# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1892 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1893 --- ## [Avg Aggregation Histogram fields](https://discuss.elastic.co/t/avg-aggregation-histogram-fields/243333)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 9:51am UTC](https://discuss.elastic.co/t/avg-aggregation-histogram-fields/243333 "2020-08-03T09:51:18Z")
Hi I'm working on Elasticsearch since 2015 . Today when I'm going through the documentation I found some interesting stuff i.e PUT metrics\_index/\_doc/1 { "network.name" : "net-1", "latency\_histo" : { "values" : \[0.… --- ## [BST conversion on Kibana Visualization](https://discuss.elastic.co/t/bst-conversion-on-kibana-visualization/239840)
**Author:** [@Landong.Zuo](https://discuss.elastic.co/u/Landong.Zuo)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 9:49am UTC](https://discuss.elastic.co/t/bst-conversion-on-kibana-visualization/239840 "2020-08-03T09:49:11Z")
Hello, I installed ELK V7.6.1 on an AWS Linux 2 EC2. When I ran a Data Histogram Aggregation in Kibana visualization with a time filter crossing over UTC and BST, e.g. from 2020-03-01T00:00:00.000 to 2020-04-01T00:00:0… --- ## [Logstash on Docker using JDBC input plugin does not fetch all rows from SQL Server](https://discuss.elastic.co/t/logstash-on-docker-using-jdbc-input-plugin-does-not-fetch-all-rows-from-sql-server/243483)
**Author:** [@webstruck](https://discuss.elastic.co/u/webstruck)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 9:44am UTC](https://discuss.elastic.co/t/logstash-on-docker-using-jdbc-input-plugin-does-not-fetch-all-rows-from-sql-server/243483 "2020-08-03T09:44:59Z")
I'm trying to index data into Elasticsearch 7.8.0 from SQL Server through Logstash 7.8.0. All works well when I use non docker version of Logstash. I have more than 6 million rows I need to fetch and the count matches e… --- ## [Using environment variables in elasticsearch config file](https://discuss.elastic.co/t/using-environment-variables-in-elasticsearch-config-file/243390)
**Author:** [@cms95](https://discuss.elastic.co/u/cms95)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 9:37am UTC](https://discuss.elastic.co/t/using-environment-variables-in-elasticsearch-config-file/243390 "2020-08-03T09:37:44Z")
Im trying to use environment variables to define network.host. Ive tried ${var}, var, "{var}", etc all with no luck. ive tried doing whats mentioned here too: https://www.elastic.co/guide/en/elasticsearch/reference/curr… --- ## [Search results returned are incomplete](https://discuss.elastic.co/t/search-results-returned-are-incomplete/243519)
**Author:** [@Phil795](https://discuss.elastic.co/u/Phil795)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 9:31am UTC](https://discuss.elastic.co/t/search-results-returned-are-incomplete/243519 "2020-08-03T09:31:18Z")
I use ES7 to search PDF files. When I search something with match\_phrase, I get 2 word occurrences, even though the document has 59 occurrences. What can be the reason for this? How can I optimize the query? { … --- ## [Performance Optimization for Multi-Index Search on Small Data Set](https://discuss.elastic.co/t/performance-optimization-for-multi-index-search-on-small-data-set/243378)
**Author:** [@Piyush\_Gupta](https://discuss.elastic.co/u/Piyush_Gupta)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 6:29am UTC](https://discuss.elastic.co/t/performance-optimization-for-multi-index-search-on-small-data-set/243378 "2020-08-03T06:29:46Z")
We have different document structures/schema that we on-board into different indices. We have ~50 such indices, and one of our primary use cases is to perform search across all these document types i.e. across all 50 ind… --- ## [Creating a raw field mapping searchable by regexes with spaces](https://discuss.elastic.co/t/creating-a-raw-field-mapping-searchable-by-regexes-with-spaces/243117)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 8:59am UTC](https://discuss.elastic.co/t/creating-a-raw-field-mapping-searchable-by-regexes-with-spaces/243117 "2020-08-03T08:59:26Z")
On Elastic 6.6, I'm trying to create an index that supports a regex search when the regex has spaces in it. I see older references to not\_analyzed that no longer apply to modern versions of Elasticsearch. I've tried, f… --- ## [Kibana script field still Loading to save, cannot create and update scripted field index pattern](https://discuss.elastic.co/t/kibana-script-field-still-loading-to-save-cannot-create-and-update-scripted-field-index-pattern/243512)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 8:31am UTC](https://discuss.elastic.co/t/kibana-script-field-still-loading-to-save-cannot-create-and-update-scripted-field-index-pattern/243512 "2020-08-03T08:31:40Z")
