# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=261 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 262 --- ## [Convert object type data to array in Elastic search watcher](https://discuss.elastic.co/t/convert-object-type-data-to-array-in-elastic-search-watcher/357597)
**Author:** [@JasonREC](https://discuss.elastic.co/u/JasonREC)\ **Replies:** 0\ **Last updated:** [April 17, 2024, 9:49am UTC](https://discuss.elastic.co/t/convert-object-type-data-to-array-in-elastic-search-watcher/357597 "2024-04-17T09:49:27Z")
Hi, I am trying to run a Elasticsearch watcher, but I am stuck in the chain input, I have a http fetch -\> transfrom the http response data -\> used by the index search the http response data is simply a json like this … --- ## [Process specific dynamic array field from JSON file](https://discuss.elastic.co/t/process-specific-dynamic-array-field-from-json-file/357300)
**Author:** [@Gabao-Farias](https://discuss.elastic.co/u/Gabao-Farias)\ **Replies:** 3\ **Last updated:** [April 17, 2024, 9:46am UTC](https://discuss.elastic.co/t/process-specific-dynamic-array-field-from-json-file/357300 "2024-04-17T09:46:39Z")
Hi people! Recently I've got in a situation where there is a service that posts it's logs on a single .json file in deeper level field. The structure is something like this... { "field1": "value1", "field2": "… --- ## [Send log to ELK server](https://discuss.elastic.co/t/send-log-to-elk-server/357570)
**Author:** [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\ **Replies:** 3\ **Last updated:** [April 17, 2024, 9:37am UTC](https://discuss.elastic.co/t/send-log-to-elk-server/357570 "2024-04-17T09:37:06Z")
I have some firewall and want to send their log to ELK server. Can you please guide to which guide can help me to setup ELK according to Database? (pg or mysql) --- ## [How to handle dot in fields (Missing intermediate object)](https://discuss.elastic.co/t/how-to-handle-dot-in-fields-missing-intermediate-object/357584)
**Author:** [@alissan](https://discuss.elastic.co/u/alissan)\ **Replies:** 0\ **Last updated:** [April 17, 2024, 8:43am UTC](https://discuss.elastic.co/t/how-to-handle-dot-in-fields-missing-intermediate-object/357584 "2024-04-17T08:43:19Z")
Hello, Elasticsearch version: 8.8.2 I have an index template with runtime fields: "dynamic": "runtime" When i add a document to index with dotted field (bash.command.test), its added normally as a runtime field: … --- ## [Where do I disable \_source field?](https://discuss.elastic.co/t/where-do-i-disable-source-field/357573)
**Author:** [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\ **Replies:** 6\ **Last updated:** [April 17, 2024, 8:51am UTC](https://discuss.elastic.co/t/where-do-i-disable-source-field/357573 "2024-04-17T08:51:19Z")
I have to disable \_source: false But I don't where file can store my \_source: false. please help me. --- ## [Elasticsearch does not release lock on node.lock file](https://discuss.elastic.co/t/elasticsearch-does-not-release-lock-on-node-lock-file/357579)
**Author:** [@Prashant\_Rana](https://discuss.elastic.co/u/Prashant_Rana)\ **Replies:** 0\ **Last updated:** [April 17, 2024, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-release-lock-on-node-lock-file/357579 "2024-04-17T08:16:02Z")
Sometimes when the machine shutsdown, the Elasticsearch is not releasing the lock on the node.lock file. Even after machine restart, ES is not able to lock the env stating failed to obtain node lock. Similar issue occur… --- ## [Runtime Field - How to create a field (scripted field)](https://discuss.elastic.co/t/runtime-field-how-to-create-a-field-scripted-field/357430)
**Author:** [@ek9boy](https://discuss.elastic.co/u/ek9boy)\ **Replies:** 1\ **Last updated:** [April 17, 2024, 7:24am UTC](https://discuss.elastic.co/t/runtime-field-how-to-create-a-field-scripted-field/357430 "2024-04-17T07:24:56Z")
Hi, I have a date value: @timestamp: 2024-04-01T12:08:00:548Z I want to use the scripted field / runtime field option to creat a new field based on the logic below: IF @timestamp \>= 10 minutes Then ten\_minute\_breac… --- ## [Toggle between two charts](https://discuss.elastic.co/t/toggle-between-two-charts/357440)
