# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1868 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1869 --- ## [Monitoring 7.8 with metricbeat drill down errors](https://discuss.elastic.co/t/monitoring-7-8-with-metricbeat-drill-down-errors/244878)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 3\ **Last updated:** [August 13, 2020, 1:46pm UTC](https://discuss.elastic.co/t/monitoring-7-8-with-metricbeat-drill-down-errors/244878 "2020-08-13T13:46:57Z")
Nodes and pipelines show up in monitoring but getting thie error trying to drill down on pipeline: {"statusCode":404,"error":"Not Found","message":"Not Found"} Pipeline is: \[beats\](https://35.245.148.101:5601/logstash/… --- ## [Elasticsearch 7.4.2 Snapshot and restore](https://discuss.elastic.co/t/elasticsearch-7-4-2-snapshot-and-restore/243928)
**Author:** [@Sanjay1](https://discuss.elastic.co/u/Sanjay1)\ **Replies:** 4\ **Last updated:** [August 13, 2020, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-7-4-2-snapshot-and-restore/243928 "2020-08-13T13:42:14Z")
I am using Elasticsearch 7.4.2 and some clarification and help on snapshot and restore. There is nothing like full snapshot or partial snapshot. Each snapshot is a complete snapshot. As I know each snapshot is incremen… --- ## [Two node cluster with all primary shards in Node 1 and all replica shards in Node 2](https://discuss.elastic.co/t/two-node-cluster-with-all-primary-shards-in-node-1-and-all-replica-shards-in-node-2/244742)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 7\ **Last updated:** [August 13, 2020, 1:29pm UTC](https://discuss.elastic.co/t/two-node-cluster-with-all-primary-shards-in-node-1-and-all-replica-shards-in-node-2/244742 "2020-08-13T13:29:32Z")
Dear all, I have an Elasticsearch cluster composed by two nodes: master node and data node. When I join the second node to the cluster, after some hours, the cluster health becomes green but I can see that all primary s… --- ## [Matching numbers found inside product MPNs](https://discuss.elastic.co/t/matching-numbers-found-inside-product-mpns/244787)
**Author:** [@droplet](https://discuss.elastic.co/u/droplet)\ **Replies:** 1\ **Last updated:** [August 13, 2020, 1:27pm UTC](https://discuss.elastic.co/t/matching-numbers-found-inside-product-mpns/244787 "2020-08-13T13:27:16Z")
Linux | ES 7.7 |PHP+Laravel6+Scout So I should start by explaining what an MPN is just in case you don't know. It is simply an abbreviation of Model Part Number and most products on the planet have it. Others have EAN, … --- ## [Logstash-input-s3 cannot back up with an S3 key that contains characters that need to be URL-encoded](https://discuss.elastic.co/t/logstash-input-s3-cannot-back-up-with-an-s3-key-that-contains-characters-that-need-to-be-url-encoded/244882)
**Author:** [@fukasawah](https://discuss.elastic.co/u/fukasawah)\ **Replies:** 0\ **Last updated:** [August 13, 2020, 12:52pm UTC](https://discuss.elastic.co/t/logstash-input-s3-cannot-back-up-with-an-s3-key-that-contains-characters-that-need-to-be-url-encoded/244882 "2020-08-13T12:52:43Z")
Hello. Regarding the title, Is there any way to fix it? I suspect it's a bug in the plugin. Version: logstash-input-s3-3.5.0 Operating System: Windows Server 2016 Config File: input { s3 { bucket =\> "fukasawah… --- ## [Java RestHighLevelClient UpdateByQuery with Task Response](https://discuss.elastic.co/t/java-resthighlevelclient-updatebyquery-with-task-response/244870)
**Author:** [@Leynch](https://discuss.elastic.co/u/Leynch)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 12:33pm UTC](https://discuss.elastic.co/t/java-resthighlevelclient-updatebyquery-with-task-response/244870 "2020-08-13T12:33:53Z")
The updateByQuery API of elasticsearch has the possibility to get a task response if the parameter wait\_for\_completion is set to false (https://www.elastic.co/guide/en/elasticsearch/reference/7.8/docs-update-by-query.htm… --- ## [Sort on multiple fields with different weighted criteria](https://discuss.elastic.co/t/sort-on-multiple-fields-with-different-weighted-criteria/244147)
**Author:** [@neeraj142](https://discuss.elastic.co/u/neeraj142)\ **Replies:** 0\ **Last updated:** [August 7, 2020, 9:43am UTC](https://discuss.elastic.co/t/sort-on-multiple-fields-with-different-weighted-criteria/244147 "2020-08-07T09:43:31Z")
as i am doing shorting on multiple fields { followersCount: { order: 'desc' } }, { averageRating: 'desc' }, { \_geo\_distance: { coordinates: \[lng, lat\], order: "asc", unit: "km", distance\_type: "arc", ignore\_un… --- ## [Unable to join nodes to cluster](https://discuss.elastic.co/t/unable-to-join-nodes-to-cluster/244832)
