# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=203 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 204 --- ## [Elasticsearch: Slow query with min\_doc\_count=0 on field aggregation](https://discuss.elastic.co/t/elasticsearch-slow-query-with-min-doc-count-0-on-field-aggregation/363158)
**Author:** [@fherenius](https://discuss.elastic.co/u/fherenius)\ **Replies:** 8\ **Last updated:** [July 16, 2024, 1:43pm UTC](https://discuss.elastic.co/t/elasticsearch-slow-query-with-min-doc-count-0-on-field-aggregation/363158 "2024-07-16T13:43:10Z")
For more background, see the previous topic on this issue: Elasticsearch queue issue after upgrading from 8.6.2 to 8.12.1/8.12.2 - #2 by Amos66 Specifically the replies by Amos66. As described in the linked post, the q… --- ## [Drop\_event processor with not and or condition filters out all event](https://discuss.elastic.co/t/drop-event-processor-with-not-and-or-condition-filters-out-all-event/363185)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [July 16, 2024, 1:07pm UTC](https://discuss.elastic.co/t/drop-event-processor-with-not-and-or-condition-filters-out-all-event/363185 "2024-07-16T13:07:34Z")
Hello I have configured a filestream with a drop\_event processor. I want to drop the all event, which is not collected by Filebeat on hosts, which are listed in the configuration. The problem is the drop\_event processor… --- ## [Elasticsearch networking with Podman](https://discuss.elastic.co/t/elasticsearch-networking-with-podman/362979)
**Author:** [@Mason\_Keresty](https://discuss.elastic.co/u/Mason_Keresty)\ **Replies:** 4\ **Last updated:** [July 16, 2024, 12:56pm UTC](https://discuss.elastic.co/t/elasticsearch-networking-with-podman/362979 "2024-07-16T12:56:26Z")
Hello, Summary: I'm having some errors creating an elasticsearch cluster across multiple servers. Setup: 2 rhel8 ec2 instances running elasticsearch 8.5 in podman containers docker-compose.yml on server A: es03: … --- ## [How to disable "create visualization" option in kibana and provide Edit access to dashboard](https://discuss.elastic.co/t/how-to-disable-create-visualization-option-in-kibana-and-provide-edit-access-to-dashboard/363202)
**Author:** [@tejashree](https://discuss.elastic.co/u/tejashree)\ **Replies:** 2\ **Last updated:** [July 16, 2024, 12:41pm UTC](https://discuss.elastic.co/t/how-to-disable-create-visualization-option-in-kibana-and-provide-edit-access-to-dashboard/363202 "2024-07-16T12:41:35Z")
Iam trying create the Roles to give access for users with create dashboard using the existing visualizations, i have to disable users with edit and delete options on the visualizations --- ## [Sending messages to Microsoft Teams](https://discuss.elastic.co/t/sending-messages-to-microsoft-teams/363214)
**Author:** [@Ryan5](https://discuss.elastic.co/u/Ryan5)\ **Replies:** 1\ **Last updated:** [July 16, 2024, 12:37pm UTC](https://discuss.elastic.co/t/sending-messages-to-microsoft-teams/363214 "2024-07-16T12:37:05Z")
With the new changes to webhooks Microsoft suddenly announced \[1\] what would be the best way to continue to send messages from Logstash into Teams? Before we had a small online payload but after their new changes the pa… --- ## [How to use\`add\_process\_metadata\`in packetbeat to get process.pid?](https://discuss.elastic.co/t/how-to-use-add-process-metadata-in-packetbeat-to-get-process-pid/363217)
**Author:** [@asdfsx](https://discuss.elastic.co/u/asdfsx)\ **Replies:** 0\ **Last updated:** [July 16, 2024, 11:57am UTC](https://discuss.elastic.co/t/how-to-use-add-process-metadata-in-packetbeat-to-get-process-pid/363217 "2024-07-16T11:57:23Z")
I start my packetbeat by docker-compose, and tring to use add\_process\_metadata to add process.pid to the packet data. But I failed, the process.pid is always empty. I use following docker-compose to start the packetbeat … --- ## [Logstash configurtaion for convert to Number](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 5\ **Last updated:** [July 16, 2024, 10:30am UTC](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194 "2024-07-16T10:30:28Z")
Hi , We are trying a configuration to convert the message field (which has number coming as Text) to integer as we have to create some line graphs based on the number . We tried below configuration but its converting on… --- ## [When Starting Data Frame, there is an error](https://discuss.elastic.co/t/when-starting-data-frame-there-is-an-error/363129)
