# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1864 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1865 --- ## [CompositeAggregation pagination's consistent behavior during indexing being frequently update period](https://discuss.elastic.co/t/compositeaggregation-paginations-consistent-behavior-during-indexing-being-frequently-update-period/245155)
**Author:** [@slodevppw](https://discuss.elastic.co/u/slodevppw)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 4:01pm UTC](https://discuss.elastic.co/t/compositeaggregation-paginations-consistent-behavior-during-indexing-being-frequently-update-period/245155 "2020-08-16T16:01:58Z")
We recently use ES CompositeAggregation to generate a report, which requires sorting and the result (can up-to 1M records sometime) is large which requires pagination. However, duplicated records have been identified (… --- ## [java.io.IOException: listener timeout after waiting for \[90000\] ms](https://discuss.elastic.co/t/java-io-ioexception-listener-timeout-after-waiting-for-90000-ms/245153)
**Author:** [@itaydvir](https://discuss.elastic.co/u/itaydvir)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 3:50pm UTC](https://discuss.elastic.co/t/java-io-ioexception-listener-timeout-after-waiting-for-90000-ms/245153 "2020-08-16T15:50:20Z")
Hello, I've upgraded to version 6.8 and using java RestHighLevelClient. Cluster is behind SearchGuard plugin and usually everything is working well. Sometimes (I assume when there are some network issues) i'm getting … --- ## [Logstash S3 Input Plugin Error](https://discuss.elastic.co/t/logstash-s3-input-plugin-error/245104)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 14\ **Last updated:** [August 16, 2020, 3:19pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-error/245104 "2020-08-16T15:19:56Z")
Hi All, I am using S3 plugin to ingest logs from Oracle Cloud Infrastructure bucket. They have advised that the S3 plugin is what can be used. So I have now configured the input config as: input { s3 { bucket =\> … --- ## [Fortinet log reading error in filebeat fortinet module v7.8.1](https://discuss.elastic.co/t/fortinet-log-reading-error-in-filebeat-fortinet-module-v7-8-1/245149)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 3:18pm UTC](https://discuss.elastic.co/t/fortinet-log-reading-error-in-filebeat-fortinet-module-v7-8-1/245149 "2020-08-16T15:18:11Z")
i am using filebeat version 7.8.1 i got error saying Provided Grok expressions do not match field value: \[date=2020-04-23 time=12:17:45 devname=\\"testswitch1\\" devid=\\"somerouterid\\" logid=\\"0317013312\\" type=\\"utm\\" s… --- ## [Canvas timelion multiple lines](https://discuss.elastic.co/t/canvas-timelion-multiple-lines/241473)
**Author:** [@Hugo\_Pires](https://discuss.elastic.co/u/Hugo_Pires)\ **Replies:** 4\ **Last updated:** [August 16, 2020, 2:07pm UTC](https://discuss.elastic.co/t/canvas-timelion-multiple-lines/241473 "2020-08-16T14:07:45Z")
Hello I am trying to use timelion on a canvas line chart, but when I use multiple lines like: .es(index=ict\*,timefield=time\_start\_ts, metric='count'), .es(index=ict\*,timefield=time\_start\_ts, metric='count', offset=-1d)… --- ## [Filter on distinct count on aggregation result](https://discuss.elastic.co/t/filter-on-distinct-count-on-aggregation-result/245144)
**Author:** [@Bharat\_Data](https://discuss.elastic.co/u/Bharat_Data)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 1:16pm UTC](https://discuss.elastic.co/t/filter-on-distinct-count-on-aggregation-result/245144 "2020-08-16T13:16:20Z")
I have a use case in which I want to filter the results which have the more than one distinct value. For example :- Query - Returns all the distinct models under each different category { "aggs": { "distinct\_cat… --- ## [Search for value NOT equal to something](https://discuss.elastic.co/t/search-for-value-not-equal-to-something/245132)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 12:22pm UTC](https://discuss.elastic.co/t/search-for-value-not-equal-to-something/245132 "2020-08-16T12:22:08Z")
In kibana, I want to see all results are the value of auditd.data.tty is NOT equal to (none). Is it possible to do such a query? Thanks ahead! --- ## [Modify filebeat module](https://discuss.elastic.co/t/modify-filebeat-module/245134)
