# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1752 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1753 --- ## [Detector field is not an aggregatable field](https://discuss.elastic.co/t/detector-field-is-not-an-aggregatable-field/252007)
**Author:** [@Ameeruddin\_Mohammed](https://discuss.elastic.co/u/Ameeruddin_Mohammed)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 8:25am UTC](https://discuss.elastic.co/t/detector-field-is-not-an-aggregatable-field/252007 "2020-10-14T08:25:06Z")
hi, i get an error while creating an ml job. the field is "MONITORLOGGER" and in the template and in the index its mapped as keyword. "MONITORLOGGER": { "type": "keyword" } please support. --- ## [EOF in Logstash File Input](https://discuss.elastic.co/t/eof-in-logstash-file-input/251126)
**Author:** [@sfischer](https://discuss.elastic.co/u/sfischer)\ **Replies:** 4\ **Last updated:** [October 14, 2020, 8:12am UTC](https://discuss.elastic.co/t/eof-in-logstash-file-input/251126 "2020-10-14T08:12:09Z")
Hello, I am using Logstash to aggregate some data out of a log file and store it in elastic search, to get some usage data for a software. We copy the log files into a directory that logstash checks. We use the file in… --- ## [Converting kibana snapshot chart to chartJs options](https://discuss.elastic.co/t/converting-kibana-snapshot-chart-to-chartjs-options/251877)
**Author:** [@arjun\_atlast](https://discuss.elastic.co/u/arjun_atlast)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 8:07am UTC](https://discuss.elastic.co/t/converting-kibana-snapshot-chart-to-chartjs-options/251877 "2020-10-14T08:07:38Z")
Is there any way to convert a visualization snapshot to chartJs data or any format that I can use to create a static chart for presentation? --- ## [What's the best way to implement 'contains' search queries in combination with MultiMatch?](https://discuss.elastic.co/t/whats-the-best-way-to-implement-contains-search-queries-in-combination-with-multimatch/251909)
**Author:** [@DanglingNode](https://discuss.elastic.co/u/DanglingNode)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 7:59am UTC](https://discuss.elastic.co/t/whats-the-best-way-to-implement-contains-search-queries-in-combination-with-multimatch/251909 "2020-10-14T07:59:55Z")
Hi, I have documents with most fields indexed as 'Keywords'. I currently want to perform a global search, over all indexed fields, which I've implemented as such: var result = await client.SearchAsync\(s =\>… --- ## [Watcher, Alert all result of the payload, not only the first](https://discuss.elastic.co/t/watcher-alert-all-result-of-the-payload-not-only-the-first/249831)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 7:41am UTC](https://discuss.elastic.co/t/watcher-alert-all-result-of-the-payload-not-only-the-first/249831 "2020-10-14T07:41:15Z")
Im am quering a incident index..this index may contain documents separated by miliseconds, this is the query I have: "query": { "bool": { "must": \[ { … --- ## [Watcher, difference between setting the time range using contex and without using context](https://discuss.elastic.co/t/watcher-difference-between-setting-the-time-range-using-contex-and-without-using-context/251965)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 7:39am UTC](https://discuss.elastic.co/t/watcher-difference-between-setting-the-time-range-using-contex-and-without-using-context/251965 "2020-10-14T07:39:52Z")
Hi, What is the difference in setting an alert with watcher using context , like this: "range": { "@timestamp": { "gte": "{{ctx.trigger.scheduled\_time}}||-30m", … --- ## [Performance of a wildcard index search for \_id](https://discuss.elastic.co/t/performance-of-a-wildcard-index-search-for-id/249931)
**Author:** [@Munawwar1](https://discuss.elastic.co/u/Munawwar1)\ **Replies:** 8\ **Last updated:** [October 14, 2020, 7:33am UTC](https://discuss.elastic.co/t/performance-of-a-wildcard-index-search-for-id/249931 "2020-10-14T07:33:49Z")
Hi all. I am doing a term query search for \_id field (which happens to be a uuid in my case) across all indexes via a wildcard index name search. e.g. GET http://elasticsearch.endpoint/prod-\*/\_search { "query": { … --- ## [Elasticsearch version upgrade from 6.6. to 6.8](https://discuss.elastic.co/t/elasticsearch-version-upgrade-from-6-6-to-6-8/251055)
