# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1843 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1844 --- ## [Does \_delete\_by\_query need a plugin or not? ES version 5.5](https://discuss.elastic.co/t/does-delete-by-query-need-a-plugin-or-not-es-version-5-5/246343)
**Author:** [@makons](https://discuss.elastic.co/u/makons)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 12:22pm UTC](https://discuss.elastic.co/t/does-delete-by-query-need-a-plugin-or-not-es-version-5-5/246343 "2020-08-26T12:22:17Z")
So I've seen this post from way before in 2015 saying that delete by query is supported through a plugin delete-by-query. This was for the Elasticsearch version 2.0.0. However, there's a newer post which says that now th… --- ## [Accessing Query Object within my code](https://discuss.elastic.co/t/accessing-query-object-within-my-code/246296)
**Author:** [@Paul\_Gege](https://discuss.elastic.co/u/Paul_Gege)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 11:42am UTC](https://discuss.elastic.co/t/accessing-query-object-within-my-code/246296 "2020-08-26T11:42:56Z")
Hi all, I'm just wondering if there's a way for me to grab the current query that's been run on a dashboard or visualization, and use it within a plugin that i'm developing. Thanks, Paul --- ## [Custom Logstash input plugin](https://discuss.elastic.co/t/custom-logstash-input-plugin/246437)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 11:11am UTC](https://discuss.elastic.co/t/custom-logstash-input-plugin/246437 "2020-08-26T11:11:56Z")
Hi all, Since the http\_poller has no support for paginated requests, I want to create a custom input plugin for logstash to solve this problem. is there a clear example to follow! --- ## [Logging of mapper\_parsing\_exception](https://discuss.elastic.co/t/logging-of-mapper-parsing-exception/246433)
**Author:** [@huberttrz](https://discuss.elastic.co/u/huberttrz)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 10:30am UTC](https://discuss.elastic.co/t/logging-of-mapper-parsing-exception/246433 "2020-08-26T10:30:53Z")
Hello, I've been googling for it with no luck to find out whether it is possible to have elasticsearch log any "mapper\_parsing\_exception" somewehre to a file / stdout wherever. I'm not using logstash, just elasticsearch… --- ## [Kibana doesn't show .keyword field under fields dropdown](https://discuss.elastic.co/t/kibana-doesnt-show-keyword-field-under-fields-dropdown/75104)
**Author:** [@Piyush\_Diwan](https://discuss.elastic.co/u/Piyush_Diwan)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 10:24am UTC](https://discuss.elastic.co/t/kibana-doesnt-show-keyword-field-under-fields-dropdown/75104 "2020-08-26T10:24:33Z")
I have an ES index generated by logstash that has the keyword field for all the properties, visible using ES API in kibana but on visualize page when I try to apply aggregation on Term, Field drop-down doesn't show any .… --- ## [Custom Metric not Adding Host.geo.country\_name](https://discuss.elastic.co/t/custom-metric-not-adding-host-geo-country-name/246094)
**Author:** [@Hassaan\_mustafa](https://discuss.elastic.co/u/Hassaan_mustafa)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 10:22am UTC](https://discuss.elastic.co/t/custom-metric-not-adding-host-geo-country-name/246094 "2020-08-26T10:22:42Z")
processors: - add\_host\_metadata: geo: name: server-1 country\_name: PK country\_iso\_code: PK city\_name: Karachi after providing add\_host\_metadata still country\_name is not … --- ## [How to remove a field from document?](https://discuss.elastic.co/t/how-to-remove-a-field-from-document/246420)
**Author:** [@jake\_hickory](https://discuss.elastic.co/u/jake_hickory)\ **Replies:** 5\ **Last updated:** [August 26, 2020, 9:57am UTC](https://discuss.elastic.co/t/how-to-remove-a-field-from-document/246420 "2020-08-26T09:57:26Z")
Hello, I am new to the forum so hi. I have the old \_type field from previous elasticsearch versions in all my documents and want it removed from my documents. How can I do this? Document: "\_index": "new-index", "\_type… --- ## [When searchable snapshot release?](https://discuss.elastic.co/t/when-searchable-snapshot-release/246209)