**Author:** [@Himanshu\_Keshari](https://discuss.elastic.co/u/Himanshu_Keshari)\ **Replies:** 1\ **Last updated:** [April 17, 2024, 7:22am UTC](https://discuss.elastic.co/t/toggle-between-two-charts/357440 "2024-04-17T07:22:57Z")
Can we toggle the two chart by using single click. Example- I have two charts Vertical bar chart and Vertical bar percentage chart for the same index. so i just want a button (toggle) for switching these two charts on … --- ## [Number of entries in Options lists (Dashboard Controls)](https://discuss.elastic.co/t/number-of-entries-in-options-lists-dashboard-controls/357492)
**Author:** [@aram215](https://discuss.elastic.co/u/aram215)\ **Replies:** 1\ **Last updated:** [April 17, 2024, 7:19am UTC](https://discuss.elastic.co/t/number-of-entries-in-options-lists-dashboard-controls/357492 "2024-04-17T07:19:12Z")
Back in 2023, someone was having the same issue Dashboard: increasing the number of entries shown in "options list" filter controls related to the option to increase the number of entries (more than 10) in the filter opt… --- ## [Need help with query to aggregate and get data across objects](https://discuss.elastic.co/t/need-help-with-query-to-aggregate-and-get-data-across-objects/357569)
**Author:** [@nser-melwin](https://discuss.elastic.co/u/nser-melwin)\ **Replies:** 0\ **Last updated:** [April 17, 2024, 6:39am UTC](https://discuss.elastic.co/t/need-help-with-query-to-aggregate-and-get-data-across-objects/357569 "2024-04-17T06:39:27Z")
I have data in an index in this format: doc1 doc1 { ports: { "80": 2, "443": 10, "23": 12 } } doc2 { ports: { "80": 32, "44": 6, "22": 1 } } I am trying to query and get an aggregate of data which ca… --- ## [Elastic Watcher](https://discuss.elastic.co/t/elastic-watcher/357520)
**Author:** [@ashish25](https://discuss.elastic.co/u/ashish25)\ **Replies:** 1\ **Last updated:** [April 17, 2024, 5:53am UTC](https://discuss.elastic.co/t/elastic-watcher/357520 "2024-04-17T05:53:20Z")
Hi Team, I created below watcher - PUT \_watcher/watch/transaction\_status\_watch { "trigger": { "schedule": { "interval": "10s" } }, "input": { "search": { "request": { "indices": \["test-transaction"\], "body":… --- ## [Encrypt HTTP client communications for Elasticsearch](https://discuss.elastic.co/t/encrypt-http-client-communications-for-elasticsearch/357561)
**Author:** [@abhinavtyagi](https://discuss.elastic.co/u/abhinavtyagi)\ **Replies:** 0\ **Last updated:** [April 17, 2024, 5:49am UTC](https://discuss.elastic.co/t/encrypt-http-client-communications-for-elasticsearch/357561 "2024-04-17T05:49:55Z")
Look at the image sharing the docs for version 8.13. Now, I am using docker for my application. And the step-1 says to stop Elasticsearch and Kibana if they are running. I used to execute the commands, using docker … --- ## [Search Rate in Kibana Dashboard](https://discuss.elastic.co/t/search-rate-in-kibana-dashboard/357494)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 1\ **Last updated:** [April 17, 2024, 5:05am UTC](https://discuss.elastic.co/t/search-rate-in-kibana-dashboard/357494 "2024-04-17T05:05:36Z")
Hi Team, While perfroming reindex activity, we can see that the search rate of the source index 330/s but while it is writing the data to target index it is with speed of 4k/s. Both we are seeing in Kibana dashboards un… --- ## [Query to return only when one of the values greater than x but not when another value is also greater than x](https://discuss.elastic.co/t/query-to-return-only-when-one-of-the-values-greater-than-x-but-not-when-another-value-is-also-greater-than-x/357470)
**Author:** [@axiom](https://discuss.elastic.co/u/axiom)\ **Replies:** 2\ **Last updated:** [April 17, 2024, 2:29am UTC](https://discuss.elastic.co/t/query-to-return-only-when-one-of-the-values-greater-than-x-but-not-when-another-value-is-also-greater-than-x/357470 "2024-04-17T02:29:37Z")
Hi, I'm new to Elastic Search and need some help if this query is possible to be done Value in Table Format: value1 value2 6000 2000 3000 3000 5000 8000 3002 3001 80 3500 only one of the values can … --- ## [Timeout during index refresh](https://discuss.elastic.co/t/timeout-during-index-refresh/357146)
