# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=231 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 232 --- ## [Search\_after doesn't consider the parameter](https://discuss.elastic.co/t/search-after-doesnt-consider-the-parameter/360297)
**Author:** [@fatimah](https://discuss.elastic.co/u/fatimah)\ **Replies:** 2\ **Last updated:** [May 28, 2024, 10:07am UTC](https://discuss.elastic.co/t/search-after-doesnt-consider-the-parameter/360297 "2024-05-28T10:07:40Z")
Hello, this is my first topic ever. When I run this query it returns 10 documents,(10 is the default number) resp = elastic\_config.open\_point\_in\_time(index='my\_index', keep\_alive='1m') pit\_clause = { 'id': … --- ## [Elasticsearch ECK in CrashLoopBackoff after node failure](https://discuss.elastic.co/t/elasticsearch-eck-in-crashloopbackoff-after-node-failure/360281)
**Author:** [@grazingelk](https://discuss.elastic.co/u/grazingelk)\ **Replies:** 5\ **Last updated:** [May 28, 2024, 9:57am UTC](https://discuss.elastic.co/t/elasticsearch-eck-in-crashloopbackoff-after-node-failure/360281 "2024-05-28T09:57:15Z")
Hi all, We have an ECK cluster v8.13.2 running on Kubernetes v1.29.2. The cluster has dedicated hot and warm data nodes. We have completed the load test and are now at the stage where we want to test recovery from fail… --- ## [Cannot recover kibana indices due to 'Too many open files' error](https://discuss.elastic.co/t/cannot-recover-kibana-indices-due-to-too-many-open-files-error/360365)
**Author:** [@111407](https://discuss.elastic.co/u/111407)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 9:26am UTC](https://discuss.elastic.co/t/cannot-recover-kibana-indices-due-to-too-many-open-files-error/360365 "2024-05-28T09:26:42Z")
After cluster reboot kibana indices cannot be recovered, I see the following entries in log: \[2024-05-28T05:15:49,289\]\[DEBUG\]\[o.e.g.G.InternalPrimaryShardAllocator\] \[sd-07a1-ae2b.local\] \[\[.kibana\_2/4sWnjATIQ7WDrOTqWYr7f… --- ## [Cannot create runtime fields](https://discuss.elastic.co/t/cannot-create-runtime-fields/360347)
**Author:** [@Ljapunov](https://discuss.elastic.co/u/Ljapunov)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 7:27am UTC](https://discuss.elastic.co/t/cannot-create-runtime-fields/360347 "2024-05-28T07:27:52Z")
Hi there, I am trying to create runtime fields via Kibana Gui and have no clue what is going on. I started on our test environment where everything is working. But my attempt to create a runtime field in productive envi… --- ## [Filebeat container fields mix info from several containers](https://discuss.elastic.co/t/filebeat-container-fields-mix-info-from-several-containers/360358)
**Author:** [@ayrm](https://discuss.elastic.co/u/ayrm)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 9:03am UTC](https://discuss.elastic.co/t/filebeat-container-fields-mix-info-from-several-containers/360358 "2024-05-28T09:03:54Z")
I'm sending logs to Graylog using filebeat on linux with the following conf: filebeat.autodiscover: providers: - type: docker templates: - condition: regexp: docker.containe… --- ## [Time filter](https://discuss.elastic.co/t/time-filter/359021)
**Author:** [@tonichu](https://discuss.elastic.co/u/tonichu)\ **Replies:** 3\ **Last updated:** [May 28, 2024, 7:58am UTC](https://discuss.elastic.co/t/time-filter/359021 "2024-05-28T07:58:21Z")
I have a kibana graph made with vega that shows in a line graph some metrics over time and I want to be able to filter by time but the selector does not work for me. --- ## [Kibana map timestamp on layer with geoshapes](https://discuss.elastic.co/t/kibana-map-timestamp-on-layer-with-geoshapes/360179)
