# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=198 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 199 --- ## [Two elk stack in same kubernetes cluster having agent port conflict](https://discuss.elastic.co/t/two-elk-stack-in-same-kubernetes-cluster-having-agent-port-conflict/363776)
**Author:** [@Pop\_Adrian](https://discuss.elastic.co/u/Pop_Adrian)\ **Replies:** 0\ **Last updated:** [July 25, 2024, 10:04am UTC](https://discuss.elastic.co/t/two-elk-stack-in-same-kubernetes-cluster-having-agent-port-conflict/363776 "2024-07-25T10:04:58Z")
Hello, I have an elk stack deployed from helm eck-stack repo and I wanna setup the second one in a new namespace The problem is that the agents will start with the same port and I got Error: could not start the HTTP s… --- ## [PySpark writing to ES: "Cannot detect ES version"](https://discuss.elastic.co/t/pyspark-writing-to-es-cannot-detect-es-version/363662)
**Author:** [@rzotti-sd](https://discuss.elastic.co/u/rzotti-sd)\ **Replies:** 9\ **Last updated:** [July 24, 2024, 11:55pm UTC](https://discuss.elastic.co/t/pyspark-writing-to-es-cannot-detect-es-version/363662 "2024-07-24T23:55:44Z")
I'm using the following PySpark code to write a DataFrame to an Elasticsearch cluster hosted in Elastic Cloud. df.writeStream.outputMode("append") .format("org.elasticsearch.spark.sql") .option("checkpoi… --- ## [Searching non-indexed fields throwing error](https://discuss.elastic.co/t/searching-non-indexed-fields-throwing-error/363404)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 5\ **Last updated:** [July 24, 2024, 9:17pm UTC](https://discuss.elastic.co/t/searching-non-indexed-fields-throwing-error/363404 "2024-07-24T21:17:17Z")
we have some fields which are marked as below old version "field1": { "type": "string", "index": "no" } v8 "field1": { "type": "text", "index": false } e… --- ## [ElasticSearch Java API Client - Create index with type mapping](https://discuss.elastic.co/t/elasticsearch-java-api-client-create-index-with-type-mapping/363736)
**Author:** [@sweller](https://discuss.elastic.co/u/sweller)\ **Replies:** 1\ **Last updated:** [July 24, 2024, 9:14pm UTC](https://discuss.elastic.co/t/elasticsearch-java-api-client-create-index-with-type-mapping/363736 "2024-07-24T21:14:35Z")
I am migrating some code which uses the old rest high level client to the Java API Client (Starting at 7.17.22 with plans to migrate to 8.X immediately after), and am trying to recreate the mapping for a CreateIndexReque… --- ## [Zeek http logs not showing IP fileds](https://discuss.elastic.co/t/zeek-http-logs-not-showing-ip-fileds/363735)
**Author:** [@syed\_naqvi](https://discuss.elastic.co/u/syed_naqvi)\ **Replies:** 6\ **Last updated:** [July 24, 2024, 9:10pm UTC](https://discuss.elastic.co/t/zeek-http-logs-not-showing-ip-fileds/363735 "2024-07-24T21:10:48Z")
Hi, I am using Elasticsearch cloud trial. All data I can see is ingested . However when check zeek http logs dont see any source Ip other fields. Where is checked zeek conn logs and it showing IP info there . Any help… --- ## [What to do when flattening data is too expensive (another join question)](https://discuss.elastic.co/t/what-to-do-when-flattening-data-is-too-expensive-another-join-question/363743)
**Author:** [@Ian\_Simpson](https://discuss.elastic.co/u/Ian_Simpson)\ **Replies:** 0\ **Last updated:** [July 24, 2024, 8:10pm UTC](https://discuss.elastic.co/t/what-to-do-when-flattening-data-is-too-expensive-another-join-question/363743 "2024-07-24T20:10:14Z")
We are in the process of brainstorming ways to redesign some of our indices. We have a 3-tier data structure that looks something like this: Root Entity (light text meta-data with some dates) |- File Attachments (large … --- ## [Kibana Windows, How to use PUT command](https://discuss.elastic.co/t/kibana-windows-how-to-use-put-command/363652)
**Author:** [@Shaakxuur](https://discuss.elastic.co/u/Shaakxuur)\ **Replies:** 1\ **Last updated:** [July 24, 2024, 8:13pm UTC](https://discuss.elastic.co/t/kibana-windows-how-to-use-put-command/363652 "2024-07-24T20:13:36Z")
My Kibana installation is no longer working. Message: “Kibana server is not ready yet”. The following error messages: \[2024-07-23T17:17:13.463+02:00\]\[ERROR\]\[savedobjects-service\] \[.kibana\_task\_manager\] Action failed w… --- ## [Search multiple documents](https://discuss.elastic.co/t/search-multiple-documents/363655)
