# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=212 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 213 --- ## [Selecting aggregation type when interval is scaled due to too many buckets](https://discuss.elastic.co/t/selecting-aggregation-type-when-interval-is-scaled-due-to-too-many-buckets/362291)
**Author:** [@vinay.nadig](https://discuss.elastic.co/u/vinay.nadig)\ **Replies:** 0\ **Last updated:** [July 1, 2024, 11:40am UTC](https://discuss.elastic.co/t/selecting-aggregation-type-when-interval-is-scaled-due-to-too-many-buckets/362291 "2024-07-01T11:40:09Z")
We just migrated from Elasticsearch 5.6 to 8.14 and we are seeing a bit of a difference in how the histogram in the discover section works. In 5.6, if an interval is scaled because of too many buckets, the histogram wou… --- ## [Elastic Field Types - Range Query](https://discuss.elastic.co/t/elastic-field-types-range-query/362249)
**Author:** [@Karthik\_Vaidyanathan](https://discuss.elastic.co/u/Karthik_Vaidyanathan)\ **Replies:** 1\ **Last updated:** [July 1, 2024, 10:28am UTC](https://discuss.elastic.co/t/elastic-field-types-range-query/362249 "2024-07-01T10:28:32Z")
Hello All, Pretty new to using Elastic and currently using the Serverless option. I have a field called street number , currently it's stored as a text. It contains values which are both string and text: \[100, 101A, 10… --- ## [Elastic search Managed instance on Azure - Data storage](https://discuss.elastic.co/t/elastic-search-managed-instance-on-azure-data-storage/362276)
**Author:** [@Bipindra.1.s](https://discuss.elastic.co/u/Bipindra.1.s)\ **Replies:** 3\ **Last updated:** [July 1, 2024, 9:09am UTC](https://discuss.elastic.co/t/elastic-search-managed-instance-on-azure-data-storage/362276 "2024-07-01T09:09:27Z")
We are planning to use elastic cloud managed instance from azure portal. what I understood that Azure portal is only for billing purpose actual instance will be created on elastic cloud only. Below are some queries relat… --- ## [Constant merges in new index](https://discuss.elastic.co/t/constant-merges-in-new-index/360710)
**Author:** [@margilit](https://discuss.elastic.co/u/margilit)\ **Replies:** 8\ **Last updated:** [July 1, 2024, 6:39am UTC](https://discuss.elastic.co/t/constant-merges-in-new-index/360710 "2024-07-01T06:39:03Z")
When creating a new index, we often see a significant and sustained increase in the number of internal refreshes. Merges are constantly triggered, affecting CPU usage and search speed accordingly. The only workaround we … --- ## [Filebeats rotateeverybytes not work v8.14](https://discuss.elastic.co/t/filebeats-rotateeverybytes-not-work-v8-14/362272)
**Author:** [@shahrestanaki](https://discuss.elastic.co/u/shahrestanaki)\ **Replies:** 0\ **Last updated:** [July 1, 2024, 6:34am UTC](https://discuss.elastic.co/t/filebeats-rotateeverybytes-not-work-v8-14/362272 "2024-07-01T06:34:55Z")
hello. i set this config but all log file fixed on 12kb logging.level: debug logging.to\_files: true logging.files: path: /opt/filebeats/log name: filebeat rotateeverybytes: 10485760 keepfiles: 7 permissions: 0… --- ## [Elastic Agent Best Practice in remote cluster scenarios](https://discuss.elastic.co/t/elastic-agent-best-practice-in-remote-cluster-scenarios/362206)