**Author:** [@tisandg](https://discuss.elastic.co/u/tisandg)\ **Replies:** 9\ **Last updated:** [October 14, 2020, 7:30am UTC](https://discuss.elastic.co/t/elasticsearch-version-upgrade-from-6-6-to-6-8/251055 "2020-10-14T07:30:47Z")
Hello. I have a server centOS 7 which have Elasticsearch 6.6 and I was trying to upgrade the version to it from 6.6 to 6.8. I followed each step of the guide and all the steps works well. However when I start again the … --- ## [How to use greater than operator in Json Input in Kibana visualisation to get the data which is greater than a value](https://discuss.elastic.co/t/how-to-use-greater-than-operator-in-json-input-in-kibana-visualisation-to-get-the-data-which-is-greater-than-a-value/251928)
**Author:** [@Dubru](https://discuss.elastic.co/u/Dubru)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 7:26am UTC](https://discuss.elastic.co/t/how-to-use-greater-than-operator-in-json-input-in-kibana-visualisation-to-get-the-data-which-is-greater-than-a-value/251928 "2020-10-14T07:26:18Z")
My actual requirement is I would like to display the data in kibana visualisation only if the response.time is greater than 10 seconds I've the field response.time and I am using this field to get the average response t… --- ## [Unable to pull aws cloud data using S3 plugin/ Error : something is wrong with your configuration](https://discuss.elastic.co/t/unable-to-pull-aws-cloud-data-using-s3-plugin-error-something-is-wrong-with-your-configuration/251889)
**Author:** [@sainath](https://discuss.elastic.co/u/sainath)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 7:18am UTC](https://discuss.elastic.co/t/unable-to-pull-aws-cloud-data-using-s3-plugin-error-something-is-wrong-with-your-configuration/251889 "2020-10-14T07:18:18Z")
Hi , we are trying to pull S3 bucket data from AWS cloud and below is the configuration. input { s3 { "access\_key\_id" =\> "AXXXXX" "secret\_access\_key" =\> "XXXX" "region" =\> "us-east-2" "bucket" =\> "XXX… --- ## [Large numbers in kibana as keyword not searchable](https://discuss.elastic.co/t/large-numbers-in-kibana-as-keyword-not-searchable/251996)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 6:51am UTC](https://discuss.elastic.co/t/large-numbers-in-kibana-as-keyword-not-searchable/251996 "2020-10-14T06:51:14Z")
I have problem to search the value in Kibana for field I Created mapping keyword and inserted number inside (see example below) "B\_ASSOCIAID": { "type" : "keyword"} "B\_ASSOCIAID" : 5947737601889008123, in this case Ki… --- ## [How to turn off automatic deletion upon expiration of data / index?](https://discuss.elastic.co/t/how-to-turn-off-automatic-deletion-upon-expiration-of-data-index/251736)
**Author:** [@dwlande](https://discuss.elastic.co/u/dwlande)\ **Replies:** 16\ **Last updated:** [October 14, 2020, 6:42am UTC](https://discuss.elastic.co/t/how-to-turn-off-automatic-deletion-upon-expiration-of-data-index/251736 "2020-10-14T06:42:46Z")
How to turn off automatic deletion upon expiration of data / index? --- ## [\_grokparsefailure and I have no idea](https://discuss.elastic.co/t/grokparsefailure-and-i-have-no-idea/251984)
**Author:** [@EunBae\_Park](https://discuss.elastic.co/u/EunBae_Park)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 6:37am UTC](https://discuss.elastic.co/t/grokparsefailure-and-i-have-no-idea/251984 "2020-10-14T06:37:10Z")
Hi, I'd tried to parse NGINX Access log whose log format is '$http\_x\_forwarded\_for - $http\_referer - \[$time\_local\] "$request" $status $body\_bytes\_sent'. The logs are like below: - - - - \[08/Oct/2020:11:05:50 +0900\] "… --- ## [Filebeat multiline configuration consolidate all logs line to one event](https://discuss.elastic.co/t/filebeat-multiline-configuration-consolidate-all-logs-line-to-one-event/251993)
**Author:** [@HadarPeeran](https://discuss.elastic.co/u/HadarPeeran)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 6:07am UTC](https://discuss.elastic.co/t/filebeat-multiline-configuration-consolidate-all-logs-line-to-one-event/251993 "2020-10-14T06:07:05Z")
I have the following setting: Filebeat =\> Logstash In order to support java stack trace I added multiline configuration in filebeat.yml multiline.pattern: '^\\\[\[0-9\]{2}-\[0-9\]{2}-\[0-9\]{2}' multiline.negate: true mu… --- ## [Can't Get Logs From Multiple Machines](https://discuss.elastic.co/t/cant-get-logs-from-multiple-machines/251991)