**Author:** [@raymondtam](https://discuss.elastic.co/u/raymondtam)\ **Replies:** 1\ **Last updated:** [July 24, 2024, 8:10pm UTC](https://discuss.elastic.co/t/search-multiple-documents/363655 "2024-07-24T20:10:50Z")
I have 2 indexes - People and Vehicles. Index "People" has a field "IsVisible" while index "Vehicles" does not have this property. Now I want to search "Raymond" on these 2 indexes. However, the search only happens on "… --- ## [Upsert large amount of documents based on the property value](https://discuss.elastic.co/t/upsert-large-amount-of-documents-based-on-the-property-value/362494)
**Author:** [@CTO\_Servefast](https://discuss.elastic.co/u/CTO_Servefast)\ **Replies:** 10\ **Last updated:** [July 24, 2024, 7:52pm UTC](https://discuss.elastic.co/t/upsert-large-amount-of-documents-based-on-the-property-value/362494 "2024-07-24T19:52:19Z")
Is it possible to use Bulk API to upsert large number of documents 100, 1000 ... but i want them to be inserted based on a query for example based on my userId property Use case for this is that we need to handle thousa… --- ## [Advanced Sync Rule Query skip due Table not having primary key](https://discuss.elastic.co/t/advanced-sync-rule-query-skip-due-table-not-having-primary-key/363731)
**Author:** [@sebaV\_20](https://discuss.elastic.co/u/sebaV_20)\ **Replies:** 0\ **Last updated:** [July 24, 2024, 4:40pm UTC](https://discuss.elastic.co/t/advanced-sync-rule-query-skip-due-table-not-having-primary-key/363731 "2024-07-24T16:40:59Z")
Hello ! Basically what the title says. I have everything working fine, i can ingest data and all with big queries and JOINS. The "issue" i'm having is with a particular table that i need to use in one of my queries. Th… --- ## [New Index with latest timestamp](https://discuss.elastic.co/t/new-index-with-latest-timestamp/363573)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 2\ **Last updated:** [July 24, 2024, 2:37pm UTC](https://discuss.elastic.co/t/new-index-with-latest-timestamp/363573 "2024-07-24T14:37:01Z")
Hi All, I have an index that contains time series data, essentially the status of different servers. I want to create another index from this index which should always have the latest value of data present by timestamp,… --- ## [Elastic Usage Disk Filtered By Date](https://discuss.elastic.co/t/elastic-usage-disk-filtered-by-date/363668)
**Author:** [@zerratriani](https://discuss.elastic.co/u/zerratriani)\ **Replies:** 1\ **Last updated:** [July 24, 2024, 2:25pm UTC](https://discuss.elastic.co/t/elastic-usage-disk-filtered-by-date/363668 "2024-07-24T14:25:55Z")
I have an Elasticsearch cluster and want to know the memory usage of all indices over the past 3 months. This way, I can request additional resources using accurate data. I am using the command /\_cat/indices?v, which pr… --- ## [Logstash and fingerprint](https://discuss.elastic.co/t/logstash-and-fingerprint/363683)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 2\ **Last updated:** [July 24, 2024, 12:51pm UTC](https://discuss.elastic.co/t/logstash-and-fingerprint/363683 "2024-07-24T12:51:27Z")
Hi there! I would like to use the fingerprint plugin to manage the authenticity of a document. When I try to use the the fingerprint on the field agent, it works well : fingerprint { source =\> \["agent"\] concatenat… --- ## [Cannot create an enrollment token to enrol a new elasticsearch node](https://discuss.elastic.co/t/cannot-create-an-enrollment-token-to-enrol-a-new-elasticsearch-node/363697)
**Author:** [@adrian.cunnelly](https://discuss.elastic.co/u/adrian.cunnelly)\ **Replies:** 1\ **Last updated:** [July 24, 2024, 12:50pm UTC](https://discuss.elastic.co/t/cannot-create-an-enrollment-token-to-enrol-a-new-elasticsearch-node/363697 "2024-07-24T12:50:34Z")
I have an elasticsearch 8.14 cluster running with 5 nodes with security enabled using own generated certificates. Everything is running fine but I now need to add 2 ingest only nodes. I am trying to create the enrollme… --- ## [Automatic Index Creation](https://discuss.elastic.co/t/automatic-index-creation/361788)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 66\ **Last updated:** [July 24, 2024, 12:47pm UTC](https://discuss.elastic.co/t/automatic-index-creation/361788 "2024-07-24T12:47:44Z")
