# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1926 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1927 --- ## [Missing geoip.location](https://discuss.elastic.co/t/missing-geoip-location/241004)
**Author:** [@brapnda23](https://discuss.elastic.co/u/brapnda23)\ **Replies:** 8\ **Last updated:** [July 15, 2020, 11:11pm UTC](https://discuss.elastic.co/t/missing-geoip-location/241004 "2020-07-15T23:11:54Z")
New to ELK...My test ELK instance is 7.8.x. I am using the below filter code for IIS Logs and it is working fine. I can see other geo fields but I don't see geoip.location as mentioned in https://www.elastic.co/blog/geo… --- ## [Logstash](https://discuss.elastic.co/t/logstash/241326)
**Author:** [@laxmikanth](https://discuss.elastic.co/u/laxmikanth)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 9:25pm UTC](https://discuss.elastic.co/t/logstash/241326 "2020-07-15T21:25:57Z")
When I try to run logstash in local, noticing below error. Can some one please help me? --- ## [Alternative to Filebeat on Solaris 11.3 SPARC](https://discuss.elastic.co/t/alternative-to-filebeat-on-solaris-11-3-sparc/241356)
**Author:** [@dhanshake](https://discuss.elastic.co/u/dhanshake)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 9:08pm UTC](https://discuss.elastic.co/t/alternative-to-filebeat-on-solaris-11-3-sparc/241356 "2020-07-15T21:08:10Z")
Any alternative to Filebeat to read application logs from Solaris server ( Solaris 11.3 SPARC) ? P.S - logs weren't written to syslog. --- ## [I wonder about logstash YYYY.MM.dd](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073)
**Author:** [@111349](https://discuss.elastic.co/u/111349)\ **Replies:** 9\ **Last updated:** [July 15, 2020, 9:07pm UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073 "2020-07-15T21:07:22Z")
I am not sure what logstash YYYY.MM.dd is based on. I'm in asia/seoul area and I also sent a message at 1am. The 13th was 1:00 a.m. on the 14th, but there was no newly created 14-day index in elasticsearch. I searched … --- ## [How to debug relevance in DSL queries](https://discuss.elastic.co/t/how-to-debug-relevance-in-dsl-queries/241357)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 8:09pm UTC](https://discuss.elastic.co/t/how-to-debug-relevance-in-dsl-queries/241357 "2020-07-15T20:09:33Z")
Hi, I'm working on my first set of queries, but I wish to 'debug' and see: which part of my query match what is the computed score for anything involved in the computation of the final score. For the first, it seems … --- ## [How to read JSON files and insert in Elastic Stack](https://discuss.elastic.co/t/how-to-read-json-files-and-insert-in-elastic-stack/241229)
**Author:** [@Mike0211](https://discuss.elastic.co/u/Mike0211)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 7:48pm UTC](https://discuss.elastic.co/t/how-to-read-json-files-and-insert-in-elastic-stack/241229 "2020-07-15T19:48:48Z")
I am new to Elastic. I have 10 independent docker containers each writing custom JSON files in a single directory. Each docker container writes file in a different format. Each file is a single line JSON along with times… --- ## [Heartbeat is only detecting physical devices](https://discuss.elastic.co/t/heartbeat-is-only-detecting-physical-devices/241348)
**Author:** [@samspopguy](https://discuss.elastic.co/u/samspopguy)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 6:21pm UTC](https://discuss.elastic.co/t/heartbeat-is-only-detecting-physical-devices/241348 "2020-07-15T18:21:57Z")
heartbeat detects any physical device as being up fine, but almost anything that's a virtual server its marking it as down. I think 1 of the 12 virtual servers is marked as up. I'm just using the http type for the server … --- ## [Filebeat too quick on recovering data](https://discuss.elastic.co/t/filebeat-too-quick-on-recovering-data/241133)
**Author:** [@Bader](https://discuss.elastic.co/u/Bader)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 11:12am UTC](https://discuss.elastic.co/t/filebeat-too-quick-on-recovering-data/241133 "2020-07-15T11:12:49Z")
Hello. I am running ELK 6.6 on a CentOS 7 box. I have filebeat configured on a Windows machine to forward specific logs to Logstash. The problem I have is that my Logstash filter has a throttling mechanism setup as to … --- ## [Snapshot only for data-nodes](https://discuss.elastic.co/t/snapshot-only-for-data-nodes/241345)
