# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1737 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1738 --- ## [How to plot speed derived from time and distance using aggregation](https://discuss.elastic.co/t/how-to-plot-speed-derived-from-time-and-distance-using-aggregation/252861)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 9:22am UTC](https://discuss.elastic.co/t/how-to-plot-speed-derived-from-time-and-distance-using-aggregation/252861 "2020-10-22T09:22:01Z")
Hi, I have an query that calculates average speed for different car makes based on the fields 'distance' and 'time' in travel documents in Elasticsearch: POST /test\_data/\_search { "size": 0, "aggs": { "speed\_per\_ma… --- ## [How to increase watcher search timeout?](https://discuss.elastic.co/t/how-to-increase-watcher-search-timeout/252764)
**Author:** [@hanase](https://discuss.elastic.co/u/hanase)\ **Replies:** 6\ **Last updated:** [October 22, 2020, 9:17am UTC](https://discuss.elastic.co/t/how-to-increase-watcher-search-timeout/252764 "2020-10-22T09:17:02Z")
Hi, I'v create advanced watcher the part of input is "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ "phplog-\*" \], "rest\_total\_… --- ## [Newbie question: how to reindex with field value change?](https://discuss.elastic.co/t/newbie-question-how-to-reindex-with-field-value-change/252655)
**Author:** [@Admak](https://discuss.elastic.co/u/Admak)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 8:10am UTC](https://discuss.elastic.co/t/newbie-question-how-to-reindex-with-field-value-change/252655 "2020-10-22T08:10:36Z")
Hi! First, sorry for the newb question, however 2h of googling proved i'm either unqualified or explicitly trying to do the task wrong way I'm trying to reindex with new mappings, however due to field data type change,… --- ## [Filebeat syslog unix socket input doesn't work for Nginx](https://discuss.elastic.co/t/filebeat-syslog-unix-socket-input-doesnt-work-for-nginx/252958)
**Author:** [@zoulja](https://discuss.elastic.co/u/zoulja)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 8:06am UTC](https://discuss.elastic.co/t/filebeat-syslog-unix-socket-input-doesnt-work-for-nginx/252958 "2020-10-22T08:06:08Z")
I'm trying to collect customized Nginx access logs via Filebeat using syslog unix socket type. Filebeat 7.9.2: - input\_type: syslog protocol.unix: path: "/var/log/nginx/nginx.sock" Nginx 1.15.2: access\_log sy… --- ## [Filebeat config using Docker labels as index and pipeline names](https://discuss.elastic.co/t/filebeat-config-using-docker-labels-as-index-and-pipeline-names/252959)
**Author:** [@jbws](https://discuss.elastic.co/u/jbws)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 8:08am UTC](https://discuss.elastic.co/t/filebeat-config-using-docker-labels-as-index-and-pipeline-names/252959 "2020-10-22T08:08:16Z")
I am trying to use docker labels as the index and pipeline names. What is wrong with this config? filebeat.config: modules: path: ${path.config}/modules.d/\*.yml reload.enabled: false filebeat.autodiscover: … --- ## [I Want to Audit Enabled for Kibana Dev Tools Console Queries](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 8:06am UTC](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839 "2020-10-22T08:06:07Z")
I want to keep a diary for Kibana Dev Tools Console queries. For this they told me to add xpack.audit.enabled: true line to elasticsearch.yml file and restart elasticsearch service, but when I add the line the elasticse… --- ## [Elastic doesn't create a new index](https://discuss.elastic.co/t/elastic-doesnt-create-a-new-index/252947)
**Author:** [@AlexOQ](https://discuss.elastic.co/u/AlexOQ)\ **Replies:** 5\ **Last updated:** [October 22, 2020, 8:03am UTC](https://discuss.elastic.co/t/elastic-doesnt-create-a-new-index/252947 "2020-10-22T08:03:36Z")
Hi, and thanks for any leads in advance. I am using the following output configuration: \ @type rewrite\_tag\_filter @label @LOGTYPE \ key … --- ## [Create new Filebeat](https://discuss.elastic.co/t/create-new-filebeat/246081)
**Author:** [@saffatechy](https://discuss.elastic.co/u/saffatechy)\ **Replies:** 34\ **Last updated:** [October 22, 2020, 8:01am UTC](https://discuss.elastic.co/t/create-new-filebeat/246081 "2020-10-22T08:01:22Z")
Hi Elastic community I'm trying to build a custom Filebeat module but to me the Doc is a little unspecific: https://www.elastic.co/guide/en/beats/devguide/current/filebeat-modules-devguide.html I've come as far as crea… --- ## [Debugging missing plugins after updating from 7.6.2 to 7.9.2](https://discuss.elastic.co/t/debugging-missing-plugins-after-updating-from-7-6-2-to-7-9-2/252355)
