# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1718 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1719 --- ## [Query documents to match a value in a sublist of a list](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 2:44pm UTC](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831 "2020-11-03T14:44:55Z")
I am storing windows folder permissions in elastic as a document per folder, then each folder has a list of users that has access to this folder, and each user has list of permissions (accessmask) that is stored as a lis… --- ## [Not getting any response on POST and BULK requests](https://discuss.elastic.co/t/not-getting-any-response-on-post-and-bulk-requests/254155)
**Author:** [@kpiyush](https://discuss.elastic.co/u/kpiyush)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 2:43pm UTC](https://discuss.elastic.co/t/not-getting-any-response-on-post-and-bulk-requests/254155 "2020-11-03T14:43:20Z")
Hi, As the title says, any post or bulk request, basically any writes is not working. I checked the cluster health and the status is green. I also checked for disk usage and more than half is available. I ran following… --- ## [What's different between reindexing an exist document and updating some field of document?](https://discuss.elastic.co/t/whats-different-between-reindexing-an-exist-document-and-updating-some-field-of-document/254152)
**Author:** [@DumpCat](https://discuss.elastic.co/u/DumpCat)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 2:33pm UTC](https://discuss.elastic.co/t/whats-different-between-reindexing-an-exist-document-and-updating-some-field-of-document/254152 "2020-11-03T14:33:06Z")
If I have an exist document，is reindexing whole new document better than updating some field of document? --- ## [How to get elasticsearch URI](https://discuss.elastic.co/t/how-to-get-elasticsearch-uri/254159)
**Author:** [@grynhtjnyuk](https://discuss.elastic.co/u/grynhtjnyuk)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 2:31pm UTC](https://discuss.elastic.co/t/how-to-get-elasticsearch-uri/254159 "2020-11-03T14:31:09Z")
I have created an account on this website ( https://www.elastic.co/downloads/ ), I have an access to elastic-stack. But, could you please tell me how can I see elasticsearch Uri to use it in my own application. --- ## [Script Params vs Constant Hash in Script](https://discuss.elastic.co/t/script-params-vs-constant-hash-in-script/254163)
**Author:** [@git-blame](https://discuss.elastic.co/u/git-blame)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 2:26pm UTC](https://discuss.elastic.co/t/script-params-vs-constant-hash-in-script/254163 "2020-11-03T14:26:41Z")
I need to translate from one set of values to another. I would use the translate filter plugin but I need to keep the original value if no translation is found instead of nil. So my code is: TRANSLATE\_MAP = { "foo" =\> … --- ## [How to hide Filter options in Kibana Dashboard](https://discuss.elastic.co/t/how-to-hide-filter-options-in-kibana-dashboard/254142)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 2:06pm UTC](https://discuss.elastic.co/t/how-to-hide-filter-options-in-kibana-dashboard/254142 "2020-11-03T14:06:27Z")
Is there any options in kibana to hide the red marked part in dashboard --- ## [Filebeat Sementation Fault on Centos8](https://discuss.elastic.co/t/filebeat-sementation-fault-on-centos8/254162)
**Author:** [@GeorgeGkinis](https://discuss.elastic.co/u/GeorgeGkinis)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-sementation-fault-on-centos8/254162 "2020-11-03T14:04:58Z")
Hello there, I get a segmentation fault when trying to start Filebeat. Tried v6.8.13 and 7.9.3 What I do : Download Filebeat : https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.9.3-linux-x86\_64.tar.g… --- ## [Logstash of first node getting stopped after adding second node into cluster, added ilm\_enabled=false](https://discuss.elastic.co/t/logstash-of-first-node-getting-stopped-after-adding-second-node-into-cluster-added-ilm-enabled-false/253518)