Hello all, i am using kibana 7.5 and elastic 7.5. I am trying to update scripted filed in kibana, but when i click save field button it loading and not finished, then i try to create new scripted field but its meet same… --- ## [Documents with date (epoch\_millis) sent in bursts and not in time-increasing order are indexed stragely](https://discuss.elastic.co/t/documents-with-date-epoch-millis-sent-in-bursts-and-not-in-time-increasing-order-are-indexed-stragely/243332)
**Author:** [@mujina93](https://discuss.elastic.co/u/mujina93)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 7:47am UTC](https://discuss.elastic.co/t/documents-with-date-epoch-millis-sent-in-bursts-and-not-in-time-increasing-order-are-indexed-stragely/243332 "2020-08-03T07:47:56Z")
Does elasticsearch expect the date field to be in increasing order? I am sending docs from python using elasticsearch-py. The documents I send are sent in bursts (think sending some documents every random interval, like… --- ## [Data/write/bulk running time way too long. How do you cancel?](https://discuss.elastic.co/t/data-write-bulk-running-time-way-too-long-how-do-you-cancel/243484)
**Author:** [@Dandy](https://discuss.elastic.co/u/Dandy)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 7:21am UTC](https://discuss.elastic.co/t/data-write-bulk-running-time-way-too-long-how-do-you-cancel/243484 "2020-08-03T07:21:45Z")
I have a bunch of odd tasks that are taking up a ton of load on my nodes with no way to cancel them. They definitely seem stuck. All indices are still open, so it's not an issue with the index becoming unavailable. Shard… --- ## [Time taken to execute query fluctuates](https://discuss.elastic.co/t/time-taken-to-execute-query-fluctuates/243359)
**Author:** [@techie\_2020](https://discuss.elastic.co/u/techie_2020)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 7:08am UTC](https://discuss.elastic.co/t/time-taken-to-execute-query-fluctuates/243359 "2020-08-03T07:08:30Z")
I have this query GET \_search { "query": { "bool": { "must" : \[{"match" : {"track\_id" : 4}}\] } } } However the time take fluctuates between… --- ## [All shards failed](https://discuss.elastic.co/t/all-shards-failed/242935)
**Author:** [@Alvaro\_Sanz](https://discuss.elastic.co/u/Alvaro_Sanz)\ **Replies:** 8\ **Last updated:** [August 3, 2020, 6:49am UTC](https://discuss.elastic.co/t/all-shards-failed/242935 "2020-08-03T06:49:13Z")
Hello, I am running elastic Stack (beats -\> logstash -\> elasticsearch -\> kibana). It is a single server (no cluster) that is collecting data from 10 or so servers (auditbeat and filebeat). Today, it stopped working. I … --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/243385)
**Author:** [@ishan.abhinit](https://discuss.elastic.co/u/ishan.abhinit)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 6:42am UTC](https://discuss.elastic.co/t/filebeat-error/243385 "2020-08-03T06:42:44Z")
I am using nginx as a frontend for Kibana. I am trying to load the logs onto kibana using a Filebeat module. This is how Kibana portion of filebeat.yml file looks like # =================================== Kibana =====… --- ## [3 node cluster behind F5 VIP, how to configure?](https://discuss.elastic.co/t/3-node-cluster-behind-f5-vip-how-to-configure/243296)
**Author:** [@wardallen](https://discuss.elastic.co/u/wardallen)\ **Replies:** 4\ **Last updated:** [August 3, 2020, 4:03am UTC](https://discuss.elastic.co/t/3-node-cluster-behind-f5-vip-how-to-configure/243296 "2020-08-03T04:03:15Z")
I have a 3 node cluster, and I'm wondering how to configure the network settings in the nodes now that an F5 VIP has entered the picture. The hosts: node1 - 10.1.1.1 node2 - 10.1.1.2 node3 - 10.1.1.3 The F5 VIP is s… --- ## [Edit logstash.yml but it's not updating](https://discuss.elastic.co/t/edit-logstash-yml-but-its-not-updating/243493)
**Author:** [@evacch](https://discuss.elastic.co/u/evacch)\ **Replies:** 0\ **Last updated:** [August 3, 2020, 3:55am UTC](https://discuss.elastic.co/t/edit-logstash-yml-but-its-not-updating/243493 "2020-08-03T03:55:06Z")
I edited my logstash.yml to make some changes on the pipeline.batch.size to 1000, pipeline.batch.delay to 30 and enable xpack monitoring. After that I restart the Logstash service with the following command: systemctl … --- ## [How to configuring system settings on elasticsearch cloud](https://discuss.elastic.co/t/how-to-configuring-system-settings-on-elasticsearch-cloud/243336)