**Author:** [@john7](https://discuss.elastic.co/u/john7)\ **Replies:** 5\ **Last updated:** [August 13, 2020, 12:24pm UTC](https://discuss.elastic.co/t/unable-to-join-nodes-to-cluster/244832 "2020-08-13T12:24:55Z")
I'm trying to setup a cluster of 3 elastic nodes. 1 master and two data nodes. I'm able to start all 3 of them yet they seem to setup there own cluster instead of joining together. Node 1 (the master) 192.168.56.114 … --- ## [Querying slow on kibana after re installation of docker](https://discuss.elastic.co/t/querying-slow-on-kibana-after-re-installation-of-docker/242693)
**Author:** [@twright8](https://discuss.elastic.co/u/twright8)\ **Replies:** 12\ **Last updated:** [August 13, 2020, 12:24pm UTC](https://discuss.elastic.co/t/querying-slow-on-kibana-after-re-installation-of-docker/242693 "2020-08-13T12:24:15Z")
Hi All, After doing a clean reinstall of my ELK stack, querying the same reindexed data takes much longer, it now with saved queries that would be a few seconds previously now pop up with this: Your query is taking awh… --- ## [User docker to build elasticsearch cluster on multi-machine](https://discuss.elastic.co/t/user-docker-to-build-elasticsearch-cluster-on-multi-machine/244845)
**Author:** [@W1nter-3Z](https://discuss.elastic.co/u/W1nter-3Z)\ **Replies:** 9\ **Last updated:** [August 13, 2020, 12:19pm UTC](https://discuss.elastic.co/t/user-docker-to-build-elasticsearch-cluster-on-multi-machine/244845 "2020-08-13T12:19:00Z")
Machine A runs 3 es nodes , Machine B adds a new data nodes it faield when joining the cluster on A machine A es master node settings: cluster.name: es-cluster node.name: es-master node.master: tru… --- ## [Autocomplete Query](https://discuss.elastic.co/t/autocomplete-query/244875)
**Author:** [@chivas](https://discuss.elastic.co/u/chivas)\ **Replies:** 0\ **Last updated:** [August 13, 2020, 12:18pm UTC](https://discuss.elastic.co/t/autocomplete-query/244875 "2020-08-13T12:18:37Z")
Hi, I have currently implemented autocomplete feature by using search\_as\_you\_type datatype, I use the copy\_to parameter to copy vaules from multiple fields into a new field. e.g. values in name, address, designation fi… --- ## [Scripted Field](https://discuss.elastic.co/t/scripted-field/244171)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 3\ **Last updated:** [August 13, 2020, 12:00pm UTC](https://discuss.elastic.co/t/scripted-field/244171 "2020-08-13T12:00:15Z")
Hi, i use kibana 7.7.0 i create a scripted field (name: ADR) , then i create a line visualization , whose x-axis date and y-axis the avg of (ADR). the problem is whene i add this visualization in the my dashboard i … --- ## [TSVB Top Hit issue](https://discuss.elastic.co/t/tsvb-top-hit-issue/244482)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 11:55am UTC](https://discuss.elastic.co/t/tsvb-top-hit-issue/244482 "2020-08-13T11:55:44Z")
I have a simple dataset in elastic that logs a timestamp and code field from a web service, the value of code is always 0,1,2 or 3 and changes frequently so I am polling it with logstash every 10 secs. I am trying to ma… --- ## [Tuning SSD Performance](https://discuss.elastic.co/t/tuning-ssd-performance/244557)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [August 13, 2020, 11:16am UTC](https://discuss.elastic.co/t/tuning-ssd-performance/244557 "2020-08-13T11:16:01Z")
Hi, Is there an aggregated, and detailed, source of information regarding optimising nvme ssd config for indexing heavy use cases with elasticsearch? Thx D --- ## [Error message when creating a custom beat](https://discuss.elastic.co/t/error-message-when-creating-a-custom-beat/244868)
**Author:** [@grobd](https://discuss.elastic.co/u/grobd)\ **Replies:** 0\ **Last updated:** [August 13, 2020, 11:19am UTC](https://discuss.elastic.co/t/error-message-when-creating-a-custom-beat/244868 "2020-08-13T11:19:09Z")
Hi, i just wanted to create a new community beat by sending the number of open files to Elasticsearch using the command lsof | wc -l. I have also checked the documentation in the beats section and followed it very caref… --- ## [Filter ratio in TSVB](https://discuss.elastic.co/t/filter-ratio-in-tsvb/244842)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 4\ **Last updated:** [August 13, 2020, 11:17am UTC](https://discuss.elastic.co/t/filter-ratio-in-tsvb/244842 "2020-08-13T11:17:09Z")