**Author:** [@Muqali\_He](https://discuss.elastic.co/u/Muqali_He)\ **Replies:** 3\ **Last updated:** [July 16, 2024, 9:23am UTC](https://discuss.elastic.co/t/when-starting-data-frame-there-is-an-error/363129 "2024-07-16T09:23:02Z")
My Elasticsearch is 7.8. I can create a data frame job. but when I start it, I got the error "{"error":{"root\_cause":\[{"type":"exception","reason":"Failed to launch data frame analytics memory usage estimation process fo… --- ## [Downsample again time series metrics](https://discuss.elastic.co/t/downsample-again-time-series-metrics/363204)
**Author:** [@nekirc](https://discuss.elastic.co/u/nekirc)\ **Replies:** 0\ **Last updated:** [July 16, 2024, 8:49am UTC](https://discuss.elastic.co/t/downsample-again-time-series-metrics/363204 "2024-07-16T08:49:47Z")
Hi, I would like to know if there is a chance to downsample downsampled time series data (metrics). I have set ILM policy to downsample data every 2 minutes after 1 day which is fine and it works. Additionally, set an… --- ## [Dashboard control empty](https://discuss.elastic.co/t/dashboard-control-empty/362781)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 4\ **Last updated:** [July 16, 2024, 8:18am UTC](https://discuss.elastic.co/t/dashboard-control-empty/362781 "2024-07-16T08:18:56Z")
Hi everyone, I try to add a control component to my dashboard to list and filter on the cluster.name field. Checked in discover, the field exist and is filled : I think the control configuration is right : But … --- ## [Repository\_verification\_exception](https://discuss.elastic.co/t/repository-verification-exception/363174)
**Author:** [@Naresh\_Kumar1](https://discuss.elastic.co/u/Naresh_Kumar1)\ **Replies:** 3\ **Last updated:** [July 16, 2024, 5:28am UTC](https://discuss.elastic.co/t/repository-verification-exception/363174 "2024-07-16T05:28:57Z")
I am using ES 8.13.4 in the EKS cluster, On the daily snapshot we are getting snapshot exceptions like connection pool shutdown. What was the reason behind this it was working fine suddenly without any changes we are get… --- ## [Kibana Dashboards](https://discuss.elastic.co/t/kibana-dashboards/362765)
**Author:** [@Priyanka\_Narne](https://discuss.elastic.co/u/Priyanka_Narne)\ **Replies:** 4\ **Last updated:** [July 16, 2024, 4:12am UTC](https://discuss.elastic.co/t/kibana-dashboards/362765 "2024-07-16T04:12:38Z")
I am using Elastic Cloud as my Backend. I have ndjson files. I wanted to load dashboards in my application using those ndjson files. I want to customize the dashboards according to my application theme. Are there any pl… --- ## [Metricbeat dashboard sudden issue](https://discuss.elastic.co/t/metricbeat-dashboard-sudden-issue/363180)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [July 15, 2024, 6:38pm UTC](https://discuss.elastic.co/t/metricbeat-dashboard-sudden-issue/363180 "2024-07-15T18:38:30Z")
Hi All, I had set up metricbeat 8.7 on Linux hosts and dashboards for "system" as well as "Apache" modules started showing up fine. It kept running for almost 2 weeks without issues. This morning all of a sudden I not… --- ## [Issue with Aggregating Nested Documents in Elasticsearch](https://discuss.elastic.co/t/issue-with-aggregating-nested-documents-in-elasticsearch/363177)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 0\ **Last updated:** [July 15, 2024, 5:52pm UTC](https://discuss.elastic.co/t/issue-with-aggregating-nested-documents-in-elasticsearch/363177 "2024-07-15T17:52:28Z")
I have this json document: {"docs":\[{"id":"1","abono":10000,"cargo":0,"descripcion":"Abono"},{"id":"2","abono":0,"cargo":23000,"descripcion":"Pago Remuneraciones","Remuneracions":\[{"id":1001,"empleado\_id":111,"monto\_liq… --- ## [Java.lang.IllegalArgumentException with environment variable placeholder](https://discuss.elastic.co/t/java-lang-illegalargumentexception-with-environment-variable-placeholder/362901)
**Author:** [@EAC](https://discuss.elastic.co/u/EAC)\ **Replies:** 4\ **Last updated:** [July 15, 2024, 5:46pm UTC](https://discuss.elastic.co/t/java-lang-illegalargumentexception-with-environment-variable-placeholder/362901 "2024-07-15T17:46:40Z")
Context of environment: Newbee engaged with the learning and building of a current-version single node elasticsearch-kibana-logstash stack with manually configured security, within a current virtual Ubuntu machine. Cont… --- ## [How to disable TLS1.1 on Elastic Agent](https://discuss.elastic.co/t/how-to-disable-tls1-1-on-elastic-agent/363171)
