elastic.co/u/jonjon)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 5:32pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-not-indexing-after-upgrading-it-and-kibana-to-7-10-0/255739 "2020-11-17T17:32:09Z")
I upgraded Kibana and filebeat to 7.10.0 and my Fortinet logs aren't being indexed anymore. Looking at the logs, it looks like I am filebeat is connected to Kibana but I am getting several of these messages below and log… --- ## [Trouble Mutating](https://discuss.elastic.co/t/trouble-mutating/255598)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 6\ **Last updated:** [November 17, 2020, 5:36pm UTC](https://discuss.elastic.co/t/trouble-mutating/255598 "2020-11-17T17:36:19Z")
I am having trouble performing a mutate. I thought I had it working with a more simplified version of this config but cannot seem to get it going in this new one (though everything else seems to be working much better). … --- ## [Get system.process.cpu.user.ticks](https://discuss.elastic.co/t/get-system-process-cpu-user-ticks/255584)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 4:59pm UTC](https://discuss.elastic.co/t/get-system-process-cpu-user-ticks/255584 "2020-11-17T16:59:16Z")
I am trying to located system.process.cpu.user.ticks but I can't find it on my output. do I have to enable something in my system.module file? I only have following for system.process "cpu" =\> { … --- ## [Elastic Agent 7.10 - Setup - Invalid URL - NULL](https://discuss.elastic.co/t/elastic-agent-7-10-setup-invalid-url-null/255416)
**Author:** [@casa0](https://discuss.elastic.co/u/casa0)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 4:43pm UTC](https://discuss.elastic.co/t/elastic-agent-7-10-setup-invalid-url-null/255416 "2020-11-17T16:43:17Z")
Hi, I'm seeing an error "Invalid URL: null" when trying to view any pages related to fleet. I was testing 7.9.3 in Docker and was able to add a few agents, then upgraded to 7.10.0. Now none of the fleet pages will load.… --- ## [Setting re-index batch size in curator tool](https://discuss.elastic.co/t/setting-re-index-batch-size-in-curator-tool/255579)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 4:30pm UTC](https://discuss.elastic.co/t/setting-re-index-batch-size-in-curator-tool/255579 "2020-11-17T16:30:46Z")
When using \_reindex api in Elasticsearch, we can set scroll batch size as below From https://www.elastic.co/guide/en/elasticsearch/reference/6.8/docs-reindex.html - By default \_reindex uses scroll batches of 1000. You c… --- ## [Connect both ES 6.7 & ES 7.x to the same Kibana host](https://discuss.elastic.co/t/connect-both-es-6-7-es-7-x-to-the-same-kibana-host/255649)
**Author:** [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 3:46pm UTC](https://discuss.elastic.co/t/connect-both-es-6-7-es-7-x-to-the-same-kibana-host/255649 "2020-11-17T15:46:52Z")
Hi mates, Now I am running old Security Onion 16 (ElasticStack v6.7) and want to upgrade to S.O2.3 but I see the incident response process is much more complicated so I decide to build a new ES + Kibana v7.10, then the … --- ## [Ruby Script in Logstash :: Enters a NULL into the Data?](https://discuss.elastic.co/t/ruby-script-in-logstash-enters-a-null-into-the-data/255727)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 3:41pm UTC](https://discuss.elastic.co/t/ruby-script-in-logstash-enters-a-null-into-the-data/255727 "2020-11-17T15:41:54Z")
Hi Logstash Jedi Masters, I’m running Logstash 7.7.1 in the Docker container. (Yes, I know I need to upgrade) In my Logstash config file, I’m running a snippet of Ruby code: ruby { init =\> " require 'sock… --- ## [Prune filter plugin - How whitelist a nested field?](https://discuss.elastic.co/t/prune-filter-plugin-how-whitelist-a-nested-field/255720)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 3:16pm UTC](https://discuss.elastic.co/t/prune-filter-plugin-how-whitelist-a-nested-field/255720 "2020-11-17T15:16:14Z")
Documentation at has this example and it mentions that it would allow only "msg" through. filter { prune { whitelist\_names =\> \["^msg$"\] } } If I have a single record that has "source" … --- ## [Full Index Rebuild with 5M documents on Elastic search 7.6 takes 1 week to complete](https://discuss.elastic.co/t/full-index-rebuild-with-5m-documents-on-elastic-search-7-6-takes-1-week-to-complete/255624)
**Author:** [@nimohara](https://discuss.elastic.co/u/nimohara)\ **Replies:** 14\ **Last updated:** [November 17, 2020, 2:46pm UTC](https://discuss.elastic.co/t/full-index-rebuild-with-5m-documents-on-elastic-search-7-6-takes-1-week-to-complete/255624 "2020-11-17T14:46:50Z")
Hey There Hope all are doing well Please have a look in to the below issue and provide your valuable suggestion on this. Currently Elastic 7.6 is running on cluster with 3 nodes and it's having 5M records in it. Whil… --- ## [FileBeat apache module log issue](https://discuss.elastic.co/t/filebeat-apache-module-log-issue/255718)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-log-issue/255718 "2020-11-17T14:44:18Z")