**Author:** [@ginger](https://discuss.elastic.co/u/ginger)\ **Replies:** 4\ **Last updated:** [August 26, 2020, 9:22am UTC](https://discuss.elastic.co/t/when-searchable-snapshot-release/246209 "2020-08-26T09:22:50Z")
We have seen search snapshot feature. We are looking forward to know when this feature release? --- ## [Question about auditbeat and squid](https://discuss.elastic.co/t/question-about-auditbeat-and-squid/246246)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 4\ **Last updated:** [August 26, 2020, 9:20am UTC](https://discuss.elastic.co/t/question-about-auditbeat-and-squid/246246 "2020-08-26T09:20:40Z")
We have squid proxy server, that writes it 's logs in /var/log directory. And we want to monitor it by auditbeat. Is it possible?If yes how we should do it? --- ## [How can we aggregate SUM on column of type text in Elastic Search?](https://discuss.elastic.co/t/how-can-we-aggregate-sum-on-column-of-type-text-in-elastic-search/246422)
**Author:** [@anupambharti](https://discuss.elastic.co/u/anupambharti)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 9:17am UTC](https://discuss.elastic.co/t/how-can-we-aggregate-sum-on-column-of-type-text-in-elastic-search/246422 "2020-08-26T09:17:55Z")
I have been trying to apply aggregate function for eg : sum on type of text my index mappings are below : \`\`\` { "my\_elastic\_search\_index" : { "mappings" : { "properties" : { "@timest… --- ## [Multiple user setup with elasticsearch docker-compose](https://discuss.elastic.co/t/multiple-user-setup-with-elasticsearch-docker-compose/246419)
**Author:** [@gkman](https://discuss.elastic.co/u/gkman)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 9:10am UTC](https://discuss.elastic.co/t/multiple-user-setup-with-elasticsearch-docker-compose/246419 "2020-08-26T09:10:49Z")
Hi, I am deploying ELK stack using docker compose. I will be using x-pack security features (users + tls) I have found a few examples of how to set a single user in elk (How to set passwords for built-in users with doc… --- ## [Kibana stuck in login loop](https://discuss.elastic.co/t/kibana-stuck-in-login-loop/246101)
**Author:** [@ayushr](https://discuss.elastic.co/u/ayushr)\ **Replies:** 17\ **Last updated:** [August 26, 2020, 9:00am UTC](https://discuss.elastic.co/t/kibana-stuck-in-login-loop/246101 "2020-08-26T09:00:35Z")
Hi I am using Kibana version 7.5.2 which is linked to my elasticsearch instance. I have created a dashboard of visualizations on Kibana and have embedded the dashboard in a web page that I make available to the users of… --- ## [Elasticsearch for small datasets?](https://discuss.elastic.co/t/elasticsearch-for-small-datasets/246139)
**Author:** [@Courtan](https://discuss.elastic.co/u/Courtan)\ **Replies:** 4\ **Last updated:** [August 26, 2020, 8:05am UTC](https://discuss.elastic.co/t/elasticsearch-for-small-datasets/246139 "2020-08-26T08:05:00Z")
I've just implemented an autocomplete suggestion using Elasticsearch which works like a charm. The index-size is just about 100kb, containing about 500 filter-combinations which clients then use to make further requests… --- ## [Benchmarking ES cluster using rally](https://discuss.elastic.co/t/benchmarking-es-cluster-using-rally/246320)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 7:53am UTC](https://discuss.elastic.co/t/benchmarking-es-cluster-using-rally/246320 "2020-08-26T07:53:32Z")
I am benchmarking ES cluster using esrally. I have created custom tracks using ES queries only search operation not indexing. There is a consistent individual query performance gap(considering 100th percentile service ti… --- ## [How to handle empty result in jdbc\_streaming filter plugin in Logstash](https://discuss.elastic.co/t/how-to-handle-empty-result-in-jdbc-streaming-filter-plugin-in-logstash/246347)
**Author:** [@naveen007](https://discuss.elastic.co/u/naveen007)\ **Replies:** 4\ **Last updated:** [August 26, 2020, 7:42am UTC](https://discuss.elastic.co/t/how-to-handle-empty-result-in-jdbc-streaming-filter-plugin-in-logstash/246347 "2020-08-26T07:42:36Z")
Hi, I'm using the jdbc\_streaming filter plugin to get data from query. But in some case query return empty result or null value. parameters =\> { "firstName" =\> "firstName" } statement =\> "SELECT DISTINCT… --- ## [Elasticsearch: How to insert geo points into a list coordinate](https://discuss.elastic.co/t/elasticsearch-how-to-insert-geo-points-into-a-list-coordinate/246239)
