# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1746 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1747 --- ## [Trigger schedule without time intervals](https://discuss.elastic.co/t/trigger-schedule-without-time-intervals/252267)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 1:58pm UTC](https://discuss.elastic.co/t/trigger-schedule-without-time-intervals/252267 "2020-10-16T13:58:42Z")
hello, how can I make the trigger schedule run once and not have any time interval but only run once and already. { "trigger": { "schedule": { "interval": "1h" } }, "input": { "search": { "… --- ## [Watcher execution error](https://discuss.elastic.co/t/watcher-execution-error/252105)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 9:17pm UTC](https://discuss.elastic.co/t/watcher-execution-error/252105 "2020-10-14T21:17:07Z")
Good day I have a problem running a watcher, I get an execution error. { "watch\_id": "\_inlined\_", "node": "ELuSGxpSRICZb2ZHJp4paA", "state": "failed", "user": "elastic", "status": { "state": { "activ… --- ## [Watcher execution error](https://discuss.elastic.co/t/watcher-execution-error/252104)
**Author:** [@victor.vera](https://discuss.elastic.co/u/victor.vera)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 1:56pm UTC](https://discuss.elastic.co/t/watcher-execution-error/252104 "2020-10-16T13:56:12Z")
Good day I have a problem running a watcher, I get an execution error. { "watch\_id": "\_inlined\_", "node": "ELuSGxpSRICZb2ZHJp4paA", "state": "failed", "user": "elastic", "status": { "state": { "activ… --- ## [Watcher's condition](https://discuss.elastic.co/t/watchers-condition/252268)
**Author:** [@victor.vera](https://discuss.elastic.co/u/victor.vera)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 8:30pm UTC](https://discuss.elastic.co/t/watchers-condition/252268 "2020-10-15T20:30:35Z")
Hi, I need help in a watcher's condition: I don't know if a for or a while is useful: I need the following: I have a variable "summary.down" with two values 0 and 1, so I need it to be executed infinitely and when it ch… --- ## [Prefix query insensitive case : normalizer or analyzer ? (nest inside)](https://discuss.elastic.co/t/prefix-query-insensitive-case-normalizer-or-analyzer-nest-inside/252255)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 1:53pm UTC](https://discuss.elastic.co/t/prefix-query-insensitive-case-normalizer-or-analyzer-nest-inside/252255 "2020-10-16T13:53:43Z")
Hi, I get hard time to figure out which kind of settings should I use, my needs are basics, I got a text field (literally a phrase) that I should be able to query using a prefix ("start with") in an insensitive way. i… --- ## [Timestamp does not take the time zone](https://discuss.elastic.co/t/timestamp-does-not-take-the-time-zone/252082)
**Author:** [@victor.vera](https://discuss.elastic.co/u/victor.vera)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 1:49pm UTC](https://discuss.elastic.co/t/timestamp-does-not-take-the-time-zone/252082 "2020-10-16T13:49:16Z")
I have a problem with the time stamp, I have the correct date, but the time is wrong, I have like 5 hours in advance, the date is correct but I do not know why I have another time of execution, I put the time zone but it… --- ## [I wanted to get some recommendations on tiered storage for Elasticsearch, I'm growing an on-premise instance and I'm looking at different options](https://discuss.elastic.co/t/i-wanted-to-get-some-recommendations-on-tiered-storage-for-elasticsearch-im-growing-an-on-premise-instance-and-im-looking-at-different-options/252357)
**Author:** [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 1:47pm UTC](https://discuss.elastic.co/t/i-wanted-to-get-some-recommendations-on-tiered-storage-for-elasticsearch-im-growing-an-on-premise-instance-and-im-looking-at-different-options/252357 "2020-10-16T13:47:59Z")
I wanted to get some recommendations on tiered storage for elasitcsearch, Im growing an on-premise instance and Im looking at different options. --- ## [Trigger watcher alert (email) for every log occurrence](https://discuss.elastic.co/t/trigger-watcher-alert-email-for-every-log-occurrence/252013)
