# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1862 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1863 --- ## [Using aggregate filter to count number of events and sum field's values](https://discuss.elastic.co/t/using-aggregate-filter-to-count-number-of-events-and-sum-fields-values/244448)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 28\ **Last updated:** [August 17, 2020, 2:24pm UTC](https://discuss.elastic.co/t/using-aggregate-filter-to-count-number-of-events-and-sum-fields-values/244448 "2020-08-17T14:24:06Z")
Hi all, I have an index in elasticsearch name as "myindex" so that have fields like"date\_eng","company\_name","service\_name", "amount". I want to use aggregate filter so that counts the times which an services has been u… --- ## [Best approach to 50+ input sources](https://discuss.elastic.co/t/best-approach-to-50-input-sources/245249)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 2:20pm UTC](https://discuss.elastic.co/t/best-approach-to-50-input-sources/245249 "2020-08-17T14:20:42Z")
Hello I'd appreciate your thoughts on how to approcah the following use case: I have to configure a Logstash pipeline to index a table in SQL Server The thing is, although the table structure is the same for every cli… --- ## [Custom beat needs to send custom health messages to monitoring cluster](https://discuss.elastic.co/t/custom-beat-needs-to-send-custom-health-messages-to-monitoring-cluster/245032)
**Author:** [@rmauri](https://discuss.elastic.co/u/rmauri)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 2:18pm UTC](https://discuss.elastic.co/t/custom-beat-needs-to-send-custom-health-messages-to-monitoring-cluster/245032 "2020-08-17T14:18:08Z")
I have a suite of custom beats that are all configured to output to logstash and enable the internal monitoring collection. The monitoring data being collected is currently of two types (as supported out of the box by li… --- ## [Non-zero metrics in the last 30s how to reduce this 30s to 5s?](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-how-to-reduce-this-30s-to-5s/245239)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 2:12pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-how-to-reduce-this-30s-to-5s/245239 "2020-08-17T14:12:36Z")
Hi ELK friends, Non-zero metrics in the last 30s how to reduce this 30s to 5s? File beat should send data instantly instead of every 30s how to change this setting? --- ## [Connecting to the SAP Hana Database](https://discuss.elastic.co/t/connecting-to-the-sap-hana-database/245210)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 2:07pm UTC](https://discuss.elastic.co/t/connecting-to-the-sap-hana-database/245210 "2020-08-17T14:07:06Z")
Is it possible to connect to the SAP Hana Database using the logstash jdbc input plugin? Whether it is officially supported database just like MySQL and Oracle? --- ## [Sort fields on numeric part, and the alpha part](https://discuss.elastic.co/t/sort-fields-on-numeric-part-and-the-alpha-part/244163)
**Author:** [@JjOon](https://discuss.elastic.co/u/JjOon)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 1:54pm UTC](https://discuss.elastic.co/t/sort-fields-on-numeric-part-and-the-alpha-part/244163 "2020-08-17T13:54:20Z")
Hi all, I am facing the following issue. I have some addresses, and when we sort them on the number, we have a alphanumeric sort. Like : 1 11 2 etc... My problem is : this number can contains letters or others char… --- ## [Problems with path.data change on local machine](https://discuss.elastic.co/t/problems-with-path-data-change-on-local-machine/245243)
**Author:** [@vbelobragin](https://discuss.elastic.co/u/vbelobragin)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 1:33pm UTC](https://discuss.elastic.co/t/problems-with-path-data-change-on-local-machine/245243 "2020-08-17T13:33:46Z")
Hello everyone. I can not change local ES location - can not modify path.data . That's probably some elementary mistake, but I am stuck and greatly appreciate any assistance. So: Fresh local installation of ES 7.8.1 … --- ## [ES Backup restore](https://discuss.elastic.co/t/es-backup-restore/245241)
