# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1762 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1763 --- ## [Logstash Fingerprint Issue](https://discuss.elastic.co/t/logstash-fingerprint-issue/251410)
**Author:** [@Pratik\_Sheth](https://discuss.elastic.co/u/Pratik_Sheth)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 10:10am UTC](https://discuss.elastic.co/t/logstash-fingerprint-issue/251410 "2020-10-08T10:10:47Z")
Hi.. I have been having issue with the logstash configuration. I have set the configuration such that fingerprint of few fields is considered as doc\_id but The ID is not getting populated even tho hash are coming correc… --- ## [Master can not be discovered](https://discuss.elastic.co/t/master-can-not-be-discovered/251237)
**Author:** [@dorcas](https://discuss.elastic.co/u/dorcas)\ **Replies:** 6\ **Last updated:** [October 8, 2020, 10:02am UTC](https://discuss.elastic.co/t/master-can-not-be-discovered/251237 "2020-10-08T10:02:14Z")
After i enabled xpack.security.enabled: true xpack.security.transport.ssl.enabled: true and i restart my two nodes i get this error master not discovered yet, this node has not previously joined a bootstrapped (v7+) … --- ## [Filebeats to elasticsearch ingress documentation](https://discuss.elastic.co/t/filebeats-to-elasticsearch-ingress-documentation/251384)
**Author:** [@sillencem](https://discuss.elastic.co/u/sillencem)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 9:54am UTC](https://discuss.elastic.co/t/filebeats-to-elasticsearch-ingress-documentation/251384 "2020-10-08T09:54:54Z")
When using the config from here: https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ingest-node.html output.elasticsearch: hosts: \["localhost:9200"\] pipeline: "test-pipeline" the ingress wasn't used… --- ## [Loosing node connection after update to 7.9.2](https://discuss.elastic.co/t/loosing-node-connection-after-update-to-7-9-2/251405)
**Author:** [@whysmer](https://discuss.elastic.co/u/whysmer)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 9:28am UTC](https://discuss.elastic.co/t/loosing-node-connection-after-update-to-7-9-2/251405 "2020-10-08T09:28:18Z")
Hello, I have one node which is not reconecting after updating from 7.7.1 to 7.9.2 my cluster of three nodes. Here is the error, I don't understand why it's a connection problem as nothing changed ? \[2020-10-08T11:22… --- ## [Get the top document from each group with sorting and paging](https://discuss.elastic.co/t/get-the-top-document-from-each-group-with-sorting-and-paging/251003)
**Author:** [@Sergii](https://discuss.elastic.co/u/Sergii)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 8:34am UTC](https://discuss.elastic.co/t/get-the-top-document-from-each-group-with-sorting-and-paging/251003 "2020-10-08T08:34:36Z")
Hi! I have a collection of entities and I need to group them by RelationId and select entity with biggest Revision in each group. Result should be ordered by "title" and support paging. Is it possible to do this with El… --- ## [Nginx Log Dashboard Not Show Data](https://discuss.elastic.co/t/nginx-log-dashboard-not-show-data/251395)
**Author:** [@reza\_naipospos](https://discuss.elastic.co/u/reza_naipospos)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 8:37am UTC](https://discuss.elastic.co/t/nginx-log-dashboard-not-show-data/251395 "2020-10-08T08:37:31Z")
No data after make dashboard from filebeat command the data requirement on kibana not same with my nginx log data Please help me --- ## [Limit script\_score rescoring to the top query matches](https://discuss.elastic.co/t/limit-script-score-rescoring-to-the-top-query-matches/251247)
**Author:** [@fpug](https://discuss.elastic.co/u/fpug)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 8:35am UTC](https://discuss.elastic.co/t/limit-script-score-rescoring-to-the-top-query-matches/251247 "2020-10-08T08:35:15Z")
Hi! I'm trying to score some documents via their a dense\_vector field, via a script\_score query. The cosine computation is relatively expensive, so I'd like to limit it to the best scoring results of the "query" clause… --- ## [Watcher advanced scripts](https://discuss.elastic.co/t/watcher-advanced-scripts/251197)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 8:33am UTC](https://discuss.elastic.co/t/watcher-advanced-scripts/251197 "2020-10-08T08:33:14Z")