**Author:** [@Natesh\_Todur](https://discuss.elastic.co/u/Natesh_Todur)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 1:46pm UTC](https://discuss.elastic.co/t/trigger-watcher-alert-email-for-every-log-occurrence/252013 "2020-10-16T13:46:11Z")
Hi, Can I receive watcher alert for every log occurrence ? I have a current configuration wherein the watcher is scheduled every 2 minutes and all occurrences within that interval are clubbed to send a single email ale… --- ## [How put 2 scripts in a watcher](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252351)
**Author:** [@victor.vera](https://discuss.elastic.co/u/victor.vera)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252351 "2020-10-16T13:29:56Z")
hello how can i put 2 scripts in an alert? i have one that is from "ctx.payload.time\_triggered" and the other is for "metric.agg". i need help with this... { "trigger": { "schedule": { "interval": "1h" }… --- ## [MongoDB elasticsearch using logstash error](https://discuss.elastic.co/t/mongodb-elasticsearch-using-logstash-error/252347)
**Author:** [@Manuang](https://discuss.elastic.co/u/Manuang)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 1:05pm UTC](https://discuss.elastic.co/t/mongodb-elasticsearch-using-logstash-error/252347 "2020-10-16T13:05:28Z")
I am trying to connect mongodb to elastic search. I am using Mongodb compass and in that the database is MongoPOC and collection is Json\_file. My config file is as below: MongoDB 4.2.10 Enterprise Cluster Standalone i… --- ## [Heartbeat activemq monitor without error in activemq.log](https://discuss.elastic.co/t/heartbeat-activemq-monitor-without-error-in-activemq-log/249351)
**Author:** [@rino](https://discuss.elastic.co/u/rino)\ **Replies:** 4\ **Last updated:** [October 16, 2020, 1:03pm UTC](https://discuss.elastic.co/t/heartbeat-activemq-monitor-without-error-in-activemq-log/249351 "2020-10-16T13:03:08Z")
Hi, We're monitoring the uptime of our activemq servers (specificly the openwire port our queue is using). The problem is, with the below tcp monitor, it leaves behind some ugly logging in the activemq log. i wonder if … --- ## [Logstas-output-mongodb DB creation](https://discuss.elastic.co/t/logstas-output-mongodb-db-creation/252305)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 6:36am UTC](https://discuss.elastic.co/t/logstas-output-mongodb-db-creation/252305 "2020-10-16T06:36:14Z")
Hi Team, I am trying to have logstash output for MongoDB and I am unsure whether if i can customize the Mongo DB name based upon the input logstash receives. To be be more precise, I am unaware of the logstash capabili… --- ## [Best way to tag a large amount of documents](https://discuss.elastic.co/t/best-way-to-tag-a-large-amount-of-documents/252211)
**Author:** [@LurenzZ](https://discuss.elastic.co/u/LurenzZ)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 12:36pm UTC](https://discuss.elastic.co/t/best-way-to-tag-a-large-amount-of-documents/252211 "2020-10-16T12:36:24Z")
Hi all, This is my first question topic :slight\_smile: Me and my colleagues are trying to figure out the best way to manage tags on a bunch of documents. Our scenario is, many several devices that send data to elastic… --- ## [3-nodes License, Adding Unlicensed Nodes to the Cluster](https://discuss.elastic.co/t/3-nodes-license-adding-unlicensed-nodes-to-the-cluster/252122)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 12:34pm UTC](https://discuss.elastic.co/t/3-nodes-license-adding-unlicensed-nodes-to-the-cluster/252122 "2020-10-16T12:34:38Z")
Hello, I want to purchase a 3-nodes license. What will happen if I add unlicensed data nodes to the cluster? Will commercial features be enabled for some nodes or indices, but not for others? --- ## [Simple card to display a string-](https://discuss.elastic.co/t/simple-card-to-display-a-string/252284)
**Author:** [@elaair](https://discuss.elastic.co/u/elaair)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 12:22pm UTC](https://discuss.elastic.co/t/simple-card-to-display-a-string/252284 "2020-10-16T12:22:46Z")
I would like to add a card to my dashboard that displays the state of charge of my batteries. It is just a word like Resting or Float MPPT. I don't need time or math acted on it. Whats the best way to do this? --- ## [Filebeat 6.5.4 is truncating some records - multibyte character issue?](https://discuss.elastic.co/t/filebeat-6-5-4-is-truncating-some-records-multibyte-character-issue/252343)