**Author:** [@Juma](https://discuss.elastic.co/u/Juma)\ **Replies:** 2\ **Last updated:** [July 1, 2024, 6:26am UTC](https://discuss.elastic.co/t/elastic-agent-best-practice-in-remote-cluster-scenarios/362206 "2024-07-01T06:26:42Z")
Hello everybody, we use Elasticsearch as our SIEM/SOC solution for different customers. Our environment is based on ECK and to not mix data between our customers, we have a seperate one for each customer. Our SIEM rul… --- ## [\[User error, please ignore\] Can't upgrade from 7.17.19 to ES8. Docs indicate that you should be able to](https://discuss.elastic.co/t/user-error-please-ignore-cant-upgrade-from-7-17-19-to-es8-docs-indicate-that-you-should-be-able-to/362229)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 12\ **Last updated:** [July 1, 2024, 6:06am UTC](https://discuss.elastic.co/t/user-error-please-ignore-cant-upgrade-from-7-17-19-to-es8-docs-indicate-that-you-should-be-able-to/362229 "2024-07-01T06:06:13Z")
I am upgrading from 7.17.19 to 8.11.3 specifically and got the following message: Upgrading to \[8.11.3\] is only supported from version \[7.17.0\] (full error below) \[2024-06-28T19:16:18,650\]\[ERROR\]\[org.elasticsearch.boot… --- ## [I need to upgrade my on prem setup from docker-compose](https://discuss.elastic.co/t/i-need-to-upgrade-my-on-prem-setup-from-docker-compose/361882)
**Author:** [@sourabh\_rawat](https://discuss.elastic.co/u/sourabh_rawat)\ **Replies:** 4\ **Last updated:** [July 1, 2024, 5:11am UTC](https://discuss.elastic.co/t/i-need-to-upgrade-my-on-prem-setup-from-docker-compose/361882 "2024-07-01T05:11:24Z")
Hi, I did an on-prem setup from a docker-compose.yml. Now I wanted to upgrade to 8.14.1 from 8.6. Not able to find any simple step. I tried changing the version to 8.14.1 in the env file. After running the command do… --- ## [Cannot race, worker has exited prematurely](https://discuss.elastic.co/t/cannot-race-worker-has-exited-prematurely/362145)
**Author:** [@Varun\_Tokas](https://discuss.elastic.co/u/Varun_Tokas)\ **Replies:** 6\ **Last updated:** [July 1, 2024, 3:49am UTC](https://discuss.elastic.co/t/cannot-race-worker-has-exited-prematurely/362145 "2024-07-01T03:49:15Z")
When using Elasticsearch, I keep getting errors of this sort. $ esrally race --track-path=. --pipeline=benchmark-only --target-hosts="https://10.43.34.12:9200" --client-options="basic\_auth\_user:'elastic',basic\_auth\_pass… --- ## [Legacy index template is ignored](https://discuss.elastic.co/t/legacy-index-template-is-ignored/362246)
**Author:** [@siakc](https://discuss.elastic.co/u/siakc)\ **Replies:** 1\ **Last updated:** [June 30, 2024, 2:11pm UTC](https://discuss.elastic.co/t/legacy-index-template-is-ignored/362246 "2024-06-30T14:11:37Z")
I have a new style index template without any mapping and a legacy one with all the mappings. The matching indices do not inherit mapping from the legacy one. I expected the two templates to merge. This is a related iss… --- ## [Elastic-agents Fleet policy](https://discuss.elastic.co/t/elastic-agents-fleet-policy/362247)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 1\ **Last updated:** [June 30, 2024, 2:01pm UTC](https://discuss.elastic.co/t/elastic-agents-fleet-policy/362247 "2024-06-30T14:01:59Z")
Hello everyone, I manage Elastic agents using Fleet server. All agents of a certain type have a uniform policy that I prepared for them in Fleet. Sometimes there is a situation where I need to change a setting in the po… --- ## [logstash reading source file and send data to elasticsearch but not displaying in kibanaa dashboard](https://discuss.elastic.co/t/logstash-reading-source-file-and-send-data-to-elasticsearch-but-not-displaying-in-kibanaa-dashboard/362076)
**Author:** [@manjunath\_mone](https://discuss.elastic.co/u/manjunath_mone)\ **Replies:** 5\ **Last updated:** [June 30, 2024, 5:33am UTC](https://discuss.elastic.co/t/logstash-reading-source-file-and-send-data-to-elasticsearch-but-not-displaying-in-kibanaa-dashboard/362076 "2024-06-30T05:33:10Z")
Hi, logstash beat pipe is sending data to elasticsearch, but not all logs displaying in the kibana, but if I restart the logstash beat pipe it will work for some time after few hours or next day again, I do face same is… --- ## [How to store geoshape Linestring with C#?](https://discuss.elastic.co/t/how-to-store-geoshape-linestring-with-c/361950)