I am using Kibana 7.8 and below is the result of my POST \_xpack/watcher/watch/949f7606-97dc-42ce-86b7-ddcf5a77d804/\_execute "result" : { "execution\_time" : "2020-10-06T23:40:33.976Z", "execution\_duration" :… --- ## [Prettify Watcher JSON Response](https://discuss.elastic.co/t/prettify-watcher-json-response/250947)
**Author:** [@Porton](https://discuss.elastic.co/u/Porton)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 8:31am UTC](https://discuss.elastic.co/t/prettify-watcher-json-response/250947 "2020-10-08T08:31:38Z")
What is the best way to pretty JSON response from Elasticsearch Watch ? Currently doing webhook to MS Teams, body": "{ title: 'Server Metrics Alert', text: '{{#toJson}}ctx.payload.hits{{/toJson}}' }", Everything works… --- ## [GREEDYDATA in Grok doesn't pick up a leading \[](https://discuss.elastic.co/t/greedydata-in-grok-doesnt-pick-up-a-leading/250999)
**Author:** [@joesheps](https://discuss.elastic.co/u/joesheps)\ **Replies:** 11\ **Last updated:** [October 8, 2020, 8:18am UTC](https://discuss.elastic.co/t/greedydata-in-grok-doesnt-pick-up-a-leading/250999 "2020-10-08T08:18:05Z")
I am receiving syslogs like this: Oct 5 13:37:13 10.20.30.40 %ASA-4-733100: \[ HTTP 80\] drop rate-1 exceeded. Current burst rate is 7 per second, max configured rate is 40; Current average rate is 23 per seco… --- ## [How to get around the problem with Incompatible types found in multi-mapping during reading data by Spark from Elasticsearch?](https://discuss.elastic.co/t/how-to-get-around-the-problem-with-incompatible-types-found-in-multi-mapping-during-reading-data-by-spark-from-elasticsearch/251389)
**Author:** [@dlubom](https://discuss.elastic.co/u/dlubom)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 7:48am UTC](https://discuss.elastic.co/t/how-to-get-around-the-problem-with-incompatible-types-found-in-multi-mapping-during-reading-data-by-spark-from-elasticsearch/251389 "2020-10-08T07:48:03Z")
How to get around this problem (without reindexing): Py4JJavaError: An error occurred while calling o2649.load. : org.elasticsearch.hadoop.EsHadoopIllegalArgumentException: Incompatible types found in multi-mapping: Fie… --- ## [Pointing to different Nodes](https://discuss.elastic.co/t/pointing-to-different-nodes/251198)
**Author:** [@Jtomage](https://discuss.elastic.co/u/Jtomage)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 7:36am UTC](https://discuss.elastic.co/t/pointing-to-different-nodes/251198 "2020-10-08T07:36:17Z")
Hi all, New to elasticsearch I am currently for clarification on pointing to nodes with different roles. The current set up is a 3 Master-data node cluster and looking to possibly scale out. Currently there are 2 applic… --- ## [Getting errors after Logstash upgrade from 7.6.2 to 7.9.2](https://discuss.elastic.co/t/getting-errors-after-logstash-upgrade-from-7-6-2-to-7-9-2/251370)
**Author:** [@yummycake](https://discuss.elastic.co/u/yummycake)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 7:33am UTC](https://discuss.elastic.co/t/getting-errors-after-logstash-upgrade-from-7-6-2-to-7-9-2/251370 "2020-10-08T07:33:11Z")
I recently upgraded my Logstash from 7.6.2 to the latest version 7.9.2. When I tested my configuration file, I received the output below. I did not get the error below output when I tested with version 7.6.2 May I know … --- ## [Logstash Grok pattern](https://discuss.elastic.co/t/logstash-grok-pattern/251373)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 7:25am UTC](https://discuss.elastic.co/t/logstash-grok-pattern/251373 "2020-10-08T07:25:28Z")
Grok pattern isn't working . before I used grok pattern and it creates a fields which was I added into pattern. but now it's not creating a fields Help me out of this Here is my grok pattern : grok { match… --- ## [Kibana multiple line scripts json input](https://discuss.elastic.co/t/kibana-multiple-line-scripts-json-input/248374)
**Author:** [@sambart19](https://discuss.elastic.co/u/sambart19)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 7:21am UTC](https://discuss.elastic.co/t/kibana-multiple-line-scripts-json-input/248374 "2020-10-08T07:21:38Z")
This is a duplicate of the question here from a different user that never got an answer. I would like to be able to use multiple lines in the json input for a script but the triple quote that is listed in documentation… --- ## [Get Sum value of an aggregation than group by a term looks not possible](https://discuss.elastic.co/t/get-sum-value-of-an-aggregation-than-group-by-a-term-looks-not-possible/251271)
