# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=209 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 210 --- ## [Get Max Aggregate value for top N hits from elasticsearch](https://discuss.elastic.co/t/get-max-aggregate-value-for-top-n-hits-from-elasticsearch/362485)
**Author:** [@Het\_Test](https://discuss.elastic.co/u/Het_Test)\ **Replies:** 3\ **Last updated:** [July 5, 2024, 5:41pm UTC](https://discuss.elastic.co/t/get-max-aggregate-value-for-top-n-hits-from-elasticsearch/362485 "2024-07-05T17:41:12Z")
Hey guys, I have an Elasticsearch field called activity\_time, and I need to get the maximum activity\_time from a subset of my data. For Ex, I want to get the max value of activity\_time from the first 100 records when s… --- ## [Issue when enabling TLS in Fluent-bit with Elasticsearch as output](https://discuss.elastic.co/t/issue-when-enabling-tls-in-fluent-bit-with-elasticsearch-as-output/362573)
**Author:** [@Aingeru\_Scotland](https://discuss.elastic.co/u/Aingeru_Scotland)\ **Replies:** 2\ **Last updated:** [July 5, 2024, 5:02pm UTC](https://discuss.elastic.co/t/issue-when-enabling-tls-in-fluent-bit-with-elasticsearch-as-output/362573 "2024-07-05T17:02:43Z")
I am setting a EFK stack in a Kubernetes single host cluster. Everything works perfectly with http. However, when I enable TLS in Fluent-bit ConfigMap, I experience the following error: \[2024/07/04 16:51:57\] \[error\] \[tl… --- ## [Kibana not ready yet](https://discuss.elastic.co/t/kibana-not-ready-yet/362586)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 1\ **Last updated:** [July 5, 2024, 2:08pm UTC](https://discuss.elastic.co/t/kibana-not-ready-yet/362586 "2024-07-05T14:08:59Z")
Hi im new in elasticstack and try to install elasticsearch nad kibana in virtualbox. I have 2VM network setting a had 2adapter one nat network and 2nd inet. VM can see each other. Everything wokrs well if i use http. I… --- ## [Problem in installing & configuration of elasticsearch](https://discuss.elastic.co/t/problem-in-installing-configuration-of-elasticsearch/362465)
**Author:** [@arjun2001](https://discuss.elastic.co/u/arjun2001)\ **Replies:** 9\ **Last updated:** [July 5, 2024, 1:49pm UTC](https://discuss.elastic.co/t/problem-in-installing-configuration-of-elasticsearch/362465 "2024-07-05T13:49:58Z")
Actually my requirement is to implement the elasticsearch in my angular application. so i installed the jvm & elasticsearch from the official websites and also i am successfully installed & configured that. but now i am … --- ## [Canvas Chart Area using count/sum and Timestamp](https://discuss.elastic.co/t/canvas-chart-area-using-count-sum-and-timestamp/362608)
**Author:** [@Mang0](https://discuss.elastic.co/u/Mang0)\ **Replies:** 4\ **Last updated:** [July 5, 2024, 1:38pm UTC](https://discuss.elastic.co/t/canvas-chart-area-using-count-sum-and-timestamp/362608 "2024-07-05T13:38:18Z")
Hi ! I'm trying to use an area chart in canvas, with timestamp data on x and a count or a sum on y. The two cases I'm trying to set up: The sum : with this SQL query: SELECT round(sum(nonTaxedPrice),3) as caht, s… --- ## [All nodes are offline in the kibana dashboard](https://discuss.elastic.co/t/all-nodes-are-offline-in-the-kibana-dashboard/362613)
**Author:** [@Abdarrahmane](https://discuss.elastic.co/u/Abdarrahmane)\ **Replies:** 0\ **Last updated:** [July 5, 2024, 12:45pm UTC](https://discuss.elastic.co/t/all-nodes-are-offline-in-the-kibana-dashboard/362613 "2024-07-05T12:45:28Z")
hello, i'm currently learning about ELK stack and i'm in love with this solution background: my goal is Understanding and setting up a comprehensive security monitoring and incident response environment in my home lab… --- ## [Malformed csv error while reading csv file with Logstash](https://discuss.elastic.co/t/malformed-csv-error-while-reading-csv-file-with-logstash/362601)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 1\ **Last updated:** [July 5, 2024, 12:37pm UTC](https://discuss.elastic.co/t/malformed-csv-error-while-reading-csv-file-with-logstash/362601 "2024-07-05T12:37:41Z")
Hi all, I try to read a .csv file using logstash, it works like a charm but for just a few lines I get the error "(MalformedCSVError) Illegal quoting in line 1." The error occurs whenever a field contains a value with … --- ## [How can I avoid existing semantic query slowdown during re-indexing using ELSER model in Elastic Search V8](https://discuss.elastic.co/t/how-can-i-avoid-existing-semantic-query-slowdown-during-re-indexing-using-elser-model-in-elastic-search-v8/362468)