**Author:** [@Redwanuzzaman](https://discuss.elastic.co/u/Redwanuzzaman)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 4:50am UTC](https://discuss.elastic.co/t/cant-get-logs-from-multiple-machines/251991 "2020-10-14T04:50:21Z")
Hello There, I am trying to get logs from different machines. I installed filebeat on the client machine and make this configuration. - type: log enabled: true paths: - /path/where/log/stores/in/client/machine … --- ## [Elasticsearch-sql can't query unindexed field](https://discuss.elastic.co/t/elasticsearch-sql-cant-query-unindexed-field/251635)
**Author:** [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\ **Replies:** 26\ **Last updated:** [October 14, 2020, 2:52am UTC](https://discuss.elastic.co/t/elasticsearch-sql-cant-query-unindexed-field/251635 "2020-10-14T02:52:03Z")
As we know , unindexed field will store in \_source field,so we can get those unindexed fields in \_source.But Elasticsearch-sql can't get unindexed field. GET /\_sql/translate { "query":""" select \* from "view-laohu-s… --- ## [Aggregation 504 bad gateway](https://discuss.elastic.co/t/aggregation-504-bad-gateway/251740)
**Author:** [@Liyes](https://discuss.elastic.co/u/Liyes)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 2:13am UTC](https://discuss.elastic.co/t/aggregation-504-bad-gateway/251740 "2020-10-14T02:13:44Z")
When I use script to do aggregation and want to find two documents with the same fields in es, 504 bad gateway. Maybe it is caused by too much data. Is there any solution? I used partition. { "size": 0, "aggs": { … --- ## [Logstash Configuration for Writing to a File (that may grow in GBs)](https://discuss.elastic.co/t/logstash-configuration-for-writing-to-a-file-that-may-grow-in-gbs/251976)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 1:07am UTC](https://discuss.elastic.co/t/logstash-configuration-for-writing-to-a-file-that-may-grow-in-gbs/251976 "2020-10-14T01:07:41Z")
I have a requirement where in my logstash I have to write to Elasticsearch and as well write to a file. However the issue is, the file will be created on daily basis, and it is calculated that the file will grow in GBs. … --- ## [Get all queries executed on Elastic search](https://discuss.elastic.co/t/get-all-queries-executed-on-elastic-search/251918)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 12:32am UTC](https://discuss.elastic.co/t/get-all-queries-executed-on-elastic-search/251918 "2020-10-14T00:32:38Z")
Hi, I want to get all queries executed on elastic search. Is there any log file where I can get this information. --- ## [No connection could be made because the target machine actively refused it](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-it/251961)
**Author:** [@jdehnert](https://discuss.elastic.co/u/jdehnert)\ **Replies:** 3\ **Last updated:** [October 13, 2020, 10:31pm UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-it/251961 "2020-10-13T22:31:21Z")
I have searched all the other posts on this topic, but none of the other answers seemed to help resolve my problem. My configuration is pretty simple. It's basically straight out of the documentation. I have Elasticse… --- ## [Setting heap size and jvm parameters on elastic docker image](https://discuss.elastic.co/t/setting-heap-size-and-jvm-parameters-on-elastic-docker-image/251953)
**Author:** [@jdevilla20](https://discuss.elastic.co/u/jdevilla20)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 10:20pm UTC](https://discuss.elastic.co/t/setting-heap-size-and-jvm-parameters-on-elastic-docker-image/251953 "2020-10-13T22:20:05Z")
Hi I am using elasticsearch.k8s.elastic.co/v1 to deploy Elasticsearch defined here When I have deployed to Kubernetes, I notice that the heap size is set to 1GB. I would like to increase it to 4GB. How can I set th… --- ## [Text similarity with Elasticseacrh](https://discuss.elastic.co/t/text-similarity-with-elasticseacrh/251737)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 4\ **Last updated:** [October 13, 2020, 9:41pm UTC](https://discuss.elastic.co/t/text-similarity-with-elasticseacrh/251737 "2020-10-13T21:41:11Z")
Hi everyone, Is there a way in Elastic to aggregate the values in a particular field by the similarity between the words? I mean if for example I have a field called "userMailbox", I would like to get groups of mailbox… --- ## [Java Memory Error From a Ruby Script?](https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 3\ **Last updated:** [October 13, 2020, 9:25pm UTC](https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611 "2020-10-13T21:25:39Z")