**Author:** [@NmPOuNgLfKWK2c4dDS](https://discuss.elastic.co/u/NmPOuNgLfKWK2c4dDS)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 6:17pm UTC](https://discuss.elastic.co/t/snapshot-only-for-data-nodes/241345 "2020-07-15T18:17:45Z")
Hi \*. My first post here, this time I was unable to simply find answer on the net. I have ES 7.8.0 cluster, two "proper" nodes and one voting-only master-eligible. Last one is as simple as it can be - just a docker imag… --- ## [Enabling anonymous access](https://discuss.elastic.co/t/enabling-anonymous-access/239430)
**Author:** [@jjums](https://discuss.elastic.co/u/jjums)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 6:03pm UTC](https://discuss.elastic.co/t/enabling-anonymous-access/239430 "2020-07-15T18:03:55Z")
Hello, I'm a beginner in using elasticsearch and kibana. I installed ver. 7.7. I want to use the function "enabling anonymous access". https://www.elastic.co/guide/en/elasticsearch/reference/7.7/anonymous-access.html … --- ## [Near duplicate document detection](https://discuss.elastic.co/t/near-duplicate-document-detection/241334)
**Author:** [@tallison](https://discuss.elastic.co/u/tallison)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 5:35pm UTC](https://discuss.elastic.co/t/near-duplicate-document-detection/241334 "2020-07-15T17:35:03Z")
I have an index w ~12 million files. We have a serious duplication issue and near duplication issue. The exact duplicate problem is trivial because we store a digest. The near duplicate issue is more profound, and I'v… --- ## [ERROR: Failed to verify bootstrap password when setting built in user's password](https://discuss.elastic.co/t/error-failed-to-verify-bootstrap-password-when-setting-built-in-users-password/241341)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 5:21pm UTC](https://discuss.elastic.co/t/error-failed-to-verify-bootstrap-password-when-setting-built-in-users-password/241341 "2020-07-15T17:21:45Z")
I have imported and started Elasticsearch Source Code into an IntelliJ IDEA project. I want to create the password for the built-in users To enable security, I passed -Dtests.es.xpack.security.enabled=true as a parame… --- ## [Logstash Aggregate Filter output different result each time](https://discuss.elastic.co/t/logstash-aggregate-filter-output-different-result-each-time/239303)
**Author:** [@Aberry](https://discuss.elastic.co/u/Aberry)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 5:19pm UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-output-different-result-each-time/239303 "2020-07-15T17:19:39Z")
I have 2 input files like below - inbound.txt: 17:03:56.662 53897 55931 17:03:56.737 53898 55932 17:03:56.814 53899 55933 17:03:56.889 53900 55934 outbound.txt: 17:03:56.887 77307 55931 17:03:56.953 77… --- ## [Get newest value per distinct field](https://discuss.elastic.co/t/get-newest-value-per-distinct-field/241157)
**Author:** [@gudmundur](https://discuss.elastic.co/u/gudmundur)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 5:15pm UTC](https://discuss.elastic.co/t/get-newest-value-per-distinct-field/241157 "2020-07-15T17:15:02Z")
Greetings I want to do a query which returns the newest 1 value per distinct combination of specific underlying fields (maybe also after a certain timestamp) In the sql world I can do a query like this: select Element… --- ## [Indexes size and time duration recommended values](https://discuss.elastic.co/t/indexes-size-and-time-duration-recommended-values/241335)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 4:54pm UTC](https://discuss.elastic.co/t/indexes-size-and-time-duration-recommended-values/241335 "2020-07-15T16:54:56Z")
Hi people, I have ELK 7.8.0 running OK and configured by default. I have several data coming to my ELK server: mainly Cisco ASA and Netflow into filebeat-\* indexes: And this is the default lifecycle policy: Do y… --- ## [Pfsense logs to ELK cloud](https://discuss.elastic.co/t/pfsense-logs-to-elk-cloud/241333)