**Author:** [@kkhadka](https://discuss.elastic.co/u/kkhadka)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 2:01pm UTC](https://discuss.elastic.co/t/logstash-of-first-node-getting-stopped-after-adding-second-node-into-cluster-added-ilm-enabled-false/253518 "2020-11-03T14:01:43Z")
The ERROR logs are as follow: \[2020-10-12T17:52:25,998\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[events\] Failed to install template. {:message=\>"Elasticsearch Unreachable: \[http://164.\*\*.185.202:9200/\]\[Manticore::SocketE… --- ## [Filter / query](https://discuss.elastic.co/t/filter-query/253772)
**Author:** [@peretz\_shlomi](https://discuss.elastic.co/u/peretz_shlomi)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 1:40pm UTC](https://discuss.elastic.co/t/filter-query/253772 "2020-11-03T13:40:26Z")
Hello everyone i have a dashboard is consists number of visualize I want to filter some of visualize by the last value in a particular field. How can I do that? --- ## [Making a delay scripted field from a field containing several dates](https://discuss.elastic.co/t/making-a-delay-scripted-field-from-a-field-containing-several-dates/254063)
**Author:** [@Mike\_Di](https://discuss.elastic.co/u/Mike_Di)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 5:45pm UTC](https://discuss.elastic.co/t/making-a-delay-scripted-field-from-a-field-containing-several-dates/254063 "2020-11-02T17:45:47Z")
Hello, i would like to make a scripted field of a delay process time from a field which contains several dates separated by a comma like this dates\_multi : 2020-07-17 04:02:00,2020-07-24 04:02:00,2020-07-31 04:02:00,20… --- ## [ES ingest node per input](https://discuss.elastic.co/t/es-ingest-node-per-input/253816)
**Author:** [@ccmsi](https://discuss.elastic.co/u/ccmsi)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 1:13pm UTC](https://discuss.elastic.co/t/es-ingest-node-per-input/253816 "2020-11-03T13:13:42Z")
Greetings. Filebeat modules come with matching ES ingest node configuration. Filebeat routes module specific input through that matching ingest node on ES. I would like to do the same for normal inputs, defining with t… --- ## [IAM role ARN on AWS Destination](https://discuss.elastic.co/t/iam-role-arn-on-aws-destination/254081)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 1:12pm UTC](https://discuss.elastic.co/t/iam-role-arn-on-aws-destination/254081 "2020-11-03T13:12:18Z")
Hi all. I have Elasticsearch on AWS and I setup a destination for the alerting to go to AWS SNS. In the configuration it asks 2 settings: SNS Topic ARN and it's should be ok but also it asks about IAM role ARN which … --- ## [How to fetch date time range in markdown?](https://discuss.elastic.co/t/how-to-fetch-date-time-range-in-markdown/253776)
**Author:** [@Abhi6](https://discuss.elastic.co/u/Abhi6)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 1:03pm UTC](https://discuss.elastic.co/t/how-to-fetch-date-time-range-in-markdown/253776 "2020-11-03T13:03:23Z")
I am trying in this way \[Open\]\[1\] \[1\]:https://xyz.com/from?{{params.\_timestamp}} But it's not working. Thanks in advance !! --- ## [Logstash and ILM - rollover not working](https://discuss.elastic.co/t/logstash-and-ilm-rollover-not-working/253530)
**Author:** [@BBQigniter](https://discuss.elastic.co/u/BBQigniter)\ **Replies:** 6\ **Last updated:** [November 3, 2020, 12:33pm UTC](https://discuss.elastic.co/t/logstash-and-ilm-rollover-not-working/253530 "2020-11-03T12:33:39Z")
I please need help to understand ILM in combination with Logstash. My current setup somehow seems not to work as expected. Using ELK 7.9.1 - My configuration looks like: ILM policy - logstash-syslog-compliance { - "l… --- ## [Elasticsearch: Max virtual memory areas vm.max\_map\_count \[65530\] is too low, increase to at least \[262144\] Helm](https://discuss.elastic.co/t/elasticsearch-max-virtual-memory-areas-vm-max-map-count-65530-is-too-low-increase-to-at-least-262144-helm/254150)
**Author:** [@Sanjeev\_kumar\_N](https://discuss.elastic.co/u/Sanjeev_kumar_N)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 12:10pm UTC](https://discuss.elastic.co/t/elasticsearch-max-virtual-memory-areas-vm-max-map-count-65530-is-too-low-increase-to-at-least-262144-helm/254150 "2020-11-03T12:10:55Z")
Hi Team, Trying to configure elastic search via helm chart. Please find the below are steps. helm create ele cat values.yaml imageELE: repository: X.X.X.X:8085/elasticsearch pullPolicy: IfNotPresent Overrides the i… --- ## [Not seeing any pfsense logs](https://discuss.elastic.co/t/not-seeing-any-pfsense-logs/254145)