**Author:** [@smartjack](https://discuss.elastic.co/u/smartjack)\ **Replies:** 3\ **Last updated:** [May 28, 2024, 7:16am UTC](https://discuss.elastic.co/t/kibana-map-timestamp-on-layer-with-geoshapes/360179 "2024-05-28T07:16:34Z")
Hello, I'm trying to create a network visualisation using a map and ran into trouble with filtering of the documents using the time range picker in a dashboard. The flow is following: Send data with geo\_shape informat… --- ## [Problem mapping response to Model class \[Elasticsearch.NET 8.13\]](https://discuss.elastic.co/t/problem-mapping-response-to-model-class-elasticsearch-net-8-13/357896)
**Author:** [@hiilmiee](https://discuss.elastic.co/u/hiilmiee)\ **Replies:** 12\ **Last updated:** [May 28, 2024, 7:11am UTC](https://discuss.elastic.co/t/problem-mapping-response-to-model-class-elasticsearch-net-8-13/357896 "2024-05-28T07:11:36Z")
Hi, I am unable to map the ElasticsearchClient SearchASync result into my data model. Gotten a conversion error: The server encountered an error processing the request. Please see the \[service help page\] for constructin… --- ## [Can increase Primary Shard Count in Elasticsearch 8.2.3](https://discuss.elastic.co/t/can-increase-primary-shard-count-in-elasticsearch-8-2-3/360331)
**Author:** [@Andy\_Cong](https://discuss.elastic.co/u/Andy_Cong)\ **Replies:** 1\ **Last updated:** [May 28, 2024, 4:17am UTC](https://discuss.elastic.co/t/can-increase-primary-shard-count-in-elasticsearch-8-2-3/360331 "2024-05-28T04:17:45Z")
Hi，anybody. Question: Can increase Primary Shard Count of an existing index in Elasticsearch 8.2.3? Request：Search and indexing will all can work during the change，and if change fails, it can be rolled back smoothly… --- ## [Multiple Harvested of log file path got started for the same log file name within the span of 7 seconds](https://discuss.elastic.co/t/multiple-harvested-of-log-file-path-got-started-for-the-same-log-file-name-within-the-span-of-7-seconds/359996)
**Author:** [@vikas271019](https://discuss.elastic.co/u/vikas271019)\ **Replies:** 1\ **Last updated:** [May 28, 2024, 5:27am UTC](https://discuss.elastic.co/t/multiple-harvested-of-log-file-path-got-started-for-the-same-log-file-name-within-the-span-of-7-seconds/359996 "2024-05-28T05:27:06Z")
The problem that we are facing is, multiple harvester is being created for a single log file, within a span of 7 seconds as result of which duplicate logs being generated from filebeat. For example, please find the belo… --- ## [Elasticsearch Composite Aggregation Orderby in Java Client 8.8.2](https://discuss.elastic.co/t/elasticsearch-composite-aggregation-orderby-in-java-client-8-8-2/360315)
**Author:** [@tcpeiris](https://discuss.elastic.co/u/tcpeiris)\ **Replies:** 2\ **Last updated:** [May 28, 2024, 2:15am UTC](https://discuss.elastic.co/t/elasticsearch-composite-aggregation-orderby-in-java-client-8-8-2/360315 "2024-05-28T02:15:40Z")
I'm getting a parse exception when I add order to CompositeAggregationSource. List\\> casList = new ArrayList\<\>(); for (int i = 0; i \< groupBy.size(); i++) { Map\ **Author:** [@huanghaiqing1](https://discuss.elastic.co/u/huanghaiqing1)\ **Replies:** 4\ **Last updated:** [May 28, 2024, 12:16am UTC](https://discuss.elastic.co/t/logstash-input-data/360229 "2024-05-28T00:16:52Z") A very strange question, I don't start any filebeat service, but just configure beats as input in my logstash.conf, and elasticsearch as my output. But in kibana I still can see data index created and data fetched in re… --- ## [Change type of mapping field without reindex?](https://discuss.elastic.co/t/change-type-of-mapping-field-without-reindex/360299)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 1\ **Last updated:** [May 27, 2024, 11:02pm UTC](https://discuss.elastic.co/t/change-type-of-mapping-field-without-reindex/360299 "2024-05-27T23:02:26Z")