**Author:** [@Motsols](https://discuss.elastic.co/u/Motsols)\ **Replies:** 9\ **Last updated:** [June 30, 2024, 8:27am UTC](https://discuss.elastic.co/t/how-to-store-geoshape-linestring-with-c/361950 "2024-06-30T08:27:48Z")
Using the latest .NET client Elastic.Clients.Elasticsearch 8.14.3, how can I in code add a geoJSON geoshape of type LineString to Elasticsearch? The documentation is completely lacking information on this and I have yet… --- ## [Elastic Agent ca\_trusted\_fingerprint does not working, but the certificate works](https://discuss.elastic.co/t/elastic-agent-ca-trusted-fingerprint-does-not-working-but-the-certificate-works/362239)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 9\ **Last updated:** [June 30, 2024, 12:53am UTC](https://discuss.elastic.co/t/elastic-agent-ca-trusted-fingerprint-does-not-working-but-the-certificate-works/362239 "2024-06-30T00:53:04Z")
Hello, I've built a simple docker compose that will spin up a single node cluster with Elasticsearch, Kibana and a Fleet server and I'm facing an issue where the ca\_trusted\_fingerprint is not working as expected. The c… --- ## [Speed up Indexing](https://discuss.elastic.co/t/speed-up-indexing/362243)
**Author:** [@venkatesh\_aamanchi](https://discuss.elastic.co/u/venkatesh_aamanchi)\ **Replies:** 4\ **Last updated:** [June 29, 2024, 4:28pm UTC](https://discuss.elastic.co/t/speed-up-indexing/362243 "2024-06-29T16:28:36Z")
I have a deployment setup with 2 nodes and a storage of 70GB. I need to index 20 million records. Uploading just these documents is taking me a little over 4 hrs. Is there anyway to speed up the process? I do not have a… --- ## [Why agent version check is stuck?](https://discuss.elastic.co/t/why-agent-version-check-is-stuck/362241)
**Author:** [@0xankit](https://discuss.elastic.co/u/0xankit)\ **Replies:** 0\ **Last updated:** [June 29, 2024, 6:11am UTC](https://discuss.elastic.co/t/why-agent-version-check-is-stuck/362241 "2024-06-29T06:11:06Z")
When I'm trying to add agent this api is being hit from kibana. http://localhost:5601/api/fleet/agents/available\_versions But is it getting stuck. In my local setup it is working fine, but on remote facing this issue. … --- ## [Sharding and partitioning on the ES Index](https://discuss.elastic.co/t/sharding-and-partitioning-on-the-es-index/361122)
**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\ **Replies:** 2\ **Last updated:** [June 29, 2024, 2:53am UTC](https://discuss.elastic.co/t/sharding-and-partitioning-on-the-es-index/361122 "2024-06-29T02:53:27Z")
Currently we have our data in MongoDB and we will continue to keep it there for ACID compliance. However we are moving our search capabilities to Elastic. Since our app supports multi-tenancy our MongoDB architecture is … --- ## [Moving From 1.7.5 to 7.10.2 - DLS Changes](https://discuss.elastic.co/t/moving-from-1-7-5-to-7-10-2-dls-changes/362235)
**Author:** [@djfrodo](https://discuss.elastic.co/u/djfrodo)\ **Replies:** 13\ **Last updated:** [June 29, 2024, 1:42am UTC](https://discuss.elastic.co/t/moving-from-1-7-5-to-7-10-2-dls-changes/362235 "2024-06-29T01:42:07Z")
I've used an ancient (1.7.5) version of Elasticsearch for years and it's been great. The initial setup was a bit difficult, but when completed it has always been rock solid. Unfortunately my Elasticsearch provider wants… --- ## [Query to return documents with field A gt 10 AND field B gt 5](https://discuss.elastic.co/t/query-to-return-documents-with-field-a-gt-10-and-field-b-gt-5/362226)