**Author:** [@Lusca\_lusca](https://discuss.elastic.co/u/Lusca_lusca)\ **Replies:** 4\ **Last updated:** [November 3, 2020, 11:48am UTC](https://discuss.elastic.co/t/not-seeing-any-pfsense-logs/254145 "2020-11-03T11:48:14Z")
I only need to display the Ips that are coming from a remote PFSENSE firewall on kibana but I couldn't do it, can anyone help me? input { beats { port =\> 5044 } } --- ## [More then one attached file in to index](https://discuss.elastic.co/t/more-then-one-attached-file-in-to-index/254133)
**Author:** [@lucrug](https://discuss.elastic.co/u/lucrug)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 11:28am UTC](https://discuss.elastic.co/t/more-then-one-attached-file-in-to-index/254133 "2020-11-03T11:28:38Z")
Hi gays, can i define more then one attached (RFT) field in a index? This example is for one: PUT \_ingest/pipeline/attachment { "description" : "Extract attachment information", "processors" : \[ { "attac… --- ## [Setup Filebeat with UDP input .. several questions](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522)
**Author:** [@dewell](https://discuss.elastic.co/u/dewell)\ **Replies:** 6\ **Last updated:** [November 3, 2020, 11:27am UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522 "2020-11-03T11:27:58Z")
Hi, I'm trying to grab a udp stream of double values (8 bytes) via udp input plugin of filebeat. The connection is between two servers in the same subnet, there shouldn't be any issue. I changed the filebeat.yml like t… --- ## [Mapping for dynamic JSON payload](https://discuss.elastic.co/t/mapping-for-dynamic-json-payload/254132)
**Author:** [@akihu](https://discuss.elastic.co/u/akihu)\ **Replies:** 4\ **Last updated:** [November 3, 2020, 11:22am UTC](https://discuss.elastic.co/t/mapping-for-dynamic-json-payload/254132 "2020-11-03T11:22:16Z")
Good day to everyone! I'm trying to send JSON formated data directly to elasticsearch by using elasticsearch python library but I'm having a fight here with the index mapping. How can one define dynamic mapping to JSON… --- ## [Logstash manticore worker error](https://discuss.elastic.co/t/logstash-manticore-worker-error/254137)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 10:46am UTC](https://discuss.elastic.co/t/logstash-manticore-worker-error/254137 "2020-11-03T10:46:11Z")
I have installed logstash and am trying to run the following configuration, input { file { path =\>"C:\\Test\\CSV\\dev.csv" start\_position =\>"beginning" } } filter { csv { columns =\>\["Plugin","… --- ## [Kibana alert on boolean field possible?](https://discuss.elastic.co/t/kibana-alert-on-boolean-field-possible/252715)
**Author:** [@Bastian\_Jager](https://discuss.elastic.co/u/Bastian_Jager)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 10:39am UTC](https://discuss.elastic.co/t/kibana-alert-on-boolean-field-possible/252715 "2020-11-03T10:39:06Z")
Hello, I would like to know if kibana alerts (https://www.elastic.co/guide/en/kibana/current/alert-types.html) can somehow handle boolean fields. I have an index pattern with a field "error\_signal" as boolean and would… --- ## [Creating dashboards for custom pattern from filebeat not working?](https://discuss.elastic.co/t/creating-dashboards-for-custom-pattern-from-filebeat-not-working/253615)
**Author:** [@Karel\_Cech](https://discuss.elastic.co/u/Karel_Cech)\ **Replies:** 5\ **Last updated:** [November 3, 2020, 10:07am UTC](https://discuss.elastic.co/t/creating-dashboards-for-custom-pattern-from-filebeat-not-working/253615 "2020-11-03T10:07:29Z")
Hi, I am unable to use a not-default index naming for filebeat. According to the documentation, I have these settings in my filebeat.yml: setup.template.name: "customname" setup.template.pattern: "customname-\*" setup.d… --- ## [Unable to start Elasticsearch 7.6.2](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-6-2/254128)
