# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1793 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1794 --- ## [Difference between saved searches and saved queries](https://discuss.elastic.co/t/difference-between-saved-searches-and-saved-queries/249446)
**Author:** [@eviatt](https://discuss.elastic.co/u/eviatt)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 6:14am UTC](https://discuss.elastic.co/t/difference-between-saved-searches-and-saved-queries/249446 "2020-09-22T06:14:14Z")
Hi Community Could someone explain me, whats the difference between saved searches and saved queries? Thanks --- ## [Canvas Multiple Math Functions ESSQL](https://discuss.elastic.co/t/canvas-multiple-math-functions-essql/249302)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 5:42am UTC](https://discuss.elastic.co/t/canvas-multiple-math-functions-essql/249302 "2020-09-22T05:42:40Z")
Hi, I have a typical scenario where we need to get a percentage of number of OK devices. Something like Scenario 1 Query Defective Devices count Divide ( Defective Devices / total) There are 2 ESSQL queries which ge… --- ## [How to add existing visualizations to canvas workpad?](https://discuss.elastic.co/t/how-to-add-existing-visualizations-to-canvas-workpad/249304)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 5:36am UTC](https://discuss.elastic.co/t/how-to-add-existing-visualizations-to-canvas-workpad/249304 "2020-09-22T05:36:44Z")
Hello, How can I get this working? Kibana 7.6.2 Seems like my Kibana is not working in the same way as in the example. Can I embed/add visualisations that were previously created? Thanks --- ## [From Logstash to Filebeat (Suricata module) - Substring Search No Longer Works](https://discuss.elastic.co/t/from-logstash-to-filebeat-suricata-module-substring-search-no-longer-works/249448)
**Author:** [@jason26](https://discuss.elastic.co/u/jason26)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 5:25am UTC](https://discuss.elastic.co/t/from-logstash-to-filebeat-suricata-module-substring-search-no-longer-works/249448 "2020-09-22T05:25:19Z")
I'm testing a move from Logstash to Filebeat with the Suricata plugin and I'm noticing that substring searching no longer works. For example, when I used Logstash (no custom template, just defaults, but JSON codec), I c… --- ## [Sending syslog logs through logstash](https://discuss.elastic.co/t/sending-syslog-logs-through-logstash/249442)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 5:07am UTC](https://discuss.elastic.co/t/sending-syslog-logs-through-logstash/249442 "2020-09-22T05:07:04Z")
I've configure rsyslog server logs are coming at the server side input { tcp { port =\> 10514 } } output { elasticsearch { hosts =\> "localhost:9200" index =\> "client-syslog-%{+YYYY.MM.dd}" } } the rsyslog logs are com… --- ## [Kiban metric ui bug](https://discuss.elastic.co/t/kiban-metric-ui-bug/249437)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 4:56am UTC](https://discuss.elastic.co/t/kiban-metric-ui-bug/249437 "2020-09-22T04:56:26Z")
kibana:7.8.0 --- ## [Anomaly detection using derivative aggregation](https://discuss.elastic.co/t/anomaly-detection-using-derivative-aggregation/249207)
**Author:** [@heric](https://discuss.elastic.co/u/heric)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 4:38am UTC](https://discuss.elastic.co/t/anomaly-detection-using-derivative-aggregation/249207 "2020-09-22T04:38:15Z")
Hi All, I am trying to define anomaly detection using derivative aggregation because the value that im interested in is accumulated counter ( increasing in each interval ). Below are the anomaly detector and datafeed t… --- ## [Problem searching Filebeat netflow module logs](https://discuss.elastic.co/t/problem-searching-filebeat-netflow-module-logs/249166)
**Author:** [@Sylancer](https://discuss.elastic.co/u/Sylancer)\ **Replies:** 14\ **Last updated:** [September 22, 2020, 4:19am UTC](https://discuss.elastic.co/t/problem-searching-filebeat-netflow-module-logs/249166 "2020-09-22T04:19:07Z")
I'm really sorry if this isn't the right tag for this, I'm just not sure where to start. I recently installed Filebeat, enabled the netflow module and pointed my Edgerouter X to my machine running the Elastic stack. I'm… --- ## [How to prevent Elasticsearch match on only one character with multi\_match](https://discuss.elastic.co/t/how-to-prevent-elasticsearch-match-on-only-one-character-with-multi-match/249441)