**Author:** [@chautm](https://discuss.elastic.co/u/chautm)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 2:39am UTC](https://discuss.elastic.co/t/how-to-configuring-system-settings-on-elasticsearch-cloud/243336 "2020-08-03T02:39:04Z")
Hi everybody, I'm try to config system settings on elastic cloud, as bootstrap.memory\_lock by PUT /\_cluster/settings but failed. Anyone know how to configure it? Thanks. --- ## [The node name cannot be resolved using fieldPath: spec.nodeName, is there any solution?](https://discuss.elastic.co/t/the-node-name-cannot-be-resolved-using-fieldpath-spec-nodename-is-there-any-solution/243489)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [August 3, 2020, 2:21am UTC](https://discuss.elastic.co/t/the-node-name-cannot-be-resolved-using-fieldpath-spec-nodename-is-there-any-solution/243489 "2020-08-03T02:21:59Z")
metricbeat should be able to obtain kube-status-metric information, but cannot connect to metric-server (DNS lookup failure "k8s-dev-node02.lonsid.cn": lookup k8s-dev-node02.lonsid.cn: no such host ), I see most people u… --- ## [Auditbeat consuming almost 90% cpu some times](https://discuss.elastic.co/t/auditbeat-consuming-almost-90-cpu-some-times/242872)
**Author:** [@Khasim\_Soudagar](https://discuss.elastic.co/u/Khasim_Soudagar)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 12:15am UTC](https://discuss.elastic.co/t/auditbeat-consuming-almost-90-cpu-some-times/242872 "2020-08-03T00:15:52Z")
HI i'm using auditbeat:7.7.1-OSS as part of SIEM, following is the configuration we are following. \`audit\_rules: | -a always,exit -F arch=b64 -S execve,execveat -k exec -a always,exit -F arch=b64 -S accept,bind,conne… --- ## [Update by query on nested mapping](https://discuss.elastic.co/t/update-by-query-on-nested-mapping/243290)
**Author:** [@e-rossi](https://discuss.elastic.co/u/e-rossi)\ **Replies:** 3\ **Last updated:** [August 2, 2020, 9:44pm UTC](https://discuss.elastic.co/t/update-by-query-on-nested-mapping/243290 "2020-08-02T21:44:50Z")
So, I've successfully created a field and added a value for it in existing documents using the put mapping and update by query APIs with the following NEW\_FIELD = { 'properties': { 'deleted': { … --- ## [Failed to connect to backoff, data path already locked by another beat](https://discuss.elastic.co/t/failed-to-connect-to-backoff-data-path-already-locked-by-another-beat/243480)
**Author:** [@Anthony\_Allen](https://discuss.elastic.co/u/Anthony_Allen)\ **Replies:** 0\ **Last updated:** [August 2, 2020, 8:33pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-data-path-already-locked-by-another-beat/243480 "2020-08-02T20:33:45Z")
Elasticsearch and filebeats, auditbeats, packetbeats, metricbeats and Logstash are running on the following: Ubuntu 18.04 2 core , 64 bit, 4GB RAM All the aformentioned beats and Logstash have been systemctl stopped (… --- ## [Unable to get Date Time from logs into Timestamp](https://discuss.elastic.co/t/unable-to-get-date-time-from-logs-into-timestamp/243467)
**Author:** [@JonnB](https://discuss.elastic.co/u/JonnB)\ **Replies:** 2\ **Last updated:** [August 2, 2020, 6:00pm UTC](https://discuss.elastic.co/t/unable-to-get-date-time-from-logs-into-timestamp/243467 "2020-08-02T18:00:16Z")
Hi, I have gone through previous posts which do not seem to help with my specific issue and its taking a long time to figure out without progress, if you can assist in the group? I want to get the datetime from my logf… --- ## [Java heap space issue with logstash](https://discuss.elastic.co/t/java-heap-space-issue-with-logstash/243459)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 1\ **Last updated:** [August 2, 2020, 4:12pm UTC](https://discuss.elastic.co/t/java-heap-space-issue-with-logstash/243459 "2020-08-02T16:12:27Z")
Hi All, I have been trying to ingest data which is of 6000 documents, its around 73 MB, but i'm repeatedly getting java heap space issue. below is the error. java.lang.OutOfMemoryError: Java heap space Dumping heap to… --- ## [Can't retrieve Nginx logs with Elastic Stask on ECK](https://discuss.elastic.co/t/cant-retrieve-nginx-logs-with-elastic-stask-on-eck/242921)
**Author:** [@LomigFR](https://discuss.elastic.co/u/LomigFR)\ **Replies:** 5\ **Last updated:** [August 2, 2020, 4:08pm UTC](https://discuss.elastic.co/t/cant-retrieve-nginx-logs-with-elastic-stask-on-eck/242921 "2020-08-02T16:08:53Z")
Hello, As a test, I want to retrieve access.log and error.log from a Nginx server with : Filebeat ==\> Logstash ==\> Elasticsearch ==\> Kibana Here's the situation: Windows 10 PRO with WSL1/Ubuntu18.04/Terminator and … --- ## [Searching for content in pdf and word documents](https://discuss.elastic.co/t/searching-for-content-in-pdf-and-word-documents/243454)