**Author:** [@Sagar\_Gulia](https://discuss.elastic.co/u/Sagar_Gulia)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 1:24pm UTC](https://discuss.elastic.co/t/es-backup-restore/245241 "2020-08-17T13:24:10Z")
Can anyone tell me how can I pick latest snapshot while restoring my es backup in java. As I am keeping a snapshot every 30 min whole day and I want to shutdown es for night and in morning i want to restore the latest ba… --- ## [Can't find master nodes after node restart](https://discuss.elastic.co/t/cant-find-master-nodes-after-node-restart/245138)
**Author:** [@Barak](https://discuss.elastic.co/u/Barak)\ **Replies:** 13\ **Last updated:** [August 17, 2020, 1:29pm UTC](https://discuss.elastic.co/t/cant-find-master-nodes-after-node-restart/245138 "2020-08-17T13:29:36Z")
After upgrading to 7.7.1, the data nodes can't find the master nodes after a restart of the data node. I am using EC2 discovery plugin, and on the initial startup it joins the cluster as expected, but once restarted in … --- ## [New Platform Plugin - disallowed syntax found](https://discuss.elastic.co/t/new-platform-plugin-disallowed-syntax-found/243625)
**Author:** [@AndreaTosti](https://discuss.elastic.co/u/AndreaTosti)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 1:28pm UTC](https://discuss.elastic.co/t/new-platform-plugin-disallowed-syntax-found/243625 "2020-08-17T13:28:43Z")
Hello everyone, in legacy plugins I was able to run the following import: import EditorJs from 'react-editor-js'; In the new platform (v7.8.2) I can no longer do that import. This generates the following errors (when … --- ## [Saved "field" parameter is now invalid. Please select a new field](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/244886)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 6\ **Last updated:** [August 17, 2020, 1:15pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/244886 "2020-08-17T13:15:31Z")
hello everybody, I am setting up ILM and I am having an error in kibana dashboards: Saved "field" parameter is now invalid. Please select a new field. here are the steps that I followed: Create ILM policy: PUT \_ilm/p… --- ## [Source raw files purging after shipping to ELK](https://discuss.elastic.co/t/source-raw-files-purging-after-shipping-to-elk/243597)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 5\ **Last updated:** [August 17, 2020, 1:05pm UTC](https://discuss.elastic.co/t/source-raw-files-purging-after-shipping-to-elk/243597 "2020-08-17T13:05:33Z")
how to manage physical logs file after moving to ELK if we want to delete text files after moving to ELK how do we do? what tool can i userWe are getting payload logs from GDS channels as response for our request to book… --- ## [Growing field mapping management](https://discuss.elastic.co/t/growing-field-mapping-management/245235)
**Author:** [@WDK](https://discuss.elastic.co/u/WDK)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 12:35pm UTC](https://discuss.elastic.co/t/growing-field-mapping-management/245235 "2020-08-17T12:35:15Z")
Hi all, I wonder how people here manage the growing amount of mappings you see in some indices. Especially kubernetes logs tend to have a wild variety of field. In my situation, all kubernetes logs end up in the same in… --- ## [Use custom field instead of doc\_count](https://discuss.elastic.co/t/use-custom-field-instead-of-doc-count/245234)
**Author:** [@sesha](https://discuss.elastic.co/u/sesha)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 12:34pm UTC](https://discuss.elastic.co/t/use-custom-field-instead-of-doc-count/245234 "2020-08-17T12:34:14Z")
Need to use custom field instead of doc\_count Is it possible to change the default configuration to change doc\_count to sum by custom field Query: GET test/\_search { "aggs": { "NAME": { "term… --- ## [How to use elastic search for storing & fetching document as json](https://discuss.elastic.co/t/how-to-use-elastic-search-for-storing-fetching-document-as-json/245232)
**Author:** [@mmuzammil45](https://discuss.elastic.co/u/mmuzammil45)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 12:13pm UTC](https://discuss.elastic.co/t/how-to-use-elastic-search-for-storing-fetching-document-as-json/245232 "2020-08-17T12:13:12Z")
I am working on ElasticSearch for the purpose of storing & fetching data as json. The problem is ES treats json as text/string when I use search/highlight function and does not complete my requirement i.e. to get all the… --- ## [How to control Logstash multiple output rate](https://discuss.elastic.co/t/how-to-control-logstash-multiple-output-rate/245224)