**Author:** [@Hung\_M\_Le](https://discuss.elastic.co/u/Hung_M_Le)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 7:41am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-insert-geo-points-into-a-list-coordinate/246239 "2020-08-26T07:41:31Z")
Hi I have followed the example in the document to draw a polygon on a map. Here are the setting. PUT /admnycoord { "mappings": { "properties": { "location": { "type": "geo\_shape" } } } } POST /admnycoord/\_do… --- ## [Why "now-60m" is not equal to "now-1h"](https://discuss.elastic.co/t/why-now-60m-is-not-equal-to-now-1h/246400)
**Author:** [@cold](https://discuss.elastic.co/u/cold)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 7:13am UTC](https://discuss.elastic.co/t/why-now-60m-is-not-equal-to-now-1h/246400 "2020-08-26T07:13:54Z")
elasticsearch version 7.1.1 index mapping is: { "mappings": { "properties": { "@timestamp": { "type": "date" }, "value": { "type": "integer" } } } } index data is: {"index":{"\_index":"t… --- ## [Line chart performance degradation (7.9)](https://discuss.elastic.co/t/line-chart-performance-degradation-7-9/246355)
**Author:** [@Mads\_Jon\_Nielsen](https://discuss.elastic.co/u/Mads_Jon_Nielsen)\ **Replies:** 4\ **Last updated:** [August 26, 2020, 6:58am UTC](https://discuss.elastic.co/t/line-chart-performance-degradation-7-9/246355 "2020-08-26T06:58:23Z")
Have any one else experienced a massive javascript hit (6-7 seconds), when showing line chart visualization in the latest Kibana ? I'm pretty sure its some sort of of javascript bug. If I make the same visualization … --- ## [How to get rid of \_type field](https://discuss.elastic.co/t/how-to-get-rid-of-type-field/246230)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 0\ **Last updated:** [August 25, 2020, 6:55am UTC](https://discuss.elastic.co/t/how-to-get-rid-of-type-field/246230 "2020-08-25T06:55:52Z")
Hi, I have old indices that still contain the \_type field. I want to get rid of this so that I am prepared for 8.X whenever its coming. How can I remove this field from all my indices? What I tried: Reindex, Did not h… --- ## [Visualize: Scripted field and median aggregation](https://discuss.elastic.co/t/visualize-scripted-field-and-median-aggregation/246225)
**Author:** [@boernd](https://discuss.elastic.co/u/boernd)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 6:28am UTC](https://discuss.elastic.co/t/visualize-scripted-field-and-median-aggregation/246225 "2020-08-26T06:28:03Z")
Hi, after upgrading Kibana to 7.8.1 (also tested with 7.9.0) from 7.5.2 some visualizations using the median aggregation on scripted fields seem broken as they do not display anything. I could reproduce this quite easil… --- ## [Kubernetes\_metadata does not work on Kubernetes Windows](https://discuss.elastic.co/t/kubernetes-metadata-does-not-work-on-kubernetes-windows/245617)
**Author:** [@iusergii](https://discuss.elastic.co/u/iusergii)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 6:25am UTC](https://discuss.elastic.co/t/kubernetes-metadata-does-not-work-on-kubernetes-windows/245617 "2020-08-26T06:25:12Z")
Hi Team, I'm evaluating moving our Windows workloads to Kubernetes and would like to use filebeat for logs shipment. I've created DaemonSet where I mounted hostPathes: /var/log /ProgramData/docker/containers My file… --- ## [Getting "\_groktimeout" error for a particular filter sometimes. Need help optimizing the filter](https://discuss.elastic.co/t/getting-groktimeout-error-for-a-particular-filter-sometimes-need-help-optimizing-the-filter/246342)
**Author:** [@saurabhc](https://discuss.elastic.co/u/saurabhc)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 5:36am UTC](https://discuss.elastic.co/t/getting-groktimeout-error-for-a-particular-filter-sometimes-need-help-optimizing-the-filter/246342 "2020-08-26T05:36:04Z")
The particular line is a "multiline". Hence using "codec =\> multiline" to get the line and then applying grok filter to it. But sometimes when the particular line is having large content the parsing fails with "\_groktim… --- ## [Kibana session logout randomly](https://discuss.elastic.co/t/kibana-session-logout-randomly/246388)