Hello, I was wondering what the best way to change the index mapping is? Let's say we have an indice that has a field date however this field is of type text. (This field does however have a subfield of .date with type… --- ## [Kubernetes filebeat config map for pod events](https://discuss.elastic.co/t/kubernetes-filebeat-config-map-for-pod-events/360304)
**Author:** [@sahan.d](https://discuss.elastic.co/u/sahan.d)\ **Replies:** 1\ **Last updated:** [May 27, 2024, 5:31pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-config-map-for-pod-events/360304 "2024-05-27T17:31:27Z")
We have a pod that restarts randomly and we can't find the reason because Kubernetes only keeps event logs only for a short time. Even if we increase it, the logs will be lost when the pod is deleted. Can someone help m… --- ## [Custom Elasticsearch Analyzer :- Tokenization and Detokenize Text Processing](https://discuss.elastic.co/t/custom-elasticsearch-analyzer-tokenization-and-detokenize-text-processing/360314)
**Author:** [@alliswell](https://discuss.elastic.co/u/alliswell)\ **Replies:** 0\ **Last updated:** [May 27, 2024, 4:50pm UTC](https://discuss.elastic.co/t/custom-elasticsearch-analyzer-tokenization-and-detokenize-text-processing/360314 "2024-05-27T16:50:01Z")
I am working on building a custom analyzer that needs to implement a unique text processing workflow. Here’s a breakdown of the required steps: Tokenize the input text based on whitespace. Stem each token using an … --- ## [Do we something similar to opensearch's "Normalization processor" in elasticsearch?](https://discuss.elastic.co/t/do-we-something-similar-to-opensearchs-normalization-processor-in-elasticsearch/358933)
**Author:** [@alliswell](https://discuss.elastic.co/u/alliswell)\ **Replies:** 2\ **Last updated:** [May 27, 2024, 4:47pm UTC](https://discuss.elastic.co/t/do-we-something-similar-to-opensearchs-normalization-processor-in-elasticsearch/358933 "2024-05-27T16:47:09Z")
One of the major pain point with hybrid-search is how to combine BM25 (lexical) score with vector similarity score. BM25 scores are unbounded and their absolute value does not indicate degree of relevance. While on the o… --- ## [Understand tiering in Elastic](https://discuss.elastic.co/t/understand-tiering-in-elastic/360310)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 2\ **Last updated:** [May 27, 2024, 4:28pm UTC](https://discuss.elastic.co/t/understand-tiering-in-elastic/360310 "2024-05-27T16:28:49Z")
Hello, I started playing with tiering on my Elastic cluster (in development of course). I have 5 nodes; the first 4 are hot\_data anbd the fifth on is cold\_data. This was working fine. Then, today I added a frozen\_dat… --- ## [Get rid of suffix "per \[interval\]" in kibana lens visualisations when using Date histograms](https://discuss.elastic.co/t/get-rid-of-suffix-per-interval-in-kibana-lens-visualisations-when-using-date-histograms/360308)
**Author:** [@Knut\_Knackwurst](https://discuss.elastic.co/u/Knut_Knackwurst)\ **Replies:** 1\ **Last updated:** [May 27, 2024, 3:50pm UTC](https://discuss.elastic.co/t/get-rid-of-suffix-per-interval-in-kibana-lens-visualisations-when-using-date-histograms/360308 "2024-05-27T15:50:12Z")
Is it possible to get rid of the suffix "per \[inteval\]" in kibana lens visualisations when using Date histograms? For example, in Bar charts, when i use a Date histogram as an axis, choose "Month" as the interval and na… --- ## [Multiple logs to a single index](https://discuss.elastic.co/t/multiple-logs-to-a-single-index/358891)