**Author:** [@sudom0nk](https://discuss.elastic.co/u/sudom0nk)\ **Replies:** 5\ **Last updated:** [July 5, 2024, 11:28am UTC](https://discuss.elastic.co/t/how-can-i-avoid-existing-semantic-query-slowdown-during-re-indexing-using-elser-model-in-elastic-search-v8/362468 "2024-07-05T11:28:42Z")
We are using Elastic ELSER model for Semantic Search. I follow this doc to create my semantic tokens in the index: Tutorial: semantic search with ELSER | Elasticsearch Guide \[8.14\] | Elastic The Problem: The search data… --- ## [How to filter in multi knn query](https://discuss.elastic.co/t/how-to-filter-in-multi-knn-query/362582)
**Author:** [@melkon](https://discuss.elastic.co/u/melkon)\ **Replies:** 1\ **Last updated:** [July 5, 2024, 7:52am UTC](https://discuss.elastic.co/t/how-to-filter-in-multi-knn-query/362582 "2024-07-05T07:52:36Z")
Hi. I'm trying to use filter in multi knn query but getting below error. It's working with the example from docs but I need to apply pre filter for case when knn is array of many knn queries. Elasticsearch::Transport… --- ## [Integrating filebeat Causes exec.Command to Fail](https://discuss.elastic.co/t/integrating-filebeat-causes-exec-command-to-fail/362554)
**Author:** [@cuizhipeng326](https://discuss.elastic.co/u/cuizhipeng326)\ **Replies:** 1\ **Last updated:** [July 5, 2024, 7:44am UTC](https://discuss.elastic.co/t/integrating-filebeat-causes-exec-command-to-fail/362554 "2024-07-05T07:44:04Z")
I am currently integrating filebeat into my project. I have encountered an issue: I start a goroutine in my project to launch the filebeat plugin. The plugin starts successfully, but the strange thing is that after it st… --- ## [After enable-elasticsearch-plugin.sh, the es cannot start](https://discuss.elastic.co/t/after-enable-elasticsearch-plugin-sh-the-es-cannot-start/362501)
**Author:** [@mixsuffix](https://discuss.elastic.co/u/mixsuffix)\ **Replies:** 6\ **Last updated:** [July 5, 2024, 7:33am UTC](https://discuss.elastic.co/t/after-enable-elasticsearch-plugin-sh-the-es-cannot-start/362501 "2024-07-05T07:33:51Z")
uncaught exception in thread \[main\] java.lang.IllegalStateException: failed to load plugin ranger-elasticsearch-plugin due to jar hell Likely root cause: java.security.AccessControlException: access denied ("java.io.File… --- ## [Dynamic role mapping of OIDC Realm ID value to Realm ID field value in document](https://discuss.elastic.co/t/dynamic-role-mapping-of-oidc-realm-id-value-to-realm-id-field-value-in-document/362371)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 3\ **Last updated:** [July 5, 2024, 6:48am UTC](https://discuss.elastic.co/t/dynamic-role-mapping-of-oidc-realm-id-value-to-realm-id-field-value-in-document/362371 "2024-07-05T06:48:27Z")
Hello, Looking for some suggestions regarding dynamic role mapping between Realm ID field value returned from OIDC token claim and Realm ID field value in document. Could not find strong documentation regarding it. Is … --- ## [Kibana Integration Monitoring over server.publicBaseUrl](https://discuss.elastic.co/t/kibana-integration-monitoring-over-server-publicbaseurl/362593)
**Author:** [@hellenbart](https://discuss.elastic.co/u/hellenbart)\ **Replies:** 0\ **Last updated:** [July 5, 2024, 6:35am UTC](https://discuss.elastic.co/t/kibana-integration-monitoring-over-server-publicbaseurl/362593 "2024-07-05T06:35:51Z")
Good morning everbody I wondering if someone has experience with Monitoring Kibana over the Elasticsearch integration. We replaced the deprecated xpack monitoring and switched all to the new integration monitoring. Th… --- ## [Logstash Http-input-plugin not closed properly FD process](https://discuss.elastic.co/t/logstash-http-input-plugin-not-closed-properly-fd-process/362511)
**Author:** [@pradeep-logstashuser](https://discuss.elastic.co/u/pradeep-logstashuser)\ **Replies:** 4\ **Last updated:** [July 5, 2024, 3:51am UTC](https://discuss.elastic.co/t/logstash-http-input-plugin-not-closed-properly-fd-process/362511 "2024-07-05T03:51:59Z")
Hi, I am using Logstash 8.10.0 with the HTTP input plugin and having 2 outputs, one using the HTTP output plugin and the other using the file output. The file rotation will occur every 1 hour, and my system-level ulimit… --- ## [Frequent Creation of Threads by elastic.clients](https://discuss.elastic.co/t/frequent-creation-of-threads-by-elastic-clients/362505)