**Author:** [@Tim\_Baverstock](https://discuss.elastic.co/u/Tim_Baverstock)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 11:52am UTC](https://discuss.elastic.co/t/filebeat-6-5-4-is-truncating-some-records-multibyte-character-issue/252343 "2020-10-16T11:52:56Z")
On each host, a few Docker 18.09.6 containers use a shared volume to create low-load logfiles (a few entries a minute each). Each test-run takes under an hour, and each test run starts a new logfile. We delete files olde… --- ## [Importing json file using logstash stuck with Successfully started Logstash API endpoint {:port=\>9600}](https://discuss.elastic.co/t/importing-json-file-using-logstash-stuck-with-successfully-started-logstash-api-endpoint-port-9600/252342)
**Author:** [@Manuang](https://discuss.elastic.co/u/Manuang)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 11:50am UTC](https://discuss.elastic.co/t/importing-json-file-using-logstash-stuck-with-successfully-started-logstash-api-endpoint-port-9600/252342 "2020-10-16T11:50:21Z")
{"request\_id":1,"requestDetail\_id":0,"enrichedContent":"enrich cont example","statusCode":"P","reasonDesc":"This is a test","createdBy":"Sarah","createdDate":"Sep 24, 2010"} Json data Conf file is input { file{ pa… --- ## [What Grok pattern will be?](https://discuss.elastic.co/t/what-grok-pattern-will-be/252340)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 11:40am UTC](https://discuss.elastic.co/t/what-grok-pattern-will-be/252340 "2020-10-16T11:40:15Z")
what should grok pattern will be of this log? log sample 2020-10-16 16:53:17.4009 \[57244\] ERROR Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware 192.168.43.244 bvarsur@gmail.com http://localhost/Tran… --- ## [\[script\_exception\] runtime error in Discover](https://discuss.elastic.co/t/script-exception-runtime-error-in-discover/252218)
**Author:** [@mats.ahlbom](https://discuss.elastic.co/u/mats.ahlbom)\ **Replies:** 5\ **Last updated:** [October 16, 2020, 11:22am UTC](https://discuss.elastic.co/t/script-exception-runtime-error-in-discover/252218 "2020-10-16T11:22:59Z")
Hi, I can add scripted field selfReview; if ( doc\['type.keyword'\].value == "comment-added" && doc\['comment.keyword'\].value.contains("Code-Review+2") && doc\['change.owner.name.keyword'\].value == doc\['author.na… --- ## [Kibana UI session timeout issue](https://discuss.elastic.co/t/kibana-ui-session-timeout-issue/252147)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 11:22am UTC](https://discuss.elastic.co/t/kibana-ui-session-timeout-issue/252147 "2020-10-16T11:22:52Z")
Hi.., I am using ECK, for my kibana instance I am frequently getting session timeout issue, and also the search becomes really slow..., I am using kibana - 7.9.2 I am attaching the screenshot for reference could s… --- ## [Looking for examples of the native minhash being used for near duplicate detection](https://discuss.elastic.co/t/looking-for-examples-of-the-native-minhash-being-used-for-near-duplicate-detection/252336)
**Author:** [@Ola\_Gustafsson1](https://discuss.elastic.co/u/Ola_Gustafsson1)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 11:20am UTC](https://discuss.elastic.co/t/looking-for-examples-of-the-native-minhash-being-used-for-near-duplicate-detection/252336 "2020-10-16T11:20:02Z")
Following the documentation examples, I have mapped a text field for minhashing of shingles. Using it in a more-like-this query does work, but, as the documentation says, I'd like to use it for Jaccard similarity and ret… --- ## [Network interfaces statistics @ nodes/logstash/kibana](https://discuss.elastic.co/t/network-interfaces-statistics-nodes-logstash-kibana/252191)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 10:03am UTC](https://discuss.elastic.co/t/network-interfaces-statistics-nodes-logstash-kibana/252191 "2020-10-16T10:03:09Z")
How to stat network interfaces on nodes. We'd like to present network utilization (bitrate) per interface. I'm thinking about metricbeat, which we use actually but there are collection only from the system network. We'd … --- ## [Kibana Timeserie data on select timerange](https://discuss.elastic.co/t/kibana-timeserie-data-on-select-timerange/252047)