**Author:** [@bornatalebi](https://discuss.elastic.co/u/bornatalebi)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 10:51am UTC](https://discuss.elastic.co/t/modify-filebeat-module/245134 "2020-08-16T10:51:44Z")
Hi Is there an option to edit what kind of logs a module sends? for example i want winlogbeat not to send authentication failure events. should i use processors? --- ## [How to transfer log files from log collector(client side) to gateway collector(server side) using logstash](https://discuss.elastic.co/t/how-to-transfer-log-files-from-log-collector-client-side-to-gateway-collector-server-side-using-logstash/245131)
**Author:** [@Gunda\_Someswararao](https://discuss.elastic.co/u/Gunda_Someswararao)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 10:22am UTC](https://discuss.elastic.co/t/how-to-transfer-log-files-from-log-collector-client-side-to-gateway-collector-server-side-using-logstash/245131 "2020-08-16T10:22:07Z")
How to transfer log files from log collector(client side) to gateway collector(server side) using logstash. I am new in ES. please help me, and give some reference links for learning. Thank you. --- ## [Autocomplete for terms aggregations](https://discuss.elastic.co/t/autocomplete-for-terms-aggregations/244914)
**Author:** [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\ **Replies:** 4\ **Last updated:** [August 16, 2020, 10:02am UTC](https://discuss.elastic.co/t/autocomplete-for-terms-aggregations/244914 "2020-08-16T10:02:28Z")
Hi, There is a search-as-you-type fields since 7.x but is it possible to get similar results for filtered aggregations for autocomplete? Example you have documents with categories on it: holiday vacation images Ther… --- ## [Cannot search JSON logs in Kibana](https://discuss.elastic.co/t/cannot-search-json-logs-in-kibana/244855)
**Author:** [@bc\_andrew](https://discuss.elastic.co/u/bc_andrew)\ **Replies:** 9\ **Last updated:** [August 16, 2020, 9:24am UTC](https://discuss.elastic.co/t/cannot-search-json-logs-in-kibana/244855 "2020-08-16T09:24:15Z")
Hi. I'm sending custom JSON logs to ES/Kibana v 7.8.1 using filebeat. My filebeat config is: cloud.auth: \ cloud.id: \ filebeat.inputs: - enabled: true json.add\_error\_key… --- ## [How to publish elasticsearch to remote maven repository](https://discuss.elastic.co/t/how-to-publish-elasticsearch-to-remote-maven-repository/245128)
**Author:** [@calm4wei](https://discuss.elastic.co/u/calm4wei)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 8:53am UTC](https://discuss.elastic.co/t/how-to-publish-elasticsearch-to-remote-maven-repository/245128 "2020-08-16T08:53:17Z")
Recently, I made some changes to the elasticsearch source code, and plans to push it to the company's maven repository. The maven repository address has been modified to the company's maven address, but Using gradle publ… --- ## [Why is this logstah filter not working as intended?](https://discuss.elastic.co/t/why-is-this-logstah-filter-not-working-as-intended/244874)
**Author:** [@drjosephliu](https://discuss.elastic.co/u/drjosephliu)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 8:06am UTC](https://discuss.elastic.co/t/why-is-this-logstah-filter-not-working-as-intended/244874 "2020-08-16T08:06:25Z")
Sorry if this is too related to my previous post, but here goes: I have two types of messages that I want to send to logstash. One is a "standard" log type message and the other is a JSON object. I only want the message… --- ## [Grok parse failure](https://discuss.elastic.co/t/grok-parse-failure/245124)
**Author:** [@jclemons7](https://discuss.elastic.co/u/jclemons7)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 8:00am UTC](https://discuss.elastic.co/t/grok-parse-failure/245124 "2020-08-16T08:00:59Z")
Hello, I have the following log from snort (from PFSense) roku \[classification: misc activity\] \[priority: 3\] {tcp} 10.0.2.11:37183 -\> 151.101.65.190:80 I've created the following GROK pattern, which works fine in the … --- ## [Named queries confusion](https://discuss.elastic.co/t/named-queries-confusion/245122)
**Author:** [@liamwhite1](https://discuss.elastic.co/u/liamwhite1)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 6:31am UTC](https://discuss.elastic.co/t/named-queries-confusion/245122 "2020-08-16T06:31:33Z")
After reading the documentation for named queries, and attempting to perform some myself, I am thoroughly confused on how to name queries. This doesn't work: { "term": { "tag\_id": 1, "\_name": "test"… --- ## [Logstash is not starting](https://discuss.elastic.co/t/logstash-is-not-starting/245082)