**Author:** [@tom\_ding](https://discuss.elastic.co/u/tom_ding)\ **Replies:** 10\ **Last updated:** [July 5, 2024, 1:41am UTC](https://discuss.elastic.co/t/frequent-creation-of-threads-by-elastic-clients/362505 "2024-07-05T01:41:50Z")
I am using Elasticsearch Java API Client \[8.13\] and Elasticsearch (8.13), but I encounter the following exception: 复制代码 unable to create native thread: possibly out of memory or process/resource limits reached at j… --- ## [ElasticSearch partial update request merge Map\<\>](https://discuss.elastic.co/t/elasticsearch-partial-update-request-merge-map/362559)
**Author:** [@nolik](https://discuss.elastic.co/u/nolik)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-partial-update-request-merge-map/362559 "2024-07-04T13:42:02Z")
I have a complex ES document with multiple fields: public class SomeDocument { @JsonProperty("id") private final String id; ... @JsonProperty("hits") private final Map\ hits = new HashMap\<\>(); }… --- ## [Duplicate Fields in JSON Response payload when querying Kibana Dashboard Using Discover Tab](https://discuss.elastic.co/t/duplicate-fields-in-json-response-payload-when-querying-kibana-dashboard-using-discover-tab/362571)
**Author:** [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\ **Replies:** 3\ **Last updated:** [July 4, 2024, 7:34pm UTC](https://discuss.elastic.co/t/duplicate-fields-in-json-response-payload-when-querying-kibana-dashboard-using-discover-tab/362571 "2024-07-04T19:34:18Z")
Hi, I am running the latest version of Elastic Stack Elasticsearch version 8.14.2 | Elasticsearch Guide \[8.14\] | Elastic on Red Hat Enterprise Linux OS version 8.10 (8.10 Release Notes | Red Hat Product Documentation). … --- ## [Mapping how and where](https://discuss.elastic.co/t/mapping-how-and-where/362577)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 7:31pm UTC](https://discuss.elastic.co/t/mapping-how-and-where/362577 "2024-07-04T19:31:00Z")
According to what I have read, when the data is ingested it receives a default text value. At this moment I am in the task of mapping to define the correct type of the fields since for example "src" has "text" type. Thi… --- ## [Getting shard id in script engine](https://discuss.elastic.co/t/getting-shard-id-in-script-engine/362566)
**Author:** [@ktech007](https://discuss.elastic.co/u/ktech007)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 3:51pm UTC](https://discuss.elastic.co/t/getting-shard-id-in-script-engine/362566 "2024-07-04T15:51:14Z")
In a plugin like this where it's extending ScriptEngine, LeafFactory, and DocReader, is it possible to get the shard the script is running on? I assume the script would run on each shard individually and then combine da… --- ## [Delete data older than 30 days](https://discuss.elastic.co/t/delete-data-older-than-30-days/362564)
**Author:** [@lshmikanth](https://discuss.elastic.co/u/lshmikanth)\ **Replies:** 1\ **Last updated:** [July 4, 2024, 2:38pm UTC](https://discuss.elastic.co/t/delete-data-older-than-30-days/362564 "2024-07-04T14:38:28Z")
I have an index in Elasticsearch which stores huge data. Till two weeks I was able to delete the data older than 30 days by DELETE BY QUERY with some time. At that time it's storage is 40% used. Now it has reached 77% an… --- ## [Kiabana Server is not ready yet](https://discuss.elastic.co/t/kiabana-server-is-not-ready-yet/361738)
**Author:** [@rash4ford](https://discuss.elastic.co/u/rash4ford)\ **Replies:** 4\ **Last updated:** [July 4, 2024, 2:26pm UTC](https://discuss.elastic.co/t/kiabana-server-is-not-ready-yet/361738 "2024-07-04T14:26:21Z")
Hi Team, Can someone please help to translate this log below also advise with the fix. Any help is greatly appreciated. Thank you "observability.threshold".","log":{"level":"INFO","logger":"plugins.alerting"},"proces… --- ## [Winlogbeat windows server event issue](https://discuss.elastic.co/t/winlogbeat-windows-server-event-issue/362561)
**Author:** [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 2:11pm UTC](https://discuss.elastic.co/t/winlogbeat-windows-server-event-issue/362561 "2024-07-04T14:11:23Z")
Hello everyone ! I'm having weird issue with winlogbeat. When I use winlogbeat on Windows 10, after I create a windows user it uses fields such as "process.name", "process.parent.args" etc. But when I create a user on… --- ## [Snapshot to S3 error](https://discuss.elastic.co/t/snapshot-to-s3-error/362547)