**Author:** [@jhaycraft](https://discuss.elastic.co/u/jhaycraft)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 4:28pm UTC](https://discuss.elastic.co/t/pfsense-logs-to-elk-cloud/241333 "2020-07-15T16:28:44Z")
Is there a good way to get PFsense logs straight from the firewall to the Elk hosted stack without a go between ( graylog, logstash etc)? Thanks, --- ## [How to update dynamic mapping on existing index](https://discuss.elastic.co/t/how-to-update-dynamic-mapping-on-existing-index/241327)
**Author:** [@ilang](https://discuss.elastic.co/u/ilang)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 3:42pm UTC](https://discuss.elastic.co/t/how-to-update-dynamic-mapping-on-existing-index/241327 "2020-07-15T15:42:34Z")
Hi guys, I am trying to update the dynamic mapping to "strict" on an existing index. To do so I tried to run the following query: PUT /dev-jira-fetcher/\_mappings { "dynamic": "strict" } I also tried this one: PUT… --- ## [How can I have an review of my index content on a specific field?](https://discuss.elastic.co/t/how-can-i-have-an-review-of-my-index-content-on-a-specific-field/241297)
**Author:** [@vic22](https://discuss.elastic.co/u/vic22)\ **Replies:** 4\ **Last updated:** [July 15, 2020, 3:10pm UTC](https://discuss.elastic.co/t/how-can-i-have-an-review-of-my-index-content-on-a-specific-field/241297 "2020-07-15T15:10:24Z")
Hello everyone ! I hope that you have a great day! I would like to ask you a particular question. It sounds easy, but, in contrario, it is quite complex... In my Elasticsearch index, I would like to know for a specifi… --- ## [ILM uses the default policy](https://discuss.elastic.co/t/ilm-uses-the-default-policy/241319)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 3:02pm UTC](https://discuss.elastic.co/t/ilm-uses-the-default-policy/241319 "2020-07-15T15:02:00Z")
Hello everyone, I need your help please, I created a new ILM policy but packetbeat is still using the default policy here is my configuration Creation of the new policy: PUT \_ilm/policy/hot-warm-cold-delete-60days-p… --- ## [Logstash Jdbc Input Plugin format for timestamp in prepared statement](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-format-for-timestamp-in-prepared-statement/241307)
**Author:** [@styks90](https://discuss.elastic.co/u/styks90)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 2:47pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-format-for-timestamp-in-prepared-statement/241307 "2020-07-15T14:47:27Z")
We are looking to use prepared statements with the Jdbc input plugin, where the source database is a Db2 instance. So far we've not been using prepared statements, so that the relevant part of the (working) config looks… --- ## [How to get current time as unix timestamp for script use](https://discuss.elastic.co/t/how-to-get-current-time-as-unix-timestamp-for-script-use/240723)
**Author:** [@Quentin\_L\_eilde](https://discuss.elastic.co/u/Quentin_L_eilde)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 2:31pm UTC](https://discuss.elastic.co/t/how-to-get-current-time-as-unix-timestamp-for-script-use/240723 "2020-07-15T14:31:52Z")
Hello, I have three fields: date\_start (type: date) date\_end (type: date) permanent (type: bool) I would like to return all documents with theses conditions: date\_start \<= now AND date\_end \>= now OR date\_start \<= … --- ## [AWS Elasticsearch snapshot stuck in state IN\_PROGRESS](https://discuss.elastic.co/t/aws-elasticsearch-snapshot-stuck-in-state-in-progress/241289)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 2:16pm UTC](https://discuss.elastic.co/t/aws-elasticsearch-snapshot-stuck-in-state-in-progress/241289 "2020-07-15T14:16:24Z")
I am using ElasticService from AWS. I am receiving Snapshot failure status in Overall health. I can see, there is one snapshot that is stuctk for almost 2 days. id … --- ## [Not able to start Elasticsearch, no matter what I do](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-no-matter-what-i-do/240847)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 7\ **Last updated:** [July 15, 2020, 2:15pm UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-no-matter-what-i-do/240847 "2020-07-15T14:15:42Z")