**Author:** [@tlacuache](https://discuss.elastic.co/u/tlacuache)\ **Replies:** 6\ **Last updated:** [October 22, 2020, 7:56am UTC](https://discuss.elastic.co/t/debugging-missing-plugins-after-updating-from-7-6-2-to-7-9-2/252355 "2020-10-22T07:56:15Z")
I'm working on updating a project from using Elastic OSS components at version 7.6.2 to version 7.9.2. For the most part everything has gone smoothly. However, I've gotten stuck on a few plugins that, although they insta… --- ## [Search value based on specific field as child field are dynamic](https://discuss.elastic.co/t/search-value-based-on-specific-field-as-child-field-are-dynamic/252957)
**Author:** [@ROHITHPR](https://discuss.elastic.co/u/ROHITHPR)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 7:54am UTC](https://discuss.elastic.co/t/search-value-based-on-specific-field-as-child-field-are-dynamic/252957 "2020-10-22T07:54:23Z")
The collection looks like this { "displayname":"unknown12" "hierarchy":{ "username":"Nothing on", … --- ## [\[Solved\] Using /\_xpack/sql endpoint with dates with curl](https://discuss.elastic.co/t/solved-using-xpack-sql-endpoint-with-dates-with-curl/252742)
**Author:** [@Tiago\_Cruz](https://discuss.elastic.co/u/Tiago_Cruz)\ **Replies:** 3\ **Last updated:** [October 22, 2020, 7:53am UTC](https://discuss.elastic.co/t/solved-using-xpack-sql-endpoint-with-dates-with-curl/252742 "2020-10-22T07:53:04Z")
Hello, This works good: $ curl -X POST "localhost:9200/\_xpack/sql?format=txt&pretty" -H 'Content-Type: application/json' -d' { "query": "SELECT count(\*) FROM whatsapp\_202010 WHERE clientInfo.customerId = 7503" } ' … --- ## [Expand terms in search query into boolean expression?](https://discuss.elastic.co/t/expand-terms-in-search-query-into-boolean-expression/252935)
**Author:** [@GavinM](https://discuss.elastic.co/u/GavinM)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 7:42am UTC](https://discuss.elastic.co/t/expand-terms-in-search-query-into-boolean-expression/252935 "2020-10-22T07:42:37Z")
Hi Does Elastic search have a capability of reading a text file containing pattern = replacement strings, and if any terms in the search query match pattern they are replaced with the boolean expression defined on the r… --- ## [Strange Filebeat alerts processing](https://discuss.elastic.co/t/strange-filebeat-alerts-processing/252345)
**Author:** [@MichaelA](https://discuss.elastic.co/u/MichaelA)\ **Replies:** 16\ **Last updated:** [October 22, 2020, 7:35am UTC](https://discuss.elastic.co/t/strange-filebeat-alerts-processing/252345 "2020-10-22T07:35:13Z")
Hi, dear community! We've faced the following problem in our Elastic stack: Filebeat sends the processed logs - about 100-150 Gb in average per day, but instead of straight line as it always be now we see such peaks (se… --- ## [Kibana Build failure](https://discuss.elastic.co/t/kibana-build-failure/252841)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 7:34am UTC](https://discuss.elastic.co/t/kibana-build-failure/252841 "2020-10-22T07:34:01Z")
Hello, I am trying to build Kibana from the code source and I am facing this errors ( I got these errors after I run git pull, before that I built it and I had no problem ) yarn kbn bootstrap : warning Error running i… --- ## [Handling array values while reading from elasticsearch in spark using elasticsearch-spark](https://discuss.elastic.co/t/handling-array-values-while-reading-from-elasticsearch-in-spark-using-elasticsearch-spark/252950)
**Author:** [@shubham1](https://discuss.elastic.co/u/shubham1)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 7:27am UTC](https://discuss.elastic.co/t/handling-array-values-while-reading-from-elasticsearch-in-spark-using-elasticsearch-spark/252950 "2020-10-22T07:27:17Z")
Hi, I am trying to read from elasticsearch in spark using es-hadoop library. I know while reading from es-hadoop, we need to pass option es.read.field.as.array.include as in code ApacheSpark.sqlContext.read.format("org.… --- ## [Decimal numbers visualizations](https://discuss.elastic.co/t/decimal-numbers-visualizations/252695)