**Author:** [@H158880](https://discuss.elastic.co/u/H158880)\ **Replies:** 8\ **Last updated:** [August 16, 2020, 4:00am UTC](https://discuss.elastic.co/t/logstash-is-not-starting/245082 "2020-08-16T04:00:07Z")
I am trying to initiate logstash how ever getting below error. Can this forum help? C:\\Users\\h158880\\Documents\\lib\\logstash-7.8.1\\bin\>logstash -f apache\_logsatsh.conf Java HotSpot(TM) 64-Bit Server VM warning: Ignoring… --- ## [Kibana Discover problem, Two sources of data, one index](https://discuss.elastic.co/t/kibana-discover-problem-two-sources-of-data-one-index/245113)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 3:44am UTC](https://discuss.elastic.co/t/kibana-discover-problem-two-sources-of-data-one-index/245113 "2020-08-16T03:44:52Z")
I create an index with data comming from a Database (network events) and data from UDP port (syslogs events), this logs have different numbers of fields and diferent names, but four in common (same name): timestamp, mess… --- ## [Elasticsearch real time data sync with sql server](https://discuss.elastic.co/t/elasticsearch-real-time-data-sync-with-sql-server/244760)
**Author:** [@Coder\_Cub](https://discuss.elastic.co/u/Coder_Cub)\ **Replies:** 8\ **Last updated:** [August 16, 2020, 3:05am UTC](https://discuss.elastic.co/t/elasticsearch-real-time-data-sync-with-sql-server/244760 "2020-08-16T03:05:21Z")
I am new to Elastic Search and I am trying to figure it out below scenarios How/which tool to sync/insert data into Elastic search when new record is created in SQL Server?(Near Real time) How to transformation for leg… --- ## [Kibana : Error SavedObject view: { \[Error\] res: {}, body: null } when modifying the vistate section of a saved object](https://discuss.elastic.co/t/kibana-error-savedobject-view-error-res-body-null-when-modifying-the-vistate-section-of-a-saved-object/244762)
**Author:** [@Selim\_Sliman](https://discuss.elastic.co/u/Selim_Sliman)\ **Replies:** 6\ **Last updated:** [August 16, 2020, 2:21am UTC](https://discuss.elastic.co/t/kibana-error-savedobject-view-error-res-body-null-when-modifying-the-vistate-section-of-a-saved-object/244762 "2020-08-16T02:21:00Z")
Hello team, I am encountering an issue when trying to modify the json in the vistate section of a saved object, i encounter the following error : SavedObject view: { \[Error\] res: {}, body: null } So what i'm trying to … --- ## [Elasticsearch nodes not used for search](https://discuss.elastic.co/t/elasticsearch-nodes-not-used-for-search/245066)
**Author:** [@kidrik](https://discuss.elastic.co/u/kidrik)\ **Replies:** 7\ **Last updated:** [August 15, 2020, 9:06pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-not-used-for-search/245066 "2020-08-15T21:06:42Z")
We have an Elasticsearch 7.1 cluster (AWS) with 2 indexes. The parent index has one shard and two replicas, whereas the child index has 3 shards and 2 replicas. Right now we’re running on 8 data nodes and the shard all… --- ## [Querying dense\_vector from the High Level REST Java API](https://discuss.elastic.co/t/querying-dense-vector-from-the-high-level-rest-java-api/244956)
**Author:** [@MJB](https://discuss.elastic.co/u/MJB)\ **Replies:** 4\ **Last updated:** [August 15, 2020, 8:26pm UTC](https://discuss.elastic.co/t/querying-dense-vector-from-the-high-level-rest-java-api/244956 "2020-08-15T20:26:27Z")
All the examples I can find for querying dense vector mention script queries, eg. https://discuss.elastic.co/t/searching-with-dense-vector/213374 However, I have no idea on how to use those with the HL API. Is this pos… --- ## [Watcher results returning similar terms instead of specific one while using match query](https://discuss.elastic.co/t/watcher-results-returning-similar-terms-instead-of-specific-one-while-using-match-query/245005)
**Author:** [@suryanaj](https://discuss.elastic.co/u/suryanaj)\ **Replies:** 1\ **Last updated:** [August 15, 2020, 8:17pm UTC](https://discuss.elastic.co/t/watcher-results-returning-similar-terms-instead-of-specific-one-while-using-match-query/245005 "2020-08-15T20:17:38Z")
my watcher alert query is not returning the exact match of url it returns all similar search of http.url keyword. i am using 6.8.3. I want exact match or search of http.url. Please suggest . { "trigger": { "schedule"… --- ## [Master Node election not working](https://discuss.elastic.co/t/master-node-election-not-working/245097)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 2\ **Last updated:** [August 15, 2020, 7:19pm UTC](https://discuss.elastic.co/t/master-node-election-not-working/245097 "2020-08-15T19:19:15Z")