**Author:** [@CCee](https://discuss.elastic.co/u/CCee)\ **Replies:** 2\ **Last updated:** [July 15, 2024, 5:27pm UTC](https://discuss.elastic.co/t/how-to-disable-tls1-1-on-elastic-agent/363171 "2024-07-15T17:27:15Z")
We are trying to disable TLS 1.1 service on port 8220 for the Elastic Agent Fleet Server. The configuration file is as follows，I have three three different configuration methods but it is still not working. The elastic… --- ## [Logstash 7.7 can’t establish pipeline with ssl](https://discuss.elastic.co/t/logstash-7-7-can-t-establish-pipeline-with-ssl/363026)
**Author:** [@Ankit5](https://discuss.elastic.co/u/Ankit5)\ **Replies:** 2\ **Last updated:** [July 15, 2024, 5:27pm UTC](https://discuss.elastic.co/t/logstash-7-7-can-t-establish-pipeline-with-ssl/363026 "2024-07-15T17:27:06Z")
Hi Everyone, So I have been trying to push data from logstash to Elastic using ssl. I am facing the issue when I am doing this thing on Logstash which is running on 7.7 and When I am doing same configuration on Logstash… --- ## [Identify the difference in data for two successive days](https://discuss.elastic.co/t/identify-the-difference-in-data-for-two-successive-days/363131)
**Author:** [@lshmikanth](https://discuss.elastic.co/u/lshmikanth)\ **Replies:** 2\ **Last updated:** [July 15, 2024, 3:53pm UTC](https://discuss.elastic.co/t/identify-the-difference-in-data-for-two-successive-days/363131 "2024-07-15T15:53:10Z")
I have a query which gives the tabular data on the key value pairs. I want to analyse the same query for two successive days and find out the new additions or deletions from the key values in the table. Any option avail… --- ## [X509: certificate signed by unknown authority + fleet "Set up encryption key" in kibana \> fleet](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-fleet-set-up-encryption-key-in-kibana-fleet/363062)
**Author:** [@Abdarrahmane](https://discuss.elastic.co/u/Abdarrahmane)\ **Replies:** 6\ **Last updated:** [July 15, 2024, 3:40pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-fleet-set-up-encryption-key-in-kibana-fleet/363062 "2024-07-15T15:40:14Z")
hello i really really need help please creating a fleet server i have an elasticsearch cluster with 2 nodes (192.168.1.15:9200, 192.168.1.16:9200) and kibana instance 192.168.1.20:5601, and a fleetserver 192.168.1.23:82… --- ## [Java client 7.6.2 socket timeout seems has problem](https://discuss.elastic.co/t/java-client-7-6-2-socket-timeout-seems-has-problem/362460)
**Author:** [@renhongchao](https://discuss.elastic.co/u/renhongchao)\ **Replies:** 4\ **Last updated:** [July 15, 2024, 3:39pm UTC](https://discuss.elastic.co/t/java-client-7-6-2-socket-timeout-seems-has-problem/362460 "2024-07-15T15:39:22Z")
RestClientBuilder builder = RestClient.builder(httpHostArray) .setRequestConfigCallback(requestConfigBuilder -\> requestConfigBuilder .setConnectTimeout(connectTimeout) … --- ## [Grok patter is not parsing multiline log](https://discuss.elastic.co/t/grok-patter-is-not-parsing-multiline-log/363164)
**Author:** [@Nitesh\_Singhal](https://discuss.elastic.co/u/Nitesh_Singhal)\ **Replies:** 0\ **Last updated:** [July 15, 2024, 3:15pm UTC](https://discuss.elastic.co/t/grok-patter-is-not-parsing-multiline-log/363164 "2024-07-15T15:15:31Z")
Hi, I have a log line in multiline pattern and my grok parser is only parsing one line of the log and ignoring the others. How this can be fixed to include the complete message? filebeat.inputs: - type: log enabled: t… --- ## [Duplicate data](https://discuss.elastic.co/t/duplicate-data/363091)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 3\ **Last updated:** [July 15, 2024, 2:58pm UTC](https://discuss.elastic.co/t/duplicate-data/363091 "2024-07-15T14:58:53Z")
I have an indicator with duplicate data I want to delete this duplicate data and keep only one and the rest of the duplicates are deleted I want to do this operation periodically What is the best practice to do this? P… --- ## [Both Visualization tools and discover tab are showing nothing](https://discuss.elastic.co/t/both-visualization-tools-and-discover-tab-are-showing-nothing/363111)