**Author:** [@Laamimech\_Salah](https://discuss.elastic.co/u/Laamimech_Salah)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 10:02am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-6-2/254128 "2020-11-03T10:02:45Z")
Hi, We are upgrading the ELK stack from v6.8.13 to v7.6.2 and we've encountered the following issue with OS Linux RHEL 7.1 : \[2020-11-02T15:44:00,757\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\]fatal error … --- ## [Find maximum and minimum time difference](https://discuss.elastic.co/t/find-maximum-and-minimum-time-difference/254126)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 9:51am UTC](https://discuss.elastic.co/t/find-maximum-and-minimum-time-difference/254126 "2020-11-03T09:51:59Z")
Hi All, Is there a way to find out the maximum and minimum time difference for 3rd column in the query below; whenever I am trying to order it by 3rd column I am getting below error Cannot order by non-grouped column Q… --- ## [Multi lingual support in kibana website](https://discuss.elastic.co/t/multi-lingual-support-in-kibana-website/254119)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 9:26am UTC](https://discuss.elastic.co/t/multi-lingual-support-in-kibana-website/254119 "2020-11-03T09:26:53Z")
How to specify all three languages en,zh-CN, ja-JP in locale apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: test-kibana namespace: staging spec: http: tls: selfSignedCertificate: disabled: tr… --- ## [.kibana Indices](https://discuss.elastic.co/t/kibana-indices/254120)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 9:21am UTC](https://discuss.elastic.co/t/kibana-indices/254120 "2020-11-03T09:21:26Z")
I want to change .kibana indices shards and replicas but nothing works PUT /\_template/custom\_kibana { "index\_patterns": ".kibana\*", "order": 1, "settings": { "number\_of\_shards": 3, "number\_of\_replicas": 1 … --- ## [Elasticsearch G1GC tuning](https://discuss.elastic.co/t/elasticsearch-g1gc-tuning/253964)
**Author:** [@James\_D](https://discuss.elastic.co/u/James_D)\ **Replies:** 5\ **Last updated:** [November 3, 2020, 8:20am UTC](https://discuss.elastic.co/t/elasticsearch-g1gc-tuning/253964 "2020-11-03T08:20:40Z")
We are trying to evaluate an Elasticsearch upgrade from 5.6 to 7.8 and are seeing some unexpected memory pressure on our test 7.8 cluster. Production Cluster: Elasticsearch 5.6 - 12 Nodes - 3 Hot 9 Warm - 64GB RAM, 31G… --- ## [Filebeat not sending logs to elastic from fortinet module](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-elastic-from-fortinet-module/254000)
**Author:** [@mn0o7](https://discuss.elastic.co/u/mn0o7)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 8:15am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-elastic-from-fortinet-module/254000 "2020-11-03T08:15:35Z")
Hi Everyone, I have enabled the fortinet/firewall module all looks great i see traffic being received at in the filebeat logs but never forwarded to elastic, can someone please point me in the right direction ? filebea… --- ## [Create month on month comparison bar chart over 2 year period - can't use scripted field in timelion](https://discuss.elastic.co/t/create-month-on-month-comparison-bar-chart-over-2-year-period-cant-use-scripted-field-in-timelion/254052)
**Author:** [@alibe](https://discuss.elastic.co/u/alibe)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 8:08am UTC](https://discuss.elastic.co/t/create-month-on-month-comparison-bar-chart-over-2-year-period-cant-use-scripted-field-in-timelion/254052 "2020-11-03T08:08:59Z")
I'm trying to build a visualisation to compare month v month over a 2 year period, incl some lucene to filter my results. I can add the lucene in timelion, but can't add a scripted field query to filter down my results.… --- ## [Multiple index routing allocation with require and include](https://discuss.elastic.co/t/multiple-index-routing-allocation-with-require-and-include/253995)
**Author:** [@nopma](https://discuss.elastic.co/u/nopma)\ **Replies:** 4\ **Last updated:** [November 3, 2020, 8:02am UTC](https://discuss.elastic.co/t/multiple-index-routing-allocation-with-require-and-include/253995 "2020-11-03T08:02:50Z")
I am trying to set up index routing with require and include but is not working. I have 3 nodes, and I want one shard to be on node-1 and the second shard to be on node-2 or 3. But when I try with this index template o… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1717) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1719)