Hi Logstash, I’m running the Logstash 7.7.0 Docker container, spun up on an Ubuntu machine. In my LS filter config, I “bounce” all of my records off an external C program via a TCP socket: ruby { init =\> " … --- ## [Warm nodes on spinning disks not stable, falling out of cluster during recovery](https://discuss.elastic.co/t/warm-nodes-on-spinning-disks-not-stable-falling-out-of-cluster-during-recovery/250078)
**Author:** [@otoce](https://discuss.elastic.co/u/otoce)\ **Replies:** 33\ **Last updated:** [October 13, 2020, 5:26pm UTC](https://discuss.elastic.co/t/warm-nodes-on-spinning-disks-not-stable-falling-out-of-cluster-during-recovery/250078 "2020-10-13T17:26:18Z")
Hi, our warms nodes are falling out of cluster while in recovery, and then start recovery from zero. Hot nodes are ok. Env: 4 servers, on each (256GB ram, 8 cpu) : 1 hot node, 64GB, ssd, 30 days of data, heavy input f… --- ## [Map column from tiny math result](https://discuss.elastic.co/t/map-column-from-tiny-math-result/251691)
**Author:** [@Hugo\_Pires](https://discuss.elastic.co/u/Hugo_Pires)\ **Replies:** 3\ **Last updated:** [October 13, 2020, 9:10pm UTC](https://discuss.elastic.co/t/map-column-from-tiny-math-result/251691 "2020-10-13T21:10:13Z")
Hello Is it possible to create a new column in a data table using mapcolumn and a tinymath that divides two existing ones? Thank you Hugo --- ## [Logstash conditional test for value in a field](https://discuss.elastic.co/t/logstash-conditional-test-for-value-in-a-field/251968)
**Author:** [@Zorkmid](https://discuss.elastic.co/u/Zorkmid)\ **Replies:** 1\ **Last updated:** [October 13, 2020, 8:45pm UTC](https://discuss.elastic.co/t/logstash-conditional-test-for-value-in-a-field/251968 "2020-10-13T20:45:52Z")
Hello all, Is the follow correct for testing for the presence of a value and then applying the appropriate grok filter? The event types, urlfLog, accessLog all arrive in the same syslog input stream and I'd like to tes… --- ## [Ruby Filter to clean nulls and nils](https://discuss.elastic.co/t/ruby-filter-to-clean-nulls-and-nils/251966)
**Author:** [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 8:25pm UTC](https://discuss.elastic.co/t/ruby-filter-to-clean-nulls-and-nils/251966 "2020-10-13T20:25:58Z")
I grabbed a function from a thread somewhere that uses ruby to "clean" off nulls, nills, dashes, etc so that I dont needlessly clutter ES or import them. It has worked well up until now. Now however, I have a bit of a na… --- ## [IO / Disc "tear down" for elastic search](https://discuss.elastic.co/t/io-disc-tear-down-for-elastic-search/248013)
**Author:** [@Oleg\_Ruchovets](https://discuss.elastic.co/u/Oleg_Ruchovets)\ **Replies:** 41\ **Last updated:** [October 13, 2020, 7:08pm UTC](https://discuss.elastic.co/t/io-disc-tear-down-for-elastic-search/248013 "2020-10-13T19:08:49Z")
Hello, My task is to make an elastic search disk/io "hard life" :-). To not reinventing the wheel - is there a tool for simulation high disk load on elastic? what type of query is the most disk/io intensive? I saw many… --- ## [ReadTimeoutError, maybe related to internal:coordination/fault\_detection/leader\_check?](https://discuss.elastic.co/t/readtimeouterror-maybe-related-to-internal-coordination-fault-detection-leader-check/251940)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 4:50pm UTC](https://discuss.elastic.co/t/readtimeouterror-maybe-related-to-internal-coordination-fault-detection-leader-check/251940 "2020-10-13T16:50:11Z")
When trying to index documents in elastic, the following exception is frequently getting raised: ConnectionTimeout caused by - ReadTimeoutError(HTTPSConnectionPool(host='xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxeaf.us-west-2.aws… --- ## [Kibana 7.9.2: buttons, inputs, etc. disabled when visualization plugin added to dashboard](https://discuss.elastic.co/t/kibana-7-9-2-buttons-inputs-etc-disabled-when-visualization-plugin-added-to-dashboard/251319)
**Author:** [@jdd1](https://discuss.elastic.co/u/jdd1)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 8:03pm UTC](https://discuss.elastic.co/t/kibana-7-9-2-buttons-inputs-etc-disabled-when-visualization-plugin-added-to-dashboard/251319 "2020-10-13T20:03:22Z")
Reference https://github.com/elastic/kibana/issues/79405. I have created a trivial visualization plugin with a button. The button works when in the visualization creation/configuration screen. However, once the visual… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1751) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1753)