apache module configuration file Module: apache Docs: https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-apache.html module: apache Access logs access: enabled: true Set custom paths for the log fi… --- ## [Field analyzer for matching concepts and names](https://discuss.elastic.co/t/field-analyzer-for-matching-concepts-and-names/254521)
**Author:** [@jporzelt](https://discuss.elastic.co/u/jporzelt)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 2:38pm UTC](https://discuss.elastic.co/t/field-analyzer-for-matching-concepts-and-names/254521 "2020-11-17T14:38:12Z")
Dear Elasticsearch community, dear Elastic team, I have a question about field analyzers that I would like to discuss here. In our index we have fields (field cities in the below example) that store known concepts or n… --- ## [Mutate rename filter not working on nested fields](https://discuss.elastic.co/t/mutate-rename-filter-not-working-on-nested-fields/255713)
**Author:** [@blastodorm](https://discuss.elastic.co/u/blastodorm)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 2:33pm UTC](https://discuss.elastic.co/t/mutate-rename-filter-not-working-on-nested-fields/255713 "2020-11-17T14:33:03Z")
I'm trying to rename a field to work with my data. The field I'm attempting to rename is nested. My config: filter { mutate {rename =\> { "\[message\]\[context\]\[payload\]\[geolocation\]\[latitude\]" =\> "\[message\]\[context\]\[payl… --- ## [Kibana REST API not working](https://discuss.elastic.co/t/kibana-rest-api-not-working/255704)
**Author:** [@Maria20](https://discuss.elastic.co/u/Maria20)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 2:31pm UTC](https://discuss.elastic.co/t/kibana-rest-api-not-working/255704 "2020-11-17T14:31:46Z")
Hi, I tried to check index-patterns using kibana rest api, but it is not working. curl -XGET http://localhost:5601/api/saved\_objects/index-pattern/$indx I am using kibana 7.3.2 Thanks --- ## [To create a log-level depends on string](https://discuss.elastic.co/t/to-create-a-log-level-depends-on-string/255712)
**Author:** [@Guhan\_S](https://discuss.elastic.co/u/Guhan_S)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 2:09pm UTC](https://discuss.elastic.co/t/to-create-a-log-level-depends-on-string/255712 "2020-11-17T14:09:46Z")
message:{"level":30",hostname":"someserver.com","pid":1627," like this i am getting logs, i have filter accoding to level in message. level:30 means info level log, 20 means debug level log --- ## [Set kibana.autocompleteTerminateAfter via DevTools](https://discuss.elastic.co/t/set-kibana-autocompleteterminateafter-via-devtools/255685)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 8\ **Last updated:** [November 17, 2020, 2:08pm UTC](https://discuss.elastic.co/t/set-kibana-autocompleteterminateafter-via-devtools/255685 "2020-11-17T14:08:39Z")
Hi, Is there a way to set kibana.autocompleteTerminateAfter via DevTools or via curl command? Thank you in advance! BR Voula --- ## [Garbage collection old vs young](https://discuss.elastic.co/t/garbage-collection-old-vs-young/255361)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 2:07pm UTC](https://discuss.elastic.co/t/garbage-collection-old-vs-young/255361 "2020-11-17T14:07:35Z")
Hi, Question, On my nodes (7.9.3) I see the following graph's in stackmonitoring: What strikes me is the 0 for old . As far as I know, the default ratio is 2? So I would not expect 0 here, but about double of what y… --- ## [How can a replica recover from another replica but not the primary shard](https://discuss.elastic.co/t/how-can-a-replica-recover-from-another-replica-but-not-the-primary-shard/255703)
**Author:** [@chemboking](https://discuss.elastic.co/u/chemboking)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 2:03pm UTC](https://discuss.elastic.co/t/how-can-a-replica-recover-from-another-replica-but-not-the-primary-shard/255703 "2020-11-17T14:03:41Z")
Here is my scenario: create one index with 0 replica; merge this index to one segment; stop all the write operations and set the num of replica to 20; The question is that the replicas can only be recovere… --- ## [Kibana dashbord trading candle](https://discuss.elastic.co/t/kibana-dashbord-trading-candle/255600)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 8\ **Last updated:** [November 17, 2020, 1:58pm UTC](https://discuss.elastic.co/t/kibana-dashbord-trading-candle/255600 "2020-11-17T13:58:24Z")
Hello, giving this example data, Is It possible to make trading candle in kibana? Maybe using timelion? {'crypto.candle.close': '16746.10000000', 'crypto.candle.closeTime': '2020-11-16T22:59:59Z', 'crypto.candle.h… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1691) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1693)