**Author:** [@Nibeckj](https://discuss.elastic.co/u/Nibeckj)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 9:59am UTC](https://discuss.elastic.co/t/kibana-timeserie-data-on-select-timerange/252047 "2020-10-16T09:59:52Z")
Hello, I have some index with data. @timestamp is unix timestamp. how do for have a timseries grafic with data only between 08h-20h every day ? --- ## [Aggregation not working in Logstash input elasticsearch filter](https://discuss.elastic.co/t/aggregation-not-working-in-logstash-input-elasticsearch-filter/252298)
**Author:** [@Vijay\_Barai](https://discuss.elastic.co/u/Vijay_Barai)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 5:07am UTC](https://discuss.elastic.co/t/aggregation-not-working-in-logstash-input-elasticsearch-filter/252298 "2020-10-16T05:07:57Z")
Hi Team, I am trying to do a aggregation using ES query. Query is giving a result in develper tool but when I use it in logstash config file I am not getting a actual result. I am getting only few selected field, at lea… --- ## [How to create machine learning job which compare specific times of continous days](https://discuss.elastic.co/t/how-to-create-machine-learning-job-which-compare-specific-times-of-continous-days/251979)
**Author:** [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 8:42am UTC](https://discuss.elastic.co/t/how-to-create-machine-learning-job-which-compare-specific-times-of-continous-days/251979 "2020-10-16T08:42:50Z")
I want to create job which watch the number of record exception in series of specific time of days. It means the job will compare the number exception in 6pm of each day .My team usually upcode in 2 or 3am, so by compari… --- ## [Not able to view data in Discover after my local system restart](https://discuss.elastic.co/t/not-able-to-view-data-in-discover-after-my-local-system-restart/251865)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 9:12am UTC](https://discuss.elastic.co/t/not-able-to-view-data-in-discover-after-my-local-system-restart/251865 "2020-10-16T09:12:11Z")
Hi All, I am new to ELK and facing a weird issue, whenever I restart my system. I am not able to view data in Discover. Is there a way to prevent that. ELK is at some remote host, I am not able to understand how restar… --- ## [\[Filebeat\] Huge mapping (nearly 5k fields) when ingesting logs](https://discuss.elastic.co/t/filebeat-huge-mapping-nearly-5k-fields-when-ingesting-logs/252185)
**Author:** [@M-O](https://discuss.elastic.co/u/M-O)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 9:08am UTC](https://discuss.elastic.co/t/filebeat-huge-mapping-nearly-5k-fields-when-ingesting-logs/252185 "2020-10-16T09:08:34Z")
Hello, i am currently experimenting with filebeat and noticed that, when filebeat creates the standard indicies, it comes with a huge count of field mappings. To me it looks like the index-template specifies every … --- ## [Index Lifecycle Management rolleover not happening properly](https://discuss.elastic.co/t/index-lifecycle-management-rolleover-not-happening-properly/251771)
**Author:** [@amiya-santra](https://discuss.elastic.co/u/amiya-santra)\ **Replies:** 17\ **Last updated:** [October 16, 2020, 9:00am UTC](https://discuss.elastic.co/t/index-lifecycle-management-rolleover-not-happening-properly/251771 "2020-10-16T09:00:38Z")
I have manually configured ILM. After creating policies and telling my indices to use them, they all complain with errors like this: issue: rollover index have 0 doc PUT \_ilm/policy/new\_policy { "policy": { "pha… --- ## [Delete by Query and Refresh Interval](https://discuss.elastic.co/t/delete-by-query-and-refresh-interval/251633)
**Author:** [@gavinlee](https://discuss.elastic.co/u/gavinlee)\ **Replies:** 6\ **Last updated:** [October 16, 2020, 8:54am UTC](https://discuss.elastic.co/t/delete-by-query-and-refresh-interval/251633 "2020-10-16T08:54:44Z")
Hi, I have a situation where I take the following steps retrieve lock delete by query refresh insert documents release lock These steps could happen in quick succession. The delete by query is supposed to find all the… --- ## [Grok filter multiple match](https://discuss.elastic.co/t/grok-filter-multiple-match/252016)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 8:32am UTC](https://discuss.elastic.co/t/grok-filter-multiple-match/252016 "2020-10-16T08:32:40Z")
Hi I have these lines in my log how do i make an array of rootcause using grok? Something like this rootcause=\> { text1, text2 } TIA. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1745) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1747)