**Author:** [@koskartsev](https://discuss.elastic.co/u/koskartsev)\ **Replies:** 2\ **Last updated:** [July 4, 2024, 2:18pm UTC](https://discuss.elastic.co/t/snapshot-to-s3-error/362547 "2024-07-04T14:18:02Z")
Hi, Elasticsearch 8.2.3 I'm trying to add an S3 snapshot repository, the endpoint is Yandexcloud S3 I've set the keys in the keystore on all master nodes, check it with show elasticsearch-keystore add s3.client.defau… --- ## [How to sort on nested values that matches certain filters](https://discuss.elastic.co/t/how-to-sort-on-nested-values-that-matches-certain-filters/362557)
**Author:** [@juanm889](https://discuss.elastic.co/u/juanm889)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 1:25pm UTC](https://discuss.elastic.co/t/how-to-sort-on-nested-values-that-matches-certain-filters/362557 "2024-07-04T13:25:43Z")
I want to sort by the field has\_stock (sending false to the bottom) but only on those elements of the nested that matches the query { "mappings": { "properties": { "product\_id": { … --- ## [Logstash snmptrap](https://discuss.elastic.co/t/logstash-snmptrap/361403)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 13\ **Last updated:** [July 4, 2024, 1:07pm UTC](https://discuss.elastic.co/t/logstash-snmptrap/361403 "2024-07-04T13:07:03Z")
Hello everyone, I enabled receiving SNMP traps as input on my Logstash server with the following addition to the configuration: input { snmptrap { id =\> "snmptrap" } } I am sending an SNMP trap to the server. … --- ## [Multiple Syslog Integrations, Port 514](https://discuss.elastic.co/t/multiple-syslog-integrations-port-514/362553)
**Author:** [@MaxFeng](https://discuss.elastic.co/u/MaxFeng)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 1:01pm UTC](https://discuss.elastic.co/t/multiple-syslog-integrations-port-514/362553 "2024-07-04T13:01:19Z")
Hello everyone, I'm still quite new to the Elastic world and currently managing the PoC at our company. The environment is running quite well so far, and various systems are connected. However, I have the following prob… --- ## [Remove exotic modules fields from filebeat template](https://discuss.elastic.co/t/remove-exotic-modules-fields-from-filebeat-template/362551)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 12:51pm UTC](https://discuss.elastic.co/t/remove-exotic-modules-fields-from-filebeat-template/362551 "2024-07-04T12:51:48Z")
When filebeat runs, it creates an index template "filebeat-8.14.1" with a ton of mapping fields: "kafka", "santa" etc.... This is fine but when an user creates a dashboard, he sees all these fields and lost time to fin… --- ## [.kibana index is not available for snapshot](https://discuss.elastic.co/t/kibana-index-is-not-available-for-snapshot/362546)
**Author:** [@Rade\_Pajic](https://discuss.elastic.co/u/Rade_Pajic)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 12:16pm UTC](https://discuss.elastic.co/t/kibana-index-is-not-available-for-snapshot/362546 "2024-07-04T12:16:19Z")
I'm trying to implement Kibana dashboard snapshots. As far as I know, dashboards are saved in the .kibana\* index. In my case, it is .kibana\_8.13.4\_001 since I am using Kibana version 8.13.4. I can see that index under In… --- ## [Filtering and Processing XML Logs in Logstash for JSON Conversion](https://discuss.elastic.co/t/filtering-and-processing-xml-logs-in-logstash-for-json-conversion/362515)
**Author:** [@ayushyadav685](https://discuss.elastic.co/u/ayushyadav685)\ **Replies:** 1\ **Last updated:** [July 4, 2024, 11:43am UTC](https://discuss.elastic.co/t/filtering-and-processing-xml-logs-in-logstash-for-json-conversion/362515 "2024-07-04T11:43:19Z")
Hi All, I want to use only a few parameterized XML tags to convert into JSON and remove all other parameterized tags before processing. My XML log looks like this: \ \ \ **Author:** [@checo2024](https://discuss.elastic.co/u/checo2024)\ **Replies:** 11\ **Last updated:** [July 4, 2024, 11:40am UTC](https://discuss.elastic.co/t/cisco-ftd-integration/360496 "2024-07-04T11:40:20Z") Thank you fore reading my message. Situation: After installing Cisco FTD Integration with Fleet Manager, it seems that the Dataset is not created. Looking in Fleet -\> Data streams, searching for cisco\* and nothing is… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=208) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=210)