Hi Team, We had a requirement to create an index automatically by reading the content of the CSV files. Within the CSV files, there is a field named "timestamp" where data is received in epoch format. The objective is t… --- ## [Pinned query not good with KNN search](https://discuss.elastic.co/t/pinned-query-not-good-with-knn-search/358210)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 6\ **Last updated:** [July 24, 2024, 12:09pm UTC](https://discuss.elastic.co/t/pinned-query-not-good-with-knn-search/358210 "2024-07-24T12:09:24Z")
Hi, When using a normal knn query this works: "knn": \[ { "inner\_hits": { "\_source": false, "fields": \[ "passages.text" \] }, "field": "passages.vector.predicted\_value", "k":… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/363686)
**Author:** [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Replies:** 6\ **Last updated:** [July 24, 2024, 10:40am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/363686 "2024-07-24T10:40:18Z")
Hi, I am running into an issue with a new setup and hope someone can point me in the right direction. OS is Ubuntu 22.04 LTE. ES and Kibana are version 8.14.3 For now I am starting with everything on a single VM. Afte… --- ## [Java API Client Convert Query back to builder or Parent Builder class](https://discuss.elastic.co/t/java-api-client-convert-query-back-to-builder-or-parent-builder-class/363634)
**Author:** [@Vijeya\_Nidhi](https://discuss.elastic.co/u/Vijeya_Nidhi)\ **Replies:** 1\ **Last updated:** [July 24, 2024, 9:54am UTC](https://discuss.elastic.co/t/java-api-client-convert-query-back-to-builder-or-parent-builder-class/363634 "2024-07-24T09:54:11Z")
Hi, in the new java api client Is there any method to convert Query back to its builder format ie Query.Builder, BoolQuery.Builder etc to add more conditions (like adding more must conditions) into it? or is there any… --- ## [Kibana Rule Metadata Report](https://discuss.elastic.co/t/kibana-rule-metadata-report/363591)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [July 24, 2024, 9:23am UTC](https://discuss.elastic.co/t/kibana-rule-metadata-report/363591 "2024-07-24T09:23:14Z")
Hello, I have been asked to collect a CSV report of all alerts created in Kibana (Observability, ESQuery) and their recipients. Is this possible? I am thinking this might be possible via a hidden kibana indices? --- ## [Term query is case sensitive for some but not for others](https://discuss.elastic.co/t/term-query-is-case-sensitive-for-some-but-not-for-others/363646)
**Author:** [@paulmuller](https://discuss.elastic.co/u/paulmuller)\ **Replies:** 3\ **Last updated:** [July 24, 2024, 8:02am UTC](https://discuss.elastic.co/t/term-query-is-case-sensitive-for-some-but-not-for-others/363646 "2024-07-24T08:02:10Z")
What could be the reason that a term query behaves case sensitive in some installations and case insensitive in others? In the mapping the affected field is of type keyword. Both installations use the same Docker Compose… --- ## [Gantt chart with Vega using live data index](https://discuss.elastic.co/t/gantt-chart-with-vega-using-live-data-index/363451)
**Author:** [@Seena\_Taravati](https://discuss.elastic.co/u/Seena_Taravati)\ **Replies:** 3\ **Last updated:** [July 24, 2024, 7:24am UTC](https://discuss.elastic.co/t/gantt-chart-with-vega-using-live-data-index/363451 "2024-07-24T07:24:29Z")
Hi all, I am trying to build a gantt chart using vega for a sequence of test ran. We have ingested all the data into a index but I am having a hard time trying to plot the gantt chart. We have the start and end times fo… --- ## [Elastic Agent Filebeat - keep line order](https://discuss.elastic.co/t/elastic-agent-filebeat-keep-line-order/363472)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 2\ **Last updated:** [July 24, 2024, 7:08am UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-keep-line-order/363472 "2024-07-24T07:08:13Z")
I'm shipping logs from Wildfly application to elasticsearch using Elastic Agent 'Custom Log File" integration. However I've noticed that log lines are not shipped or displayed in the exact order. It probably has somethi… --- ## [Filtering on aggregations](https://discuss.elastic.co/t/filtering-on-aggregations/362130)