**Author:** [@k13045](https://discuss.elastic.co/u/k13045)\ **Replies:** 1\ **Last updated:** [May 27, 2024, 3:19pm UTC](https://discuss.elastic.co/t/multiple-logs-to-a-single-index/358891 "2024-05-27T15:19:18Z")
Hello, I have a use case to fetch the log messages from Kafka audit cluster and send it to Elastic. But the log messages each are of different format and if I send the messages to respective index I'm ending up with cre… --- ## [Elastic agent sending system beats but not forwarding netflow to ElasticSearch](https://discuss.elastic.co/t/elastic-agent-sending-system-beats-but-not-forwarding-netflow-to-elasticsearch/360242)
**Author:** [@MYK](https://discuss.elastic.co/u/MYK)\ **Replies:** 1\ **Last updated:** [May 27, 2024, 3:12pm UTC](https://discuss.elastic.co/t/elastic-agent-sending-system-beats-but-not-forwarding-netflow-to-elasticsearch/360242 "2024-05-27T15:12:26Z")
Hi Everyone, I am new to the ELK world and learning the stack. I deployed ELK v8.11 using Helm in Kubernetes. I am currently trying to integrate Mikrotik NetFlow logs with Elasticsearch. My current setup already has Elas… --- ## [Index not listed on the ELK server](https://discuss.elastic.co/t/index-not-listed-on-the-elk-server/360275)
**Author:** [@Sathish-369](https://discuss.elastic.co/u/Sathish-369)\ **Replies:** 0\ **Last updated:** [May 27, 2024, 10:34am UTC](https://discuss.elastic.co/t/index-not-listed-on-the-elk-server/360275 "2024-05-27T10:34:09Z")
Filebeat is installed and successfully transferring logs to the ELK server. However, the index is not appearing in the Kibana UI. Despite trying different index names, I'm unable to see the index on the ELK server. Commu… --- ## [Winlogbeat - unable to start service on windows](https://discuss.elastic.co/t/winlogbeat-unable-to-start-service-on-windows/357619)
**Author:** [@fracorbas](https://discuss.elastic.co/u/fracorbas)\ **Replies:** 27\ **Last updated:** [May 27, 2024, 1:52pm UTC](https://discuss.elastic.co/t/winlogbeat-unable-to-start-service-on-windows/357619 "2024-05-27T13:52:27Z")
I'm using the ELK stack as a syslog server on an debian server in order to gather logs from Cisco devices and Windows server. Everything was doing fine until I wanted to use HTTPS instead of HTTP, now kibana and Elastic… --- ## [Elasticsearch ssl configuration](https://discuss.elastic.co/t/elasticsearch-ssl-configuration/360300)
**Author:** [@ghost\_0](https://discuss.elastic.co/u/ghost_0)\ **Replies:** 0\ **Last updated:** [May 27, 2024, 1:48pm UTC](https://discuss.elastic.co/t/elasticsearch-ssl-configuration/360300 "2024-05-27T13:48:59Z")
Hi people. I'm trying to setup Elasticsearch inside my environment but I'm hitting wall after wall after wall, and I'm honestly loosing hope. I set up Elastic with Kibana, configured our organizations CA and certificat… --- ## [Reindexing with zero downtime - update document ](https://discuss.elastic.co/t/reindexing-with-zero-downtime-update-document/360186)
**Author:** [@anto-tl](https://discuss.elastic.co/u/anto-tl)\ **Replies:** 6\ **Last updated:** [May 27, 2024, 1:48pm UTC](https://discuss.elastic.co/t/reindexing-with-zero-downtime-update-document/360186 "2024-05-27T13:48:33Z")
Hello, I am looking for solution to do zero downtime reindexing with all read, write, delete and update without any interruption/data loss. In our case, we are doing data encryption using encryption keys in index data.… --- ## [Is there way to suppress the watcher alert at the single shot and activate it back](https://discuss.elastic.co/t/is-there-way-to-suppress-the-watcher-alert-at-the-single-shot-and-activate-it-back/360282)