**Author:** [@tnkumar](https://discuss.elastic.co/u/tnkumar)\ **Replies:** 6\ **Last updated:** [August 2, 2020, 3:30pm UTC](https://discuss.elastic.co/t/searching-for-content-in-pdf-and-word-documents/243454 "2020-08-02T15:30:19Z")
I have many word and pdf documents. I want to search for some content in these documents. For such an application, are elasticsearch and kibana used? If so, and I have the free trial (signed up yesterday), how do I inges… --- ## [CCR Stats - Using Watcher](https://discuss.elastic.co/t/ccr-stats-using-watcher/243099)
**Author:** [@Maries](https://discuss.elastic.co/u/Maries)\ **Replies:** 2\ **Last updated:** [August 2, 2020, 3:29pm UTC](https://discuss.elastic.co/t/ccr-stats-using-watcher/243099 "2020-08-02T15:29:19Z")
We have CCR enabled in Elasticsearc and there are few indices getting replicated. Is there a way to setup monitoring alert using watcher script by querying \_ccr/stats and trigger an alert if data is not getting replicate… --- ## [Cardinality aggregation always returning one extra count](https://discuss.elastic.co/t/cardinality-aggregation-always-returning-one-extra-count/243462)
**Author:** [@Hardik\_Jain](https://discuss.elastic.co/u/Hardik_Jain)\ **Replies:** 0\ **Last updated:** [August 2, 2020, 2:49pm UTC](https://discuss.elastic.co/t/cardinality-aggregation-always-returning-one-extra-count/243462 "2020-08-02T14:49:15Z")
I am new to elasticsearch and wanted to query the number of clients at fixed\_interval of 1 hour and hence used the cardinality aggregation along with date\_histogram aggregation. The problem is, the cardinality aggregatio… --- ## [Help with 'dissect\_parsing\_error' on 'log file path'](https://discuss.elastic.co/t/help-with-dissect-parsing-error-on-log-file-path/243451)
**Author:** [@Yirmio](https://discuss.elastic.co/u/Yirmio)\ **Replies:** 1\ **Last updated:** [August 2, 2020, 2:21pm UTC](https://discuss.elastic.co/t/help-with-dissect-parsing-error-on-log-file-path/243451 "2020-08-02T14:21:17Z")
Hi I'm collecting logs from a central location, where each machine keep the log in separate folder, each folder name represents the machine name. In Filebeat, I want to put the folder name as field 'HOSTNAME', below i… --- ## [Import Apache Log File from Win10 to Kibana/Logstash on Debian](https://discuss.elastic.co/t/import-apache-log-file-from-win10-to-kibana-logstash-on-debian/242948)
**Author:** [@imransarkar](https://discuss.elastic.co/u/imransarkar)\ **Replies:** 22\ **Last updated:** [August 2, 2020, 10:15am UTC](https://discuss.elastic.co/t/import-apache-log-file-from-win10-to-kibana-logstash-on-debian/242948 "2020-08-02T10:15:38Z")
Hi Everyone, I am new to Kibana, I have recently uploaded Apache Log File through Filebeat (Installed on Win10) but when I check on Kibana Discovery it is displaying only single entry of entire logfile. My Setup: File… --- ## [Kibana Discover not showing the quick visualize option for the fields in Kibana 7.8.0](https://discuss.elastic.co/t/kibana-discover-not-showing-the-quick-visualize-option-for-the-fields-in-kibana-7-8-0/242804)
**Author:** [@abi.mc](https://discuss.elastic.co/u/abi.mc)\ **Replies:** 2\ **Last updated:** [August 2, 2020, 9:58am UTC](https://discuss.elastic.co/t/kibana-discover-not-showing-the-quick-visualize-option-for-the-fields-in-kibana-7-8-0/242804 "2020-08-02T09:58:36Z")
I've installed ELK Stack 7.8.0 using docker with basic license enabled and TLS between the ES nodes. Passwords has been created for the built in users and configured. Everything works fine. But in Kibana in the discover… --- ## [Client node is frequently getting out from cluster](https://discuss.elastic.co/t/client-node-is-frequently-getting-out-from-cluster/243415)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 13\ **Last updated:** [August 2, 2020, 9:24am UTC](https://discuss.elastic.co/t/client-node-is-frequently-getting-out-from-cluster/243415 "2020-08-02T09:24:20Z")
Hi All, Greetings !! I am new to ELK. and below is my setup. Total 9 nodes (6 data node + 2 client node + 1 Management Node) Every 12 - 20 mins my both client node are getting out from cluster and its getting joined … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1891) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1893)