**Author:** [@miri](https://discuss.elastic.co/u/miri)\ **Replies:** 5\ **Last updated:** [October 8, 2020, 7:13am UTC](https://discuss.elastic.co/t/get-sum-value-of-an-aggregation-than-group-by-a-term-looks-not-possible/251271 "2020-10-08T07:13:59Z")
Is there a way to get from a field value ( like "devices\_connected"), seperated by a term (like "servers") ... the sum of that? Example: There are 3 servers sending connected device information into elasticsearch //1se… --- ## [\[Elastic Cloud\] Shipped JSON logs sometimes not parsed](https://discuss.elastic.co/t/elastic-cloud-shipped-json-logs-sometimes-not-parsed/251382)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 7:06am UTC](https://discuss.elastic.co/t/elastic-cloud-shipped-json-logs-sometimes-not-parsed/251382 "2020-10-08T07:06:51Z")
Recently, Elastic Cloud has added the ability to also ship logs to a remote monitoring cluster. Enabling that feature worked great, however, I'm seeing parsing issues in the elasticsearch.server dataset. Two subsequent … --- ## [K8s metricbeat not consistently recognizing metric endpoints](https://discuss.elastic.co/t/k8s-metricbeat-not-consistently-recognizing-metric-endpoints/246574)
**Author:** [@jonas27](https://discuss.elastic.co/u/jonas27)\ **Replies:** 15\ **Last updated:** [October 8, 2020, 6:55am UTC](https://discuss.elastic.co/t/k8s-metricbeat-not-consistently-recognizing-metric-endpoints/246574 "2020-10-08T06:55:28Z")
Hello, I experienced that after restarting metricbeat in kubernetes it recognizes different pods to scan Recognizes fine after restart: Only recognizing before: Only recognizing after: I have checked that all … --- ## [Queries get slow while indexing documents](https://discuss.elastic.co/t/queries-get-slow-while-indexing-documents/251243)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 8\ **Last updated:** [October 8, 2020, 6:52am UTC](https://discuss.elastic.co/t/queries-get-slow-while-indexing-documents/251243 "2020-10-08T06:52:01Z")
I have an index with approximately 2.3M documents. It usually returns results of query within 1~2 seconds, but it gets very slow (sometimes as long as 20~30s) while I'm inserting data into the index. I insert data in R… --- ## [Metricbeat writes data randomly, instead every 10 sec](https://discuss.elastic.co/t/metricbeat-writes-data-randomly-instead-every-10-sec/247865)
**Author:** [@Razby](https://discuss.elastic.co/u/Razby)\ **Replies:** 12\ **Last updated:** [October 8, 2020, 6:51am UTC](https://discuss.elastic.co/t/metricbeat-writes-data-randomly-instead-every-10-sec/247865 "2020-10-08T06:51:04Z")
Hi, We got a problem. Metricbeat writes data randomly even though the period=10s in case the query instance is set to all "\*". The data are recorded randomly for specific instance, but not every 10 seconds. If I set t… --- ## [Metricbeat have default parameter](https://discuss.elastic.co/t/metricbeat-have-default-parameter/250633)
**Author:** [@jonas27](https://discuss.elastic.co/u/jonas27)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 6:51am UTC](https://discuss.elastic.co/t/metricbeat-have-default-parameter/250633 "2020-10-08T06:51:03Z")
Hi, Is there a way to set a config params as optional. I want to give our freedom to set the period (scrape interval) optionally. What I tried so far was this templates: - condition.and: - equ… --- ## [Bar Chart axis label not in center of bar](https://discuss.elastic.co/t/bar-chart-axis-label-not-in-center-of-bar/250955)
**Author:** [@Nicolas\_Deleplace](https://discuss.elastic.co/u/Nicolas_Deleplace)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 6:41am UTC](https://discuss.elastic.co/t/bar-chart-axis-label-not-in-center-of-bar/250955 "2020-10-08T06:41:48Z")
Hi, exact same issue as https://discuss.elastic.co/t/bar-chart-axis-label-not-in-center-of-bar/247039 Why is this topic closed with no solution ? Thanks for helping :slight\_smile: Example : missing January and not c… --- ## [\[Elastic Cloud\] Logs are shipped without ILM policy](https://discuss.elastic.co/t/elastic-cloud-logs-are-shipped-without-ilm-policy/251377)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 6:41am UTC](https://discuss.elastic.co/t/elastic-cloud-logs-are-shipped-without-ilm-policy/251377 "2020-10-08T06:41:45Z")