**Author:** [@EHH](https://discuss.elastic.co/u/EHH)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 4:15am UTC](https://discuss.elastic.co/t/how-to-prevent-elasticsearch-match-on-only-one-character-with-multi-match/249441 "2020-09-22T04:15:43Z")
Hi there, I'm using elasiticsearch-dsl and SmartCN analyzer: from elasticsearch\_dsl import analyzer analyzer\_cn = analyzer( 'smartcn', tokenizer=tokenizer('smartcn\_tokenizer'), filter=\['lowercase'\] ) And I… --- ## [Logstash data transformation or Kibana scripted field?](https://discuss.elastic.co/t/logstash-data-transformation-or-kibana-scripted-field/249435)
**Author:** [@kimjavier43](https://discuss.elastic.co/u/kimjavier43)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 4:12am UTC](https://discuss.elastic.co/t/logstash-data-transformation-or-kibana-scripted-field/249435 "2020-09-22T04:12:40Z")
Consider this data that I'm going to index in elastic search. Should I implement it using logstash transformation or kibana scripted field? Which is the best practice? Data mapping: 1 = apple 2 = orange 3 = mango El… --- ## [Interval and timestamp does not work as expected](https://discuss.elastic.co/t/interval-and-timestamp-does-not-work-as-expected/247345)
**Author:** [@Redcxx](https://discuss.elastic.co/u/Redcxx)\ **Replies:** 8\ **Last updated:** [September 22, 2020, 4:02am UTC](https://discuss.elastic.co/t/interval-and-timestamp-does-not-work-as-expected/247345 "2020-09-22T04:02:39Z")
Hi currently it is Sep 03 09:38 here, the explore tab shows that there is data of timestamp Sep 02 10:03, I set the interval in TSVB for 1d but there is no data, in fact it shows nothing for 2d as well. The data appear w… --- ## [How to only query on data nodes by elasticsearch-py?](https://discuss.elastic.co/t/how-to-only-query-on-data-nodes-by-elasticsearch-py/249293)
**Author:** [@derobukal](https://discuss.elastic.co/u/derobukal)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 4:00am UTC](https://discuss.elastic.co/t/how-to-only-query-on-data-nodes-by-elasticsearch-py/249293 "2020-09-22T04:00:39Z")
I am using elasticsearch-py, which version is 7.5.1. I have 3 master nodes and 6 data nodes, master nodes have 2gb heap and data nodes have 30 gb heap. How can I only query data on my data nodes? I read the source code… --- ## [Can't use scripted field in some visualisations](https://discuss.elastic.co/t/cant-use-scripted-field-in-some-visualisations/249432)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 3:49am UTC](https://discuss.elastic.co/t/cant-use-scripted-field-in-some-visualisations/249432 "2020-09-22T03:49:08Z")
I added scripted field "visitor" to my filibeat-\* pattern. doc\['source.address'\].value + '-' + doc\['user\_agent.original'\].value It works and I use it in some visualizations, for example in LINE. But, when I tried to u… --- ## [Shrink always waiting about ILM](https://discuss.elastic.co/t/shrink-always-waiting-about-ilm/249324)
**Author:** [@gxl\_elastic](https://discuss.elastic.co/u/gxl_elastic)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 3:26am UTC](https://discuss.elastic.co/t/shrink-always-waiting-about-ilm/249324 "2020-09-22T03:26:32Z")
When I use ILM to manage my index, I cannot shrink the shard after the index rolls to the warm node. The status of the index is: Waiting for node \[S8Oq38hDR7m4NovqwBMDaQ\] to contain \[3\] shards, found \[2\], remaining \[1\] M… --- ## [Invalid response for \_forcemerge, \_cache/clear APIs when unassigned shards](https://discuss.elastic.co/t/invalid-response-for-forcemerge-cache-clear-apis-when-unassigned-shards/248901)
**Author:** [@setiah](https://discuss.elastic.co/u/setiah)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:58pm UTC](https://discuss.elastic.co/t/invalid-response-for-forcemerge-cache-clear-apis-when-unassigned-shards/248901 "2020-09-21T23:58:42Z")
Hi, Issue When \_forcemerge is tried on an index or a group of indices that has some unassigned shards, the response returned does not indicate failures for unassigned shards. Even the total, failed and successful count… --- ## [Can 2 queries be used in a Metric or Markdown element, with if logic in the display?](https://discuss.elastic.co/t/can-2-queries-be-used-in-a-metric-or-markdown-element-with-if-logic-in-the-display/248237)