**Author:** [@vaishno.avi](https://discuss.elastic.co/u/vaishno.avi)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 11:15am UTC](https://discuss.elastic.co/t/how-to-control-logstash-multiple-output-rate/245224 "2020-08-17T11:15:10Z")
Hello, I am using logstash with multiple output, with the below config if \[channel\] == "test" { elasticsearch { hosts =\> \["elk\_url"\] index =\> "logs-%{+YYYY.MM.dd}" } … --- ## [How to keep enrich index updated](https://discuss.elastic.co/t/how-to-keep-enrich-index-updated/245188)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 12:07pm UTC](https://discuss.elastic.co/t/how-to-keep-enrich-index-updated/245188 "2020-08-17T12:07:44Z")
hi, When we create a enrich index to use in enrich policy, is there a way to keep the enrich index updated based on changes happening in source index from which enrich index was created? If I have to constantly update … --- ## [Different number of hits for the same time range](https://discuss.elastic.co/t/different-number-of-hits-for-the-same-time-range/244912)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 11:59am UTC](https://discuss.elastic.co/t/different-number-of-hits-for-the-same-time-range/244912 "2020-08-17T11:59:58Z")
As I am using the same time range for the same query, it is returning different numbers of hits on re-query. { "size": "0", "query": { "bool": { "must": \[ { "range": { "timest… --- ## [Rollup Jobs Performance](https://discuss.elastic.co/t/rollup-jobs-performance/245228)
**Author:** [@michaelpietzsch](https://discuss.elastic.co/u/michaelpietzsch)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 11:45am UTC](https://discuss.elastic.co/t/rollup-jobs-performance/245228 "2020-08-17T11:45:53Z")
Hi Gals and Guys, i am having issues with Rollup Jobs on my system. The Data Quantity is quite large (100861815 Documents streched over 50gb per index) I am trying to run a job to roll up the information of the passt d… --- ## [Kibana visualisation from SQL query](https://discuss.elastic.co/t/kibana-visualisation-from-sql-query/244013)
**Author:** [@Mkapustin](https://discuss.elastic.co/u/Mkapustin)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 10:45am UTC](https://discuss.elastic.co/t/kibana-visualisation-from-sql-query/244013 "2020-08-17T10:45:44Z")
Hello friends! Need help with visualisation in Kibana from sql query: I have the same table from sql query: I need to group results values by columns of actions values and by Mail ID. In splunk I realise it with cha… --- ## [Count unique values from the filter query result, taking two fields into account](https://discuss.elastic.co/t/count-unique-values-from-the-filter-query-result-taking-two-fields-into-account/245220)
**Author:** [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 10:32am UTC](https://discuss.elastic.co/t/count-unique-values-from-the-filter-query-result-taking-two-fields-into-account/245220 "2020-08-17T10:32:05Z")
I have a query that filters the "desc = mls or door = 33". Next I want a count value with a agregations the unique values in two fields. "query": { "nested": { "path": "data.addresses", "inner\_hits": { … --- ## [DLQ - dead\_letter\_queue input plugin features and ability](https://discuss.elastic.co/t/dlq-dead-letter-queue-input-plugin-features-and-ability/245219)
**Author:** [@Apollyon](https://discuss.elastic.co/u/Apollyon)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 10:27am UTC](https://discuss.elastic.co/t/dlq-dead-letter-queue-input-plugin-features-and-ability/245219 "2020-08-17T10:27:12Z")
Hello all Running Logstash v7.8.1 and dead\_letter\_queue input plugin v1.1.5. Just a question about the functionalilty of the DLQ input plugin for Logstash. Seeing a couple of issues myself and then after looking aroun… --- ## [Unable to use after first install](https://discuss.elastic.co/t/unable-to-use-after-first-install/245115)
**Author:** [@carterdacat](https://discuss.elastic.co/u/carterdacat)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 10:26am UTC](https://discuss.elastic.co/t/unable-to-use-after-first-install/245115 "2020-08-17T10:26:52Z")
Hi! I tried to install Kibana using these steps: wget https://artifacts.elastic.co/downloads/kibana/kibana-5.6.16-linux-x86.tar.gz sha1sum kibana-5.6.16-linux-x86.tar.gz tar -xzf kibana-5.6.16-linux-x86.tar.gz cd kiban… --- ## [How to get aggregation bucket keys in the term query block](https://discuss.elastic.co/t/how-to-get-aggregation-bucket-keys-in-the-term-query-block/245214)