Hi , i use kibana 7.7.0 i want to calculate the occupancy rate in hotels: i have 5 documents in my index: occupancy rate % = (sum of soldrooms)/ (sum of available rooms) first : i create two scripted fields "sold-ro… --- ## [Kibana split series bucket filter issue, shows duplicated data](https://discuss.elastic.co/t/kibana-split-series-bucket-filter-issue-shows-duplicated-data/241834)
**Author:** [@coachbjork](https://discuss.elastic.co/u/coachbjork)\ **Replies:** 1\ **Last updated:** [August 13, 2020, 11:16am UTC](https://discuss.elastic.co/t/kibana-split-series-bucket-filter-issue-shows-duplicated-data/241834 "2020-08-13T11:16:38Z")
Current situation I'm using timestamps on the x-axis, I'm using amount of actions on Y-axis, I'm adding a split series bucket with specific filters. I do this to add specific users and to be able to group together mu… --- ## [FileBeat updatable log](https://discuss.elastic.co/t/filebeat-updatable-log/243565)
**Author:** [@vdmitrief](https://discuss.elastic.co/u/vdmitrief)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 11:15am UTC](https://discuss.elastic.co/t/filebeat-updatable-log/243565 "2020-08-13T11:15:28Z")
Need help configuring filebit ... One of my applications writes rotated logs to a file with a specified number of lines. If the file contains only 3 lines, then the log at the first moment of time will look like this: … --- ## [Segregating elasticsearch search results](https://discuss.elastic.co/t/segregating-elasticsearch-search-results/244865)
**Author:** [@Abhishek\_Chauhan](https://discuss.elastic.co/u/Abhishek_Chauhan)\ **Replies:** 0\ **Last updated:** [August 13, 2020, 11:12am UTC](https://discuss.elastic.co/t/segregating-elasticsearch-search-results/244865 "2020-08-13T11:12:42Z")
Hello all, I have the following query:- i have five indexes in my ES cluster and i want to search for a term in all the indexes. As we already know that by default, ES returns 10 documents that match the term.So all th… --- ## [Calculate disk usage](https://discuss.elastic.co/t/calculate-disk-usage/244571)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 11\ **Last updated:** [August 13, 2020, 11:11am UTC](https://discuss.elastic.co/t/calculate-disk-usage/244571 "2020-08-13T11:11:40Z")
I've deployed a test cluster that feeds from about 5 servers. I was asked to spec out the disk requirement once 50 servers would feed it logs with ILM setup (ILM should delete logs older than 3 month or 1 year - haven't… --- ## [Exact phrase search](https://discuss.elastic.co/t/exact-phrase-search/244765)
**Author:** [@AmitaS](https://discuss.elastic.co/u/AmitaS)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 11:10am UTC](https://discuss.elastic.co/t/exact-phrase-search/244765 "2020-08-13T11:10:26Z")
HI, I am new to elastic search.i wanted to know how to query for exact search. Example if am searching for "charlie" and i have "charlie chaplin" ,"charlie walter","charlie","charlie123" i am expecting result only "… --- ## [Beats: install dashboard in custom Space](https://discuss.elastic.co/t/beats-install-dashboard-in-custom-space/244524)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 7\ **Last updated:** [August 13, 2020, 11:04am UTC](https://discuss.elastic.co/t/beats-install-dashboard-in-custom-space/244524 "2020-08-13T11:04:00Z")
Hi there, I want to install from the command line kibana dashboards into custom Spaces. The installation in Ubuntu into the default space it works like this: ./metricbeat -c /etc/metricbeat/metricbeat.yml setup -E set… --- ## [Index lifecycle error: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[filebeat\] does not point to index \[filebeat-7.8.1-2020.08.12-000001\]](https://discuss.elastic.co/t/index-lifecycle-error-illegal-argument-exception-index-lifecycle-rollover-alias-filebeat-does-not-point-to-index-filebeat-7-8-1-2020-08-12-000001/244864)
**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\ **Replies:** 0\ **Last updated:** [August 13, 2020, 11:00am UTC](https://discuss.elastic.co/t/index-lifecycle-error-illegal-argument-exception-index-lifecycle-rollover-alias-filebeat-does-not-point-to-index-filebeat-7-8-1-2020-08-12-000001/244864 "2020-08-13T11:00:07Z")
Hi, currently I have this error: Index lifecycle error illegal\_argument\_exception: index.lifecycle.rollover\_alias \[filebeat\] does not point to index \[filebeat-7.8.1-2020.08.12-000001\] ILM infos $ curl -X GET "localh… --- ## [Monitoring Palo alto networks firewalls with ELK](https://discuss.elastic.co/t/monitoring-palo-alto-networks-firewalls-with-elk/241804)