**Author:** [@devbot](https://discuss.elastic.co/u/devbot)\ **Replies:** 12\ **Last updated:** [September 21, 2020, 9:42pm UTC](https://discuss.elastic.co/t/can-2-queries-be-used-in-a-metric-or-markdown-element-with-if-logic-in-the-display/248237 "2020-09-21T21:42:36Z")
I have a Metric element on Kibana Canvas with the following expression syntax: filters group="default" | essql query="SELECT COUNT(\*) as count FROM \\"index1\*\\" " | markdown " {{#each rows}}{{coun… --- ## [Multiple version of filebeat in search impact](https://discuss.elastic.co/t/multiple-version-of-filebeat-in-search-impact/249361)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 9:31pm UTC](https://discuss.elastic.co/t/multiple-version-of-filebeat-in-search-impact/249361 "2020-09-21T21:31:29Z")
Hi, Our existing filebeat version (in staging) is 7.8.0 where we create a lot of visualization through it (using filebeat-\* index pattern) Most of this visualization is aggregation in terms using the agent.hostname and… --- ## [Adding new field to the mapping template](https://discuss.elastic.co/t/adding-new-field-to-the-mapping-template/249102)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 9:22pm UTC](https://discuss.elastic.co/t/adding-new-field-to-the-mapping-template/249102 "2020-09-21T21:22:49Z")
Hi, From time to time, I need to add a new field to my templates (mostly daily indices). Is there an easy way to apply that to an existing index? Thank you! --- ## [Update returned values in response](https://discuss.elastic.co/t/update-returned-values-in-response/249376)
**Author:** [@Cyril\_Guiet](https://discuss.elastic.co/u/Cyril_Guiet)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 9:08pm UTC](https://discuss.elastic.co/t/update-returned-values-in-response/249376 "2020-09-21T21:08:01Z")
Hello ! after my query I would like to know if it's possible to update the "instanceof" values by there labels equivalents ( municipalities and cities of Serbia == Q783930 ) . Thanks :slight\_smile: returned answer sam… --- ## [Automatic deletion of read only indices with 0 documents](https://discuss.elastic.co/t/automatic-deletion-of-read-only-indices-with-0-documents/249378)
**Author:** [@mjedynak](https://discuss.elastic.co/u/mjedynak)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 8:57pm UTC](https://discuss.elastic.co/t/automatic-deletion-of-read-only-indices-with-0-documents/249378 "2020-09-21T20:57:59Z")
I have index lifecycle policy (hot phase 1 month -\> warm phase 1 year -\> delete phase) My index has 2 primary shards + 1 replica (4 shards in total). Sometimes it happens that my index has 0 documents and it rolls over… --- ## [Matrix aggregate question](https://discuss.elastic.co/t/matrix-aggregate-question/249421)
**Author:** [@Aldo\_Sarmiento](https://discuss.elastic.co/u/Aldo_Sarmiento)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 8:41pm UTC](https://discuss.elastic.co/t/matrix-aggregate-question/249421 "2020-09-21T20:41:52Z")
Hello I'm having a hard time figuring out if the aggregate functions would be able to achieve what I'm trying to do. It's hard to explain in text format, but I created a simple image: https://imgur.com/a/YPXmrBI Basical… --- ## [High Heap Usage](https://discuss.elastic.co/t/high-heap-usage/249060)
**Author:** [@yasir\_khatri](https://discuss.elastic.co/u/yasir_khatri)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 8:31pm UTC](https://discuss.elastic.co/t/high-heap-usage/249060 "2020-09-21T20:31:43Z")
We are using single node of elasticsearch v7.9.1 with 3.0 Tb of data. The rollover size is 10 gb 3 shards per index, that makes in 3.33 gb per shard. I need help troubleshooting these issues: The heap usage is always … --- ## [Creating Custom Classes for Kibana ML Classification](https://discuss.elastic.co/t/creating-custom-classes-for-kibana-ml-classification/249416)
**Author:** [@NomadicCodeGuy](https://discuss.elastic.co/u/NomadicCodeGuy)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 8:24pm UTC](https://discuss.elastic.co/t/creating-custom-classes-for-kibana-ml-classification/249416 "2020-09-21T20:24:31Z")
I am using Elastic Stack for test log failure analysis. I would like to make a Data Frame Analytics classification job where I create my own classification categories(class labels.) It seems like the tool is currently se… --- ## [Index only and do not store in source](https://discuss.elastic.co/t/index-only-and-do-not-store-in-source/249283)