Running Ubuntu 20.04 on Oracle VM. Deployed two Ubuntu instances on AWS. I will list out all the steps I did. Please let me know where I have gone wrong. Copied the pem file to home directory cp ~/Downloads/TetraSear… --- ## [How to restore elasticsearch s3 snapshot on a different cluster](https://discuss.elastic.co/t/how-to-restore-elasticsearch-s3-snapshot-on-a-different-cluster/241153)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-to-restore-elasticsearch-s3-snapshot-on-a-different-cluster/241153 "2020-07-15T13:58:51Z")
I have an Elastic Cloud on Kubernetes (ECK) setup and i have also setup snapshots which are stored on s3. I want to restore these snapshots on s3 to a local version of ECK i have running on minikube. So how do i restore… --- ## [How to stop logstash gracefully when using kubernetes](https://discuss.elastic.co/t/how-to-stop-logstash-gracefully-when-using-kubernetes/241288)
**Author:** [@benz](https://discuss.elastic.co/u/benz)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 1:54pm UTC](https://discuss.elastic.co/t/how-to-stop-logstash-gracefully-when-using-kubernetes/241288 "2020-07-15T13:54:26Z")
Hi, We are running logstash as statefulset over k8s. I am looking for a way to stop logstash only after it finish process all in-flight events. We already use: enable\_auto\_commit =\> "false" for kafka input so I guess… --- ## [Visualization with kibana](https://discuss.elastic.co/t/visualization-with-kibana/238999)
**Author:** [@inchirah](https://discuss.elastic.co/u/inchirah)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 1:46pm UTC](https://discuss.elastic.co/t/visualization-with-kibana/238999 "2020-07-15T13:46:35Z")
Hello, I want to visualize a simple bar chart with y-axis "taux"(percentage) one value, and in the x-axis a constant "seuil". Could you please help me. --- ## [Canvas sql throwing syntax error](https://discuss.elastic.co/t/canvas-sql-throwing-syntax-error/237642)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 1:43pm UTC](https://discuss.elastic.co/t/canvas-sql-throwing-syntax-error/237642 "2020-07-15T13:43:50Z")
I am trying create canvas line chart with following sql SELECT avg(beat.system.cpu.user.norm.pct) as avg1 , beat.hostname, MINUTE\_OF\_HOUR("@timestamp") as min FROM "all\_metric\*" group by beat.hostname, MINUTE\_OF\_HOU… --- ## [Get file name from index based on content search in index](https://discuss.elastic.co/t/get-file-name-from-index-based-on-content-search-in-index/241283)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 21\ **Last updated:** [July 15, 2020, 1:34pm UTC](https://discuss.elastic.co/t/get-file-name-from-index-based-on-content-search-in-index/241283 "2020-07-15T13:34:52Z")
Hi, Thanks in advance i have loaded pdf files into index, all the data in the pdf file is treated as content in index. now i want the file name based on the content search. suppose if i search for football in the co… --- ## [List of string must match all provided values](https://discuss.elastic.co/t/list-of-string-must-match-all-provided-values/240351)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 13\ **Last updated:** [July 15, 2020, 1:07pm UTC](https://discuss.elastic.co/t/list-of-string-must-match-all-provided-values/240351 "2020-07-15T13:07:30Z")
Hi, I'm new to Elastic Search, and I simply would like to make a query that filter all entries that have exactly all the supplied values (not an OR but an AND). Here is an example of my document \[ { "Areas" : … --- ## [Sum nested values and filter / sort by them](https://discuss.elastic.co/t/sum-nested-values-and-filter-sort-by-them/241284)
**Author:** [@stefnats](https://discuss.elastic.co/u/stefnats)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 12:54pm UTC](https://discuss.elastic.co/t/sum-nested-values-and-filter-sort-by-them/241284 "2020-07-15T12:54:26Z")
Hi, as in this thread, my problem is pretty similar: I have a product index with a nested sales\_per\_day array. It looks something like this: PUT /products { "mappings": { "properties": { "sales\_per\_day… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1925) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1927)