**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 5:22am UTC](https://discuss.elastic.co/t/kibana-session-logout-randomly/246388 "2020-08-26T05:22:54Z")
Hello. I have a working ELK Cluster Stack with SSL security, but it randomly log me out even if i'm working on (not idle). This happens only with elastic user (superuser/admin), with regular user there's no problem. I'… --- ## [Auditbeat or Filebeat](https://discuss.elastic.co/t/auditbeat-or-filebeat/246287)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 5:22am UTC](https://discuss.elastic.co/t/auditbeat-or-filebeat/246287 "2020-08-26T05:22:35Z")
Hi I just wondering what Auditbeat can audit what filebeat can't by logging /var/log/audit/audit.log ? we planned to install both auditbeat and filebeat on the same host but from my undersating filebeat also can get … --- ## [Reducing number of shards in 6.5 ES](https://discuss.elastic.co/t/reducing-number-of-shards-in-6-5-es/245709)
**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\ **Replies:** 12\ **Last updated:** [August 26, 2020, 5:17am UTC](https://discuss.elastic.co/t/reducing-number-of-shards-in-6-5-es/245709 "2020-08-26T05:17:13Z")
I tried to reduce number of shards in ES 6.5 version from default(5) to 1 using 'PUT \_template/temp\_new1 { "index\_patterns" : \["test1-\*"\], "settings" : { "number\_of\_shards" : 1, "number\_of\_replicas" : 1 } }' It … --- ## [Hadoop Training in Hyderabad](https://discuss.elastic.co/t/hadoop-training-in-hyderabad/21732)
**Author:** [@madhu\_k](https://discuss.elastic.co/u/madhu_k)\ **Replies:** 1\ **Last updated:** [December 6, 2016, 9:10am UTC](https://discuss.elastic.co/t/hadoop-training-in-hyderabad/21732 "2016-12-06T09:10:50Z")
Hadoop Training in Hyderabad, Online Hadoop Training in USA, Online Hadoop Training in UK, Online Hadoop Training in Canada, Online Hadoop Training in Austria, Online Hadoop Training in Singapore,Online Hadoo… --- ## [How to Move existing Index data to warm nodes](https://discuss.elastic.co/t/how-to-move-existing-index-data-to-warm-nodes/246077)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 5\ **Last updated:** [August 26, 2020, 4:56am UTC](https://discuss.elastic.co/t/how-to-move-existing-index-data-to-warm-nodes/246077 "2020-08-26T04:56:41Z")
Currently I have a 6 node cluster (4 hot nodes and 2 warm nodes). hot nodes contain less disk space and warm nodes are almost free.. The indexes are currently active and data ingestion is going on. below are my doubt: … --- ## [How to compare and sum docs with different values](https://discuss.elastic.co/t/how-to-compare-and-sum-docs-with-different-values/246364)
**Author:** [@Den1](https://discuss.elastic.co/u/Den1)\ **Replies:** 8\ **Last updated:** [August 26, 2020, 4:44am UTC](https://discuss.elastic.co/t/how-to-compare-and-sum-docs-with-different-values/246364 "2020-08-26T04:44:29Z")
Hello, I have docs with such data: sessionState: Active statusBoolean: true statusInt:-1 timeStamp:Aug 26, 2020 @ 02:08:21.522 OR sessionState: Disconnected statusBoolean: false statusInt:1 timeStamp:Aug 26, 20… --- ## [Logstash status is active but logs showing error as "\[2020-08-25T02:48:59,350\]\[ERROR\]\[org.logstash.Logstash \] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit"](https://discuss.elastic.co/t/logstash-status-is-active-but-logs-showing-error-as-2020-08-25t0259-350-error-org-logstash-logstash-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/246245)
**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 4:39am UTC](https://discuss.elastic.co/t/logstash-status-is-active-but-logs-showing-error-as-2020-08-25t0259-350-error-org-logstash-logstash-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/246245 "2020-08-26T04:39:45Z")
Hi, I have been trying to add one more conf file to pipeline.yml and did troubleshooting using sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/new.conf and it worked fine.Later during another troubleshooti… --- ## [Elasticsearch Query](https://discuss.elastic.co/t/elasticsearch-query/246332)
**Author:** [@sundarcse1216](https://discuss.elastic.co/u/sundarcse1216)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 4:28am UTC](https://discuss.elastic.co/t/elasticsearch-query/246332 "2020-08-26T04:28:33Z")
Hi All, I have record in Elasticsearch index like below. Can any one pls help me for curl query with following conditions. Conditions: Type must be 'A' user must be 'U1' OR 'U3' date range between '8/22/2020' and '8/… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1842) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1844)