**Author:** [@Ankit\_Mangal](https://discuss.elastic.co/u/Ankit_Mangal)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 7:31pm UTC](https://discuss.elastic.co/t/index-only-and-do-not-store-in-source/249283 "2020-09-21T19:31:37Z")
I was looking for a feature where i can pass first name, last name as plain string to Elasticsearch and just index these fields so i can search but do not store them in source (Due to PII data). Came across this copy\_to … --- ## [Continuous transform doesn't use checkpoint timestamp to filter search](https://discuss.elastic.co/t/continuous-transform-doesnt-use-checkpoint-timestamp-to-filter-search/249178)
**Author:** [@tbrown\_monarx](https://discuss.elastic.co/u/tbrown_monarx)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 7:33pm UTC](https://discuss.elastic.co/t/continuous-transform-doesnt-use-checkpoint-timestamp-to-filter-search/249178 "2020-09-21T19:33:11Z")
On ES 7.7.1 I recently created a transform with an empty (match\_all) query that pivots with a group\_by including three terms and one histogram (not a date\_histogram which I understand has some issues with transforms). W… --- ## [Can't get AD ldap to work](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174)
**Author:** [@Jay9x](https://discuss.elastic.co/u/Jay9x)\ **Replies:** 9\ **Last updated:** [September 21, 2020, 7:26pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174 "2020-09-21T19:26:01Z")
Keep getting this error in the elasticsearch.log. Authentication to realm ldap failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), diagnosticMessage='80090308: LdapErr: DSID-0C0904… --- ## [Logstash - Can't get text on a START\_OBJECT](https://discuss.elastic.co/t/logstash-cant-get-text-on-a-start-object/249400)
**Author:** [@bruno\_aleixo](https://discuss.elastic.co/u/bruno_aleixo)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 7:15pm UTC](https://discuss.elastic.co/t/logstash-cant-get-text-on-a-start-object/249400 "2020-09-21T19:15:36Z")
Hi, could help me with errors at the logstash \[2020-09-21T13:48:42,854\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"apimanager-2… --- ## [Multi index in filbeat Logstash output](https://discuss.elastic.co/t/multi-index-in-filbeat-logstash-output/249412)
**Author:** [@ganta\_chandra\_teja](https://discuss.elastic.co/u/ganta_chandra_teja)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 7:03pm UTC](https://discuss.elastic.co/t/multi-index-in-filbeat-logstash-output/249412 "2020-09-21T19:03:36Z")
Tried multi index in filebeat 7.5.2 but didn't work. Please suggest. filebeat.inputs: - type: log enabled: true paths: - /app/logs/ldapsync/dnp\_ldap\_interface\_error.log processors: - dissect: tokenize… --- ## [How to connect to DB2 using JDBC with securityMechanism=13](https://discuss.elastic.co/t/how-to-connect-to-db2-using-jdbc-with-securitymechanism-13/249410)
**Author:** [@fsilveir](https://discuss.elastic.co/u/fsilveir)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 6:40pm UTC](https://discuss.elastic.co/t/how-to-connect-to-db2-using-jdbc-with-securitymechanism-13/249410 "2020-09-21T18:40:18Z")
Hi there, I'm trying to extract some data from a DB2 database with securityMechanism 13. I've tried passing this parameter as part of the connection string as shown below: input { jdbc { jdbc\_connection\_string =\> … --- ## [Logstash config date filter - what am I doing wrong?](https://discuss.elastic.co/t/logstash-config-date-filter-what-am-i-doing-wrong/248186)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 14\ **Last updated:** [September 21, 2020, 6:23pm UTC](https://discuss.elastic.co/t/logstash-config-date-filter-what-am-i-doing-wrong/248186 "2020-09-21T18:23:50Z")
Hi, I am new to the elastic stack. I am currently having trouble setting the timestamp within the logstash config. The date format to be read: 2019/06/19 10:05:37.000000 19046 2019/06/19 10:07:11.000000 3893143 075… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1792) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1794)