**Author:** [@gusgus1993](https://discuss.elastic.co/u/gusgus1993)\ **Replies:** 8\ **Last updated:** [October 22, 2020, 6:45am UTC](https://discuss.elastic.co/t/decimal-numbers-visualizations/252695 "2020-10-22T06:45:24Z")
Hello! I'm trying to show a sum of decimal numbers at Kibana. I'm sending as a double variable to the index pattern. When I did the sum at kibana it appears like 0. My index parttern has this format: What may be … --- ## [Inode remaing same - reading old logs. on restart gets new inode on sincedb and get new data](https://discuss.elastic.co/t/inode-remaing-same-reading-old-logs-on-restart-gets-new-inode-on-sincedb-and-get-new-data/252942)
**Author:** [@chandramouli\_sriniva](https://discuss.elastic.co/u/chandramouli_sriniva)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 6:38am UTC](https://discuss.elastic.co/t/inode-remaing-same-reading-old-logs-on-restart-gets-new-inode-on-sincedb-and-get-new-data/252942 "2020-10-22T06:38:59Z")
Hi, on log rotation, inode doesnt change and it doesnt put any new entry in sincedb file. If I stop and start logstash, then new entry with new inode gets created for current file(xx.log) and new data is being sent. S… --- ## [Configure ELK stack with Jira server to monitor server logs](https://discuss.elastic.co/t/configure-elk-stack-with-jira-server-to-monitor-server-logs/252938)
**Author:** [@prerak.diwan](https://discuss.elastic.co/u/prerak.diwan)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 6:24am UTC](https://discuss.elastic.co/t/configure-elk-stack-with-jira-server-to-monitor-server-logs/252938 "2020-10-22T06:24:04Z")
Hi all, I am new to the ELK stack and want to try the ELK solution to monitor Atlassian Jira logs. So far I have been able to setup the ELK stack on my local system and start both the Kibana and Elasticsearch servers. … --- ## [Kibana After set basePath cannot display UI](https://discuss.elastic.co/t/kibana-after-set-basepath-cannot-display-ui/248960)
**Author:** [@Mohammad\_Iqbal](https://discuss.elastic.co/u/Mohammad_Iqbal)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 3:57am UTC](https://discuss.elastic.co/t/kibana-after-set-basepath-cannot-display-ui/248960 "2020-10-22T03:57:07Z")
Hi Sorry for my broken english. I still struggling with my kibana.yaml, i want to deploy it to k8s cluster this my kibana.yaml apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: kibana namespace: e… --- ## [Http tls on elastic nodes?](https://discuss.elastic.co/t/http-tls-on-elastic-nodes/252922)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 3:40am UTC](https://discuss.elastic.co/t/http-tls-on-elastic-nodes/252922 "2020-10-22T03:40:14Z")
Hi all In my cluster it said that i need to configure tls for connection between elastic and kibana But i have some question, i have 2 nodes for coordination, the kibana will connect to those 2 node only, so do i have … --- ## [Filebeat manage multiple write indices](https://discuss.elastic.co/t/filebeat-manage-multiple-write-indices/252760)
**Author:** [@keshara](https://discuss.elastic.co/u/keshara)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 2:24am UTC](https://discuss.elastic.co/t/filebeat-manage-multiple-write-indices/252760 "2020-10-22T02:24:44Z")
According to the link =\> https://www.elastic.co/guide/en/beats/filebeat/6.8/ilm.html#\_advanced\_ilm\_settings I am trying to create multiple indices from filebeat output to elasticsearch. Here is my filebeat.yml. - … --- ## [Using a higher version EUI in plugin](https://discuss.elastic.co/t/using-a-higher-version-eui-in-plugin/252800)
**Author:** [@Wang\_Hay\_Ng](https://discuss.elastic.co/u/Wang_Hay_Ng)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 1:39am UTC](https://discuss.elastic.co/t/using-a-higher-version-eui-in-plugin/252800 "2020-10-22T01:39:07Z")
i am making a plugin for 7.5.2, but i would like to use a newer feature from EUI v22+, i tried to yarn add it into the plugin's node module, not only did it not work, kibana will exit by heap out of memory when building … --- ## [Can logstash be limited by subdirectories?](https://discuss.elastic.co/t/can-logstash-be-limited-by-subdirectories/252917)