**Author:** [@Shrikanth\_M](https://discuss.elastic.co/u/Shrikanth_M)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 10:14am UTC](https://discuss.elastic.co/t/how-to-get-aggregation-bucket-keys-in-the-term-query-block/245214 "2020-08-17T10:14:47Z")
How to get aggregation bucket keys in the term query block in the same query? Query { "size": 0, "query": {....}, "aggs": { "customerId": { "composite": { "sources": \[ { "customerId": {… --- ## [Kibana upgrade from 6.6.1 to 7.8.0 fails with resource already exists exception](https://discuss.elastic.co/t/kibana-upgrade-from-6-6-1-to-7-8-0-fails-with-resource-already-exists-exception/245158)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 10:15am UTC](https://discuss.elastic.co/t/kibana-upgrade-from-6-6-1-to-7-8-0-fails-with-resource-already-exists-exception/245158 "2020-08-17T10:15:24Z")
Hi, I am upgrading ELK stack from 6.6.1 to 7.8.0(oss) in kubernetes environment. Elasticsearch upgrade works fine, but new kibana pod fails with this error - {"type":"log","@timestamp":"2020-08-16T18:01:43Z","tags":\["… --- ## [Internode communication in ES](https://discuss.elastic.co/t/internode-communication-in-es/245207)
**Author:** [@baidwan007](https://discuss.elastic.co/u/baidwan007)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 10:05am UTC](https://discuss.elastic.co/t/internode-communication-in-es/245207 "2020-08-17T10:05:30Z")
Is there any type of authentication that is required for ES nodes to communicate with each other? So in the communication between master nodes and data nodes is there any auth happening without which they wont be able t… --- ## [Yaxis data value loses precision in timelion when using percent as units with tickDecimals](https://discuss.elastic.co/t/yaxis-data-value-loses-precision-in-timelion-when-using-percent-as-units-with-tickdecimals/244281)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 10:00am UTC](https://discuss.elastic.co/t/yaxis-data-value-loses-precision-in-timelion-when-using-percent-as-units-with-tickdecimals/244281 "2020-08-17T10:00:55Z")
Kibana Version \[ywatanabe@fedora-desktop ~\]$ docker ps | awk '{ print $2;}' ID docker.elastic.co/kibana/kibana:7.8.0 docker.elastic.co/elasticsearch/elasticsearch:7.8.0 What had happened If I calculate numeric value as … --- ## [How to split field value into an array?](https://discuss.elastic.co/t/how-to-split-field-value-into-an-array/245197)
**Author:** [@Robo](https://discuss.elastic.co/u/Robo)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 9:57am UTC](https://discuss.elastic.co/t/how-to-split-field-value-into-an-array/245197 "2020-08-17T09:57:15Z")
Hello, I would like to split a field value into an array of values. Field type is keyword and I would like to separate these values, so we can filter each value separately (e.g. "app1"). example: applname: app1, app2,… --- ## [Delete data in index without deleting the data](https://discuss.elastic.co/t/delete-data-in-index-without-deleting-the-data/245116)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 9:20am UTC](https://discuss.elastic.co/t/delete-data-in-index-without-deleting-the-data/245116 "2020-08-17T09:20:09Z")
Hello, Could you please share me steps on how to delete the index data without deleting the index itself ?? If yes, then is it possible to delete the data based on timeline ? For ex : Currently I have data from the l… --- ## [Acces to elastic cloud for managing deployments with multiple accounts](https://discuss.elastic.co/t/acces-to-elastic-cloud-for-managing-deployments-with-multiple-accounts/245204)
**Author:** [@ErwinEnableU](https://discuss.elastic.co/u/ErwinEnableU)\ **Replies:** 4\ **Last updated:** [August 17, 2020, 9:20am UTC](https://discuss.elastic.co/t/acces-to-elastic-cloud-for-managing-deployments-with-multiple-accounts/245204 "2020-08-17T09:20:00Z")
Dear community, Right now we have 2 cloud environments at Elastic (T and P). To manage these deployments we can now only have one account to login and manage these deployments. Is it possible to create more accounts wit… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1861) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1863)