**Author:** [@Kannan\_Rajendran](https://discuss.elastic.co/u/Kannan_Rajendran)\ **Replies:** 1\ **Last updated:** [May 27, 2024, 1:06pm UTC](https://discuss.elastic.co/t/is-there-way-to-suppress-the-watcher-alert-at-the-single-shot-and-activate-it-back/360282 "2024-05-27T13:06:18Z")
is there way to automate this enable and disable of the watchers based on any scheduled manner? Regards, Kannan R --- ## [Transport.go:125: SSL client failed to connect with: dial tcp xx.xx.xx.xx:5044: getsock…n refused](https://discuss.elastic.co/t/transport-go-ssl-client-failed-to-connect-with-dial-tcp-xx-xx-xx-xx-getsock-n-refused/360182)
**Author:** [@chandra\_sekhar](https://discuss.elastic.co/u/chandra_sekhar)\ **Replies:** 3\ **Last updated:** [May 27, 2024, 12:45pm UTC](https://discuss.elastic.co/t/transport-go-ssl-client-failed-to-connect-with-dial-tcp-xx-xx-xx-xx-getsock-n-refused/360182 "2024-05-27T12:45:09Z")
I am running ELK on 6.8.15 version which is pretty old version working as of now good. Since 2 weeks I am getting the following issues with filebeat is not able to communicate with logstatsh and getting the following SSL… --- ## [Manual snapshot one index only](https://discuss.elastic.co/t/manual-snapshot-one-index-only/360269)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 2\ **Last updated:** [May 27, 2024, 10:53am UTC](https://discuss.elastic.co/t/manual-snapshot-one-index-only/360269 "2024-05-27T10:53:22Z")
Is it possible to manually take snapshot from one index? I found from the documentation that it is be possible to snapshot all indices, but I want just one index backed up. PUT \_snapshot/my\_repository/%3Cmy\_snapshot\_%7B… --- ## [Need to parse multi-lines log message](https://discuss.elastic.co/t/need-to-parse-multi-lines-log-message/360206)
**Author:** [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Replies:** 4\ **Last updated:** [May 27, 2024, 10:41am UTC](https://discuss.elastic.co/t/need-to-parse-multi-lines-log-message/360206 "2024-05-27T10:41:30Z")
Hi everyone, I am new on Grok. I am in stuck with multiple lines of log message below. Can anyone help me look at my grok. Thanks The log message: \[timestamp: 1621431760\] abort handler of pid 1823 thread 1848977280 \*… --- ## [Fucntionbeat with aws lambda ( run time issue)](https://discuss.elastic.co/t/fucntionbeat-with-aws-lambda-run-time-issue/360273)
**Author:** [@Ashwin\_Anbalagan](https://discuss.elastic.co/u/Ashwin_Anbalagan)\ **Replies:** 0\ **Last updated:** [May 27, 2024, 10:31am UTC](https://discuss.elastic.co/t/fucntionbeat-with-aws-lambda-run-time-issue/360273 "2024-05-27T10:31:03Z")
Hi i have been using functionbeat fileto create a lambda function, here in runtime using provided.al2023 which is deprecated, so i have given provided.al2 , if i deploy ,same old deprectated provided.al2023 is coming for… --- ## [Filtering with wildcard](https://discuss.elastic.co/t/filtering-with-wildcard/360085)
**Author:** [@Cebula](https://discuss.elastic.co/u/Cebula)\ **Replies:** 2\ **Last updated:** [May 27, 2024, 10:16am UTC](https://discuss.elastic.co/t/filtering-with-wildcard/360085 "2024-05-27T10:16:17Z")
Need some help with the use of wildcard in filter. Filter log.level : ERROR and message: "This topic with id\*" will – as expected – list all data which starts with ’This topic with id’ If I include the not keyword in l… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=230) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=232)