**Author:** [@GetYourSh1tTogether](https://discuss.elastic.co/u/GetYourSh1tTogether)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 1:06am UTC](https://discuss.elastic.co/t/can-logstash-be-limited-by-subdirectories/252917 "2020-10-22T01:06:36Z")
I have a list of subdirectories that are consistent in each directory. Is it possible to limit logstash to only look for those subdirectories and pull data from those? Would something like this work? filter { if \[type… --- ## [Aggregate sum child documents' cumulative data while keeping some of parent's source fields](https://discuss.elastic.co/t/aggregate-sum-child-documents-cumulative-data-while-keeping-some-of-parents-source-fields/252907)
**Author:** [@rfferrao](https://discuss.elastic.co/u/rfferrao)\ **Replies:** 0\ **Last updated:** [October 21, 2020, 10:28pm UTC](https://discuss.elastic.co/t/aggregate-sum-child-documents-cumulative-data-while-keeping-some-of-parents-source-fields/252907 "2020-10-21T22:28:27Z")
I'd like to know if it's possible to do this. Let's say I have the following mapping for a testindex: { "properties": { "datetime": { "type": "date" }, "datetime\_range": { "type": "date\_range" }, "devna… --- ## [How to call an alert in another?](https://discuss.elastic.co/t/how-to-call-an-alert-in-another/252910)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 21, 2020, 10:52pm UTC](https://discuss.elastic.co/t/how-to-call-an-alert-in-another/252910 "2020-10-21T22:52:23Z")
How can I do to call a watch in another, so I had it in my code but it does not serve me need to call an alert to this, to make a condition that if you run that make an action in this. I am confused about this because th… --- ## [State execution watcher condition](https://discuss.elastic.co/t/state-execution-watcher-condition/252909)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 21, 2020, 10:46pm UTC](https://discuss.elastic.co/t/state-execution-watcher-condition/252909 "2020-10-21T22:46:55Z")
How to make a condition that is met if the state of execution of a watch is executed, to send me an email, but only if the condition is met. { "trigger": { "schedule": { "interval": "24h" } }, "input… --- ## [Multiple dissect in logstash](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898)
**Author:** [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)\ **Replies:** 4\ **Last updated:** [October 21, 2020, 10:36pm UTC](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898 "2020-10-21T22:36:39Z")
Hi, I would like somehow to have multiple dissect or grok one for Errorlog : dissect { mapping =\> { "message" =\> "\[%logdate}\] %{exception}.%{CHttpException}.%{logtype}.%{loglevel}: %{errormessage}" } } and second one… --- ## [Help a non-profit STIR the data](https://discuss.elastic.co/t/help-a-non-profit-stir-the-data/251589)
**Author:** [@martinsz](https://discuss.elastic.co/u/martinsz)\ **Replies:** 7\ **Last updated:** [October 21, 2020, 9:47pm UTC](https://discuss.elastic.co/t/help-a-non-profit-stir-the-data/251589 "2020-10-21T21:47:18Z")
Hi, we're a Mexican NGO working all across latin-america to stop corporate abuse, you can check out our bilingual website here: https://poderlatam.org Our most intensive data project is about public contracts, it has ev… --- ## [Min\_doc\_count for data table filter aggregation](https://discuss.elastic.co/t/min-doc-count-for-data-table-filter-aggregation/252902)
**Author:** [@Eric\_Scaramuzzo](https://discuss.elastic.co/u/Eric_Scaramuzzo)\ **Replies:** 0\ **Last updated:** [October 21, 2020, 9:37pm UTC](https://discuss.elastic.co/t/min-doc-count-for-data-table-filter-aggregation/252902 "2020-10-21T21:37:51Z")
Hello! I am creating a data table with a unique count metric and a filter aggregation, and I want to not show rows that have a doc\_count of 0. I tried using min\_doc\_count in the json input, but that just threw an error: E… --- ## [Kibana Error loading data](https://discuss.elastic.co/t/kibana-error-loading-data/249179)
**Author:** [@Eric\_Scaramuzzo](https://discuss.elastic.co/u/Eric_Scaramuzzo)\ **Replies:** 2\ **Last updated:** [October 21, 2020, 9:27pm UTC](https://discuss.elastic.co/t/kibana-error-loading-data/249179 "2020-10-21T21:27:16Z")
Getting "Error loading data": error on kibana: Replaced my elasticsearch domain with \ Error at Fetch.\_callee3$ (https://\.us-west-1.es.amazonaws.com/\_plugin/kibana/bundles/commons.bundle.js:1:142… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1736) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1738)