**Author:** [@trs80](https://discuss.elastic.co/u/trs80)\ **Replies:** 4\ **Last updated:** [June 28, 2024, 7:40pm UTC](https://discuss.elastic.co/t/query-to-return-documents-with-field-a-gt-10-and-field-b-gt-5/362226 "2024-06-28T19:40:28Z")
Hi, can someone help me write the correct query if possible? I want to return documents with field A gt 10 AND field B gt 10. The below query only returns documents with filed A gt 10 and field B (but B is not gt 10). Pl… --- ## [Unable to Select New Index in Dashboard from DropDown](https://discuss.elastic.co/t/unable-to-select-new-index-in-dashboard-from-dropdown/362119)
**Author:** [@vdashora](https://discuss.elastic.co/u/vdashora)\ **Replies:** 3\ **Last updated:** [June 28, 2024, 6:02pm UTC](https://discuss.elastic.co/t/unable-to-select-new-index-in-dashboard-from-dropdown/362119 "2024-06-28T18:02:09Z")
Hi there, I recently updated my Python script and pushed to a new index, wxo\_Everything and I can see the index in the index management section of Kibana, but when I go to make a new dashboard and change the index, I do … --- ## [Parse logs Trent Micro Email Security](https://discuss.elastic.co/t/parse-logs-trent-micro-email-security/362217)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 5\ **Last updated:** [June 28, 2024, 3:00pm UTC](https://discuss.elastic.co/t/parse-logs-trent-micro-email-security/362217 "2024-06-28T15:00:32Z")
Hello everyone, I am currently in the process of normalizing and parsing logs from the manufacturer trend micro email security. Maybe for you it is obvious but in my case as I am not an expert I must mention that I am … --- ## [All of my agents stayed inactive](https://discuss.elastic.co/t/all-of-my-agents-stayed-inactive/362168)
**Author:** [@dmrlixos](https://discuss.elastic.co/u/dmrlixos)\ **Replies:** 4\ **Last updated:** [June 28, 2024, 2:53pm UTC](https://discuss.elastic.co/t/all-of-my-agents-stayed-inactive/362168 "2024-06-28T14:53:57Z")
I have 65 agents and today all these are inactive, I don't did any changes to the cluster to affect these agents. There's a way to recover these agents, my fleet server API are respond healthy curl -f https://localhos… --- ## [After elastic upgrade, cant cretae enrollment token](https://discuss.elastic.co/t/after-elastic-upgrade-cant-cretae-enrollment-token/362216)
**Author:** [@Tompa-boy](https://discuss.elastic.co/u/Tompa-boy)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 1:30pm UTC](https://discuss.elastic.co/t/after-elastic-upgrade-cant-cretae-enrollment-token/362216 "2024-06-28T13:30:15Z")
Hi, I run elastic and kibana with docker compose. My docker-compose.yaml services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:8.14.1 container\_name: es01 environment: - node.name=es… --- ## [Sentinelone RPM\_MOUNT is filling up space](https://discuss.elastic.co/t/sentinelone-rpm-mount-is-filling-up-space/362212)
**Author:** [@dhiyaneshwaran\_r](https://discuss.elastic.co/u/dhiyaneshwaran_r)\ **Replies:** 1\ **Last updated:** [June 28, 2024, 12:36pm UTC](https://discuss.elastic.co/t/sentinelone-rpm-mount-is-filling-up-space/362212 "2024-06-28T12:36:41Z")
Team, We are using Elasticsearch-8.12.2 version, where we are seeing the directory /opt/sentinelone with the same elastic user which is filling space in /opt/sentinelone/rpm\_mount Please clarify the below points: H… --- ## [NO rollover info found for an index with rollover target after reindexing](https://discuss.elastic.co/t/no-rollover-info-found-for-an-index-with-rollover-target-after-reindexing/362209)