Recently, Elastic Cloud has added the ability to also ship logs to a remote monitoring cluster. Enabling that feature worked great, except for one single thing. The index called elastic-cloud-logs-7-2020.10.08-000001 wa… --- ## [Reporting on Multiple Indices in elastic](https://discuss.elastic.co/t/reporting-on-multiple-indices-in-elastic/251376)
**Author:** [@Khushboo2908](https://discuss.elastic.co/u/Khushboo2908)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 6:37am UTC](https://discuss.elastic.co/t/reporting-on-multiple-indices-in-elastic/251376 "2020-10-08T06:37:28Z")
I have multiple indices in elastic and I need to generate reports using all of them. Description of indices: Ticket: Fields: Ticket\_id, campaign\_id, customer\_id, \ Campaign Fields: campaign\_id… --- ## [Pipeline name in body of \_update\_by\_query request](https://discuss.elastic.co/t/pipeline-name-in-body-of-update-by-query-request/251128)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 6\ **Last updated:** [October 8, 2020, 6:20am UTC](https://discuss.elastic.co/t/pipeline-name-in-body-of-update-by-query-request/251128 "2020-10-08T06:20:42Z")
Hello, is it possible to specify id/name of pipeline in body of \_update\_by\_query request? POST \_update\_by\_query?pipeline=id\_of\_pipeline { # How to specify pipeline here? Is it possible? } --- ## [Combine two queries](https://discuss.elastic.co/t/combine-two-queries/251346)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 6:19am UTC](https://discuss.elastic.co/t/combine-two-queries/251346 "2020-10-08T06:19:43Z")
Hello, I want to combine two queries into one: query 1: { "query": { "match\_phrase": { "m09-event-id.keyword": "DELIVER" } } } query 2: { "query": { "match\_phrase": { "m23-directionalit… --- ## [Restrict time range for users in kibana](https://discuss.elastic.co/t/restrict-time-range-for-users-in-kibana/251371)
**Author:** [@Saurabh\_Anand](https://discuss.elastic.co/u/Saurabh_Anand)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 5:38am UTC](https://discuss.elastic.co/t/restrict-time-range-for-users-in-kibana/251371 "2020-10-08T05:38:24Z")
Is it possible to restrict time ranges for different users in Kibana? For example User1 can not search data before 90 days. User1 can only see those data available between now to 90 days before? --- ## [Logstash daily indices write to wrong (yesterday) date](https://discuss.elastic.co/t/logstash-daily-indices-write-to-wrong-yesterday-date/251339)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 8:44pm UTC](https://discuss.elastic.co/t/logstash-daily-indices-write-to-wrong-yesterday-date/251339 "2020-10-07T20:44:15Z")
I implement logstash elasticsearch output to create daily indices. The index name has this format: "default-%{\[kubernetes\]\[pod\]\[name\]}-%{+YYYY.MM.dd}" It works perfectly, it creates index, lets say for example for pod m… --- ## [Filebeat multiline pattern](https://discuss.elastic.co/t/filebeat-multiline-pattern/251274)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 5:22am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern/251274 "2020-10-08T05:22:44Z")
In the picture stacktrace of log message taking the new log line I want them in one log. How to do that ? Here is my log example : 2020-10-01 16:39:18.4120 ERROR LeadsController bhavin http://bhavin/Leads/New POS… --- ## [Delete index automatically after particular days](https://discuss.elastic.co/t/delete-index-automatically-after-particular-days/251289)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 5:16am UTC](https://discuss.elastic.co/t/delete-index-automatically-after-particular-days/251289 "2020-10-08T05:16:59Z")
Hi, I am using Logstash to ingest log data to elasticsearch, Indices are created daily, that every day's index has a unique name like index\_name-YYYY-MM-DD. So, after 30 days, there will be 30 indices. On day 31st, I wa… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1761) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1763)