**Author:** [@Navnath](https://discuss.elastic.co/u/Navnath)\ **Replies:** 2\ **Last updated:** [July 24, 2024, 5:51am UTC](https://discuss.elastic.co/t/filtering-on-aggregations/362130 "2024-07-24T05:51:01Z")
Hello, I am doing a search operation to get some product results with their associated aggregations. So , here, aggregations are by products of the search result When I fetch this result, I ask for only 100 aggregatio… --- ## [Elastic CSV Download Problem](https://discuss.elastic.co/t/elastic-csv-download-problem/363660)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [July 23, 2024, 10:54pm UTC](https://discuss.elastic.co/t/elastic-csv-download-problem/363660 "2024-07-23T22:54:16Z")
I downloaded a csv report from Discover. It only returned 89 out of 161 rows. I didn't think it would be this little amount to download? Kibana/elasticsearch version: 8.14.1 --- ## [Kibana Reporting Tools](https://discuss.elastic.co/t/kibana-reporting-tools/363663)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [July 23, 2024, 10:09pm UTC](https://discuss.elastic.co/t/kibana-reporting-tools/363663 "2024-07-23T22:09:54Z")
Hello, does anyone use free/open source reporting tools outside of Elastic? I have seen Skedler but was see if theres something others are using? --- ## [Often hot node require restart](https://discuss.elastic.co/t/often-hot-node-require-restart/363484)
**Author:** [@mohd\_sa](https://discuss.elastic.co/u/mohd_sa)\ **Replies:** 2\ **Last updated:** [July 23, 2024, 5:18pm UTC](https://discuss.elastic.co/t/often-hot-node-require-restart/363484 "2024-07-23T17:18:24Z")
i have 3 master and one hot node and warm node , often injest data on hot node is decrease and after restart elasticsearch service , It works correctly. I don't understand why --- ## [Present end of nested field as a part of value](https://discuss.elastic.co/t/present-end-of-nested-field-as-a-part-of-value/363643)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 2\ **Last updated:** [July 23, 2024, 4:54pm UTC](https://discuss.elastic.co/t/present-end-of-nested-field-as-a-part-of-value/363643 "2024-07-23T16:54:31Z")
Hi, I have records which could contain nested fields with a high depth. And I want to convert part of the nested field to the part of the value. What I have before { "a":{ "b":{ "c":{ "d":{ … --- ## [\[Bug\]: ElasticSearch : Timeout context manager should be used inside a task](https://discuss.elastic.co/t/bug-elasticsearch-timeout-context-manager-should-be-used-inside-a-task/363639)
**Author:** [@FlorentGrenier](https://discuss.elastic.co/u/FlorentGrenier)\ **Replies:** 1\ **Last updated:** [July 23, 2024, 3:24pm UTC](https://discuss.elastic.co/t/bug-elasticsearch-timeout-context-manager-should-be-used-inside-a-task/363639 "2024-07-23T15:24:03Z")
Bug Description I'm developing a chatbot, and on a second request sent the bug appears I have llama-index installed in the conda environment with Pyhton 3.12.3. I have streamlit 1.36.0 for UI. I have elastic-transport… --- ## [Send fortiweb syslog to elasticsearch](https://discuss.elastic.co/t/send-fortiweb-syslog-to-elasticsearch/363605)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 3\ **Last updated:** [July 23, 2024, 12:55pm UTC](https://discuss.elastic.co/t/send-fortiweb-syslog-to-elasticsearch/363605 "2024-07-23T12:55:25Z")
hi all, we have a fortieweb 2000 s device and we want to send its log to elaticearch. in the first step, we wrote a logstash config file which is listening on udp with type "json", meanwhile the fortiweb log type is c… --- ## [Dynamically filter for data in the visible map area - doesn't work](https://discuss.elastic.co/t/dynamically-filter-for-data-in-the-visible-map-area-doesnt-work/363570)
**Author:** [@dc\_3](https://discuss.elastic.co/u/dc_3)\ **Replies:** 4\ **Last updated:** [July 23, 2024, 12:30pm UTC](https://discuss.elastic.co/t/dynamically-filter-for-data-in-the-visible-map-area-doesnt-work/363570 "2024-07-23T12:30:14Z")
Hi there. I've had this trouble on multiple maps now, that the 'Dynamically filter for data in the visible map area' toggle does not work reliably. I've had it work on some maps, and this screenshot where it doesn't work… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=197) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=199)