**Author:** [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 12:20pm UTC](https://discuss.elastic.co/t/no-rollover-info-found-for-an-index-with-rollover-target-after-reindexing/362209 "2024-06-28T12:20:36Z")
For resolving mapping conflict, I was performing reindexing for log-llb index. I used the following API's but I have been seeing one ilm error ever since the reindexing. PUT /log-llb-testing … --- ## [How to query on computed script\_fields?](https://discuss.elastic.co/t/how-to-query-on-computed-script-fields/362205)
**Author:** [@Nicolas\_Noukies](https://discuss.elastic.co/u/Nicolas_Noukies)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 11:06am UTC](https://discuss.elastic.co/t/how-to-query-on-computed-script-fields/362205 "2024-06-28T11:06:30Z")
Hello, I would like to query on a script field. I'm trying this query without success : { "query": { "multi\_match": { "query": "machinbidule", "fields": \[ "name^9", "concatenated\_synon… --- ## [While expanding document getting red overlay in chrome](https://discuss.elastic.co/t/while-expanding-document-getting-red-overlay-in-chrome/361946)
**Author:** [@asharma08](https://discuss.elastic.co/u/asharma08)\ **Replies:** 9\ **Last updated:** [June 28, 2024, 10:17am UTC](https://discuss.elastic.co/t/while-expanding-document-getting-red-overlay-in-chrome/361946 "2024-06-28T10:17:45Z")
While expanding document getting red overlay in chrome (windows) but the same is working fine in chrome (macbook) and mozilla firefox (windows). Chrome Version 126.0.6478.115 (Official Build) (64-bit) --- ## [Unable to create index based on POD names with provided prefix](https://discuss.elastic.co/t/unable-to-create-index-based-on-pod-names-with-provided-prefix/362196)
**Author:** [@Mandar\_Pimplapure](https://discuss.elastic.co/u/Mandar_Pimplapure)\ **Replies:** 1\ **Last updated:** [June 28, 2024, 9:39am UTC](https://discuss.elastic.co/t/unable-to-create-index-based-on-pod-names-with-provided-prefix/362196 "2024-06-28T09:39:10Z")
We used multi\_format format to read logs but then indexes are not created properly with pod names. Here it seems unable to read pod\_name using below prefix : logstash\_prefix "{ENV\['K8S\_NODE\_NAME'\]}-${record\['kubernetes'… --- ## [Open modal ( Iframe ) to right click on \[widget\] table row value and send the row value on iframe . how can open the modal for specific \[widget\]table row value with right click](https://discuss.elastic.co/t/open-modal-iframe-to-right-click-on-widget-table-row-value-and-send-the-row-value-on-iframe-how-can-open-the-modal-for-specific-widget-table-row-value-with-right-click/362187)
**Author:** [@santosh\_kr\_pathak](https://discuss.elastic.co/u/santosh_kr_pathak)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 8:06am UTC](https://discuss.elastic.co/t/open-modal-iframe-to-right-click-on-widget-table-row-value-and-send-the-row-value-on-iframe-how-can-open-the-modal-for-specific-widget-table-row-value-with-right-click/362187 "2024-06-28T08:06:28Z")
Hello Team, I am try to create the some modal (iframe) for Kibana. Pls, help me out. I am trying to create the some modal ( iframe ) that open when i rightClick the \[widget\] table row value , Requirement below list S… --- ## [Multiline logs](https://discuss.elastic.co/t/multiline-logs/362166)
**Author:** [@adis3421](https://discuss.elastic.co/u/adis3421)\ **Replies:** 1\ **Last updated:** [June 28, 2024, 7:55am UTC](https://discuss.elastic.co/t/multiline-logs/362166 "2024-06-28T07:55:37Z")
Hi, I use custom logs integration to process custom logs, but this integration does not connect the multi-lines below: Custom logs configuration and sample log. Config in Custom Log: filebeat.inputs: type: filestrea… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=211) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=213)