**Author:** [@Hipper\_Ride](https://discuss.elastic.co/u/Hipper_Ride)\ **Replies:** 3\ **Last updated:** [July 15, 2024, 2:46pm UTC](https://discuss.elastic.co/t/both-visualization-tools-and-discover-tab-are-showing-nothing/363111 "2024-07-15T14:46:34Z")
Hi, I have encountered a issue that I dont know why there is no result inside the discover tab. I have also tried to do some visualization based on the dataset. But the results shows there is no results found. I have se… --- ## [Controls - Pre Filtering](https://discuss.elastic.co/t/controls-pre-filtering/363157)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [July 15, 2024, 2:21pm UTC](https://discuss.elastic.co/t/controls-pre-filtering/363157 "2024-07-15T14:21:59Z")
Hello, As continuing to leverage Controls, is there a way to filter the data when creating controls? The issue is alot of data is considered since its under the same index, but we want to narrow it down like only show e… --- ## [Issue with BufferOverflowException from logstash agent](https://discuss.elastic.co/t/issue-with-bufferoverflowexception-from-logstash-agent/363156)
**Author:** [@Tachion1337](https://discuss.elastic.co/u/Tachion1337)\ **Replies:** 0\ **Last updated:** [July 15, 2024, 2:04pm UTC](https://discuss.elastic.co/t/issue-with-bufferoverflowexception-from-logstash-agent/363156 "2024-07-15T14:04:23Z")
Recently during logstash pod startup I've started getting the error trace below. Could you give me a hint where to look for a solution? ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::Pipe… --- ## [Ignore\_malformed within an object](https://discuss.elastic.co/t/ignore-malformed-within-an-object/363147)
**Author:** [@TiredPanda](https://discuss.elastic.co/u/TiredPanda)\ **Replies:** 2\ **Last updated:** [July 15, 2024, 1:37pm UTC](https://discuss.elastic.co/t/ignore-malformed-within-an-object/363147 "2024-07-15T13:37:53Z")
Hi, can anyone provide confirmation or clarification if using ignore\_malformed on a property within an object is supported. The docs say they are not supported on object types but does this extend to properties within t… --- ## [Getting exception "Timed out while waiting for a dynamic mapping update"](https://discuss.elastic.co/t/getting-exception-timed-out-while-waiting-for-a-dynamic-mapping-update/362719)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 5\ **Last updated:** [July 15, 2024, 1:34pm UTC](https://discuss.elastic.co/t/getting-exception-timed-out-while-waiting-for-a-dynamic-mapping-update/362719 "2024-07-15T13:34:34Z")
Hi we have dynamic mappings for our indices, we are receiving below exception while bulk indexing using kafka-connect-elasticsearch plugin type: mapper\_exception, reason: timed out while waiting for a dynamic mapping u… --- ## [Performance comparison: KQL vs ES|QL vs DSL](https://discuss.elastic.co/t/performance-comparison-kql-vs-es-ql-vs-dsl/363151)
**Author:** [@yar](https://discuss.elastic.co/u/yar)\ **Replies:** 0\ **Last updated:** [July 15, 2024, 1:33pm UTC](https://discuss.elastic.co/t/performance-comparison-kql-vs-es-ql-vs-dsl/363151 "2024-07-15T13:33:04Z")
Hi! I'm facing some performance degradation with my ELK setup. I believe that poorly written querys are one of the main causes of this degradation. Due to the specific use cases I must write queries with a lot of OR sta… --- ## [Syslog input to logstash time zone - drifts by 2h. everything set to UTC](https://discuss.elastic.co/t/syslog-input-to-logstash-time-zone-drifts-by-2h-everything-set-to-utc/362905)
**Author:** [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Replies:** 4\ **Last updated:** [July 15, 2024, 1:32pm UTC](https://discuss.elastic.co/t/syslog-input-to-logstash-time-zone-drifts-by-2h-everything-set-to-utc/362905 "2024-07-15T13:32:03Z")
Debug stdout logstash | { logstash | "message" =\> "notice syslog-ng\[2219\]: Syslog connection established; fd='67', server='AF\_INET(10.6.10.93:5140)', local='AF\_INET(0.0.0.0:0)'\\n", logstash | "e… --- ## [Setting up password as env variable is not woking in openshift](https://discuss.elastic.co/t/setting-up-password-as-env-variable-is-not-woking-in-openshift/363045)
**Author:** [@Sohaib\_El\_Mediouni](https://discuss.elastic.co/u/Sohaib_El_Mediouni)\ **Replies:** 2\ **Last updated:** [July 15, 2024, 12:19pm UTC](https://discuss.elastic.co/t/setting-up-password-as-env-variable-is-not-woking-in-openshift/363045 "2024-07-15T12:19:32Z")
Hello, I'm trying to implement basic security for my elasticsearch in openshift using a statefulset. The problem I have encountered is that when I deploy my statefulset and try to test my elasticsearch, it gives me the … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=202) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=204)