**Author:** [@zkhanfur](https://discuss.elastic.co/u/zkhanfur)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 10:50am UTC](https://discuss.elastic.co/t/monitoring-palo-alto-networks-firewalls-with-elk/241804 "2020-08-13T10:50:36Z")
Hi dear community, I have been following a blog to create Dashboards for Palo alto networks firewalls and good progress has been made. The blog post that has been used is We have successfully replicated the dashboa… --- ## [Multiple indexes common field filter in dashboard](https://discuss.elastic.co/t/multiple-indexes-common-field-filter-in-dashboard/244839)
**Author:** [@1862347ba9566e72a47d](https://discuss.elastic.co/u/1862347ba9566e72a47d)\ **Replies:** 1\ **Last updated:** [August 13, 2020, 10:49am UTC](https://discuss.elastic.co/t/multiple-indexes-common-field-filter-in-dashboard/244839 "2020-08-13T10:49:21Z")
There are multiple indexes with one common field. The shared dashboard has several widgets from each index. It is necessary to compose a filter on the dashboard for finding a field so that all widgets work correctly. W… --- ## [Aggregation on Vega-LIte](https://discuss.elastic.co/t/aggregation-on-vega-lite/244826)
**Author:** [@gpolini](https://discuss.elastic.co/u/gpolini)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 10:49am UTC](https://discuss.elastic.co/t/aggregation-on-vega-lite/244826 "2020-08-13T10:49:09Z")
Hi I'm trying to build an histogram chart with aggregations by vega-lite. The aggregation is: "aggs": { "gate": { "terms": { "field": "host.abbr.keyword", "order": { "dcam": "desc" }, … --- ## [Rotated log files have incorrect permissions](https://discuss.elastic.co/t/rotated-log-files-have-incorrect-permissions/244623)
**Author:** [@drjan](https://discuss.elastic.co/u/drjan)\ **Replies:** 3\ **Last updated:** [August 13, 2020, 10:40am UTC](https://discuss.elastic.co/t/rotated-log-files-have-incorrect-permissions/244623 "2020-08-13T10:40:01Z")
When log files are rotated by metricbeat, the files created do not have the permissions specified in the metricbeat.yml file. Here's part of metricbeat.yml: logging.to\_files: true logging.files: path: /var/log/metric… --- ## [How to create a multi field mapping for a geo\_shape / text field?](https://discuss.elastic.co/t/how-to-create-a-multi-field-mapping-for-a-geo-shape-text-field/244559)
**Author:** [@zachsa](https://discuss.elastic.co/u/zachsa)\ **Replies:** 4\ **Last updated:** [August 13, 2020, 10:39am UTC](https://discuss.elastic.co/t/how-to-create-a-multi-field-mapping-for-a-geo-shape-text-field/244559 "2020-08-13T10:39:24Z")
I saw this thread - https://discuss.elastic.co/t/cant-create-geo-shape-multi-field/19034. It looks like it's not possible to create a multi field that includes the type 'geo\_shape' and 'keyword'? In my particular case I… --- ## [Logstash to Azure Log Analytics issue](https://discuss.elastic.co/t/logstash-to-azure-log-analytics-issue/244853)
**Author:** [@accts324](https://discuss.elastic.co/u/accts324)\ **Replies:** 0\ **Last updated:** [August 13, 2020, 10:22am UTC](https://discuss.elastic.co/t/logstash-to-azure-log-analytics-issue/244853 "2020-08-13T10:22:15Z")
We are using the module on our testing environment and it has been added to our logstash.conf. The problem we are facing now is with the elasticsearch module. The logs are now going properly to Log Analytics but does not… --- ## [Group by the incoming records and return a list of records with specific event occurred](https://discuss.elastic.co/t/group-by-the-incoming-records-and-return-a-list-of-records-with-specific-event-occurred/242385)
**Author:** [@nisargtest1](https://discuss.elastic.co/u/nisargtest1)\ **Replies:** 1\ **Last updated:** [August 13, 2020, 10:21am UTC](https://discuss.elastic.co/t/group-by-the-incoming-records-and-return-a-list-of-records-with-specific-event-occurred/242385 "2020-08-13T10:21:56Z")
There is one field called "identity\_number" and I am taking 30 days data as input and I need to make a list of group having same identity\_number and then in each group, I need compare the price of most recent identy\_num… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1867) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1869)