Hi Team, We are running a POC on elastic search. We have three nodes Node 1: node.master: true node.data: true node.ingest: true node.ml: false cluster.initial\_master\_nodes: \["ibs-dc-siem-1", "ibs-dc-siem-backup"\] … --- ## [Help with aggregation query to calculate relative volume](https://discuss.elastic.co/t/help-with-aggregation-query-to-calculate-relative-volume/245103)
**Author:** [@JGor](https://discuss.elastic.co/u/JGor)\ **Replies:** 0\ **Last updated:** [August 15, 2020, 5:55pm UTC](https://discuss.elastic.co/t/help-with-aggregation-query-to-calculate-relative-volume/245103 "2020-08-15T17:55:31Z")
Relative Volume (often times called RVOL) is an indicator that tells traders how current trading volume is compared to past trading volume over a given period. Hello guys, I was wondering if someone can point me… --- ## [Jira-Elasticsearch Integration for Watcher](https://discuss.elastic.co/t/jira-elasticsearch-integration-for-watcher/244850)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 2\ **Last updated:** [August 15, 2020, 2:55pm UTC](https://discuss.elastic.co/t/jira-elasticsearch-integration-for-watcher/244850 "2020-08-15T14:55:36Z")
Hello Team, I am trying to Integrate Elastic Watcher With Jira Community Version. My Elasticsearch Config is But I am Facing the Error When I am trying to Test the Watcher. Can Someone Help me. Regards Shrikan… --- ## [Regarding Index Sorting](https://discuss.elastic.co/t/regarding-index-sorting/244984)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [August 14, 2020, 4:54pm UTC](https://discuss.elastic.co/t/regarding-index-sorting/244984 "2020-08-14T16:54:39Z")
Hi, When considering index sorting would it be correct to assume the following cost/benefits: Pros: faster searching for standard queries Better index compression Cons: Significantly reduced indexing throughput, s… --- ## [Developing a Logstash plugin within Docker](https://discuss.elastic.co/t/developing-a-logstash-plugin-within-docker/245093)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 0\ **Last updated:** [August 15, 2020, 10:32am UTC](https://discuss.elastic.co/t/developing-a-logstash-plugin-within-docker/245093 "2020-08-15T10:32:44Z")
Hi, I'm more of a Python and C developer than a Ruby a Java developer, but I have a need to make my first real logstash plugin for some work I'm doing with Elastic. My development environment is Windows 10 Enterprise wi… --- ## [Does EdgeNGram autocomplete\_filter make sense with prefix search?](https://discuss.elastic.co/t/does-edgengram-autocomplete-filter-make-sense-with-prefix-search/245086)
**Author:** [@AleksandarT](https://discuss.elastic.co/u/AleksandarT)\ **Replies:** 0\ **Last updated:** [August 15, 2020, 9:22am UTC](https://discuss.elastic.co/t/does-edgengram-autocomplete-filter-make-sense-with-prefix-search/245086 "2020-08-15T09:22:44Z")
i have Elastic Search Index with around 1 million records. I want to do multi prefix search against 2 fields in the Elastic Search Index, Name and ID (there are around 10 total). Does creating EdgeNGram autocomplete fi… --- ## [Logstash monitoring warning](https://discuss.elastic.co/t/logstash-monitoring-warning/244835)
**Author:** [@gsk](https://discuss.elastic.co/u/gsk)\ **Replies:** 1\ **Last updated:** [August 15, 2020, 9:04am UTC](https://discuss.elastic.co/t/logstash-monitoring-warning/244835 "2020-08-15T09:04:06Z")
Hi all, I have a cluster of three master-eligible nodes, which are also data nodes, and one coordinating node which also runs a kibana instance. There's also a pipeline node. It's about 7.8.0 version. All the cluster c… --- ## [Data node using different cluster id](https://discuss.elastic.co/t/data-node-using-different-cluster-id/244991)
**Author:** [@Shambu\_Pujar](https://discuss.elastic.co/u/Shambu_Pujar)\ **Replies:** 5\ **Last updated:** [August 15, 2020, 8:24am UTC](https://discuss.elastic.co/t/data-node-using-different-cluster-id/244991 "2020-08-15T08:24:42Z")
Hi For some of the maintenance exercise, I had to bring down the master. In that process, I made data node as master as well. Now with new master, I am not able to get data node join master Data node throws following … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1863) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1865)