**Author:** [@wnmills3](https://discuss.elastic.co/u/wnmills3)\ **Replies:** 2\ **Last updated:** [April 16, 2024, 11:26pm UTC](https://discuss.elastic.co/t/timeout-during-index-refresh/357146 "2024-04-16T23:26:43Z")
I'm getting a timeout when refreshing an index after a large bulk ingest. I'm using the synchronous client with 8.1.3 Java APIs. It seems the refresh occurs, just waiting for completion times out. It is safe to ignore th… --- ## [Routing allocation shard doesn't work](https://discuss.elastic.co/t/routing-allocation-shard-doesnt-work/357540)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 5\ **Last updated:** [April 16, 2024, 9:43pm UTC](https://discuss.elastic.co/t/routing-allocation-shard-doesnt-work/357540 "2024-04-16T21:43:46Z")
Hi I'm struggling the case why even it was enabled the routing rebalance on that index. shards are still placed on one node, how to force automatically rerouting shards on the other nodes? some of the index(with shard… --- ## [Unable to parse logstash date filter](https://discuss.elastic.co/t/unable-to-parse-logstash-date-filter/357539)
**Author:** [@Johnson\_will](https://discuss.elastic.co/u/Johnson_will)\ **Replies:** 1\ **Last updated:** [April 16, 2024, 7:41pm UTC](https://discuss.elastic.co/t/unable-to-parse-logstash-date-filter/357539 "2024-04-16T19:41:00Z")
Unable to parse logstash date filter SOURCE = 2024-04-16 18:29:01.178 -0400 LOGSTASH = "start\_time" =\> 2024-04-16T18:29:01.178Z, LOGSTASH DATE FILTER date{ match =\> \["\[start\_time\]" , "yyyy-MM-dd HH:mm:ss.SSSZ"\] … --- ## [Can not query when inserting data](https://discuss.elastic.co/t/can-not-query-when-inserting-data/357532)
**Author:** [@D\_Tu](https://discuss.elastic.co/u/D_Tu)\ **Replies:** 4\ **Last updated:** [April 16, 2024, 6:14pm UTC](https://discuss.elastic.co/t/can-not-query-when-inserting-data/357532 "2024-04-16T18:14:49Z")
I am a newbie to elastic and use spring boots to interact with elastic. I have a scenario as below: inserting a document like A inserting a document like B ( and this action takes 5m to complete) and I also insert oth… --- ## [We are trying to make pipeline as filebeat to logstash to elasticsearch but facing issue with connectivity and version compatibility](https://discuss.elastic.co/t/we-are-trying-to-make-pipeline-as-filebeat-to-logstash-to-elasticsearch-but-facing-issue-with-connectivity-and-version-compatibility/357321)
**Author:** [@Darshan1](https://discuss.elastic.co/u/Darshan1)\ **Replies:** 36\ **Last updated:** [April 16, 2024, 5:29pm UTC](https://discuss.elastic.co/t/we-are-trying-to-make-pipeline-as-filebeat-to-logstash-to-elasticsearch-but-facing-issue-with-connectivity-and-version-compatibility/357321 "2024-04-16T17:29:04Z")
We are trying to send logs from filebeat 7.17.x to logstash 8.13 to elasticsearch 7.17.20 version but we are not able to connect from filebeat to logstash and unable to open 5044 port in logstash. in filebeat test out f… --- ## [Filebeat not sending indices to es](https://discuss.elastic.co/t/filebeat-not-sending-indices-to-es/357536)
**Author:** [@oster\_ferns](https://discuss.elastic.co/u/oster_ferns)\ **Replies:** 0\ **Last updated:** [April 16, 2024, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-indices-to-es/357536 "2024-04-16T17:28:15Z")
Hi, I am trying to configure filebeat to create custom Index to send to ES. But the filebeat runs without error , but can't see any indices that it sends to ES. This is my filebeat.yml config. I am deploying it in k8s w… --- ## [Limiting log 'noise' due inactive log files](https://discuss.elastic.co/t/limiting-log-noise-due-inactive-log-files/356160)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [April 16, 2024, 3:59pm UTC](https://discuss.elastic.co/t/limiting-log-noise-due-inactive-log-files/356160 "2024-04-16T15:59:13Z")
Got filebeat monitoring various test JBoss instance, only quite some log files remains empty for long periodes and filebeat watcher still monitors such, just in case events do sometime get written to various logs. But i… --- ## ["term" behave srangely in knn filter?](https://discuss.elastic.co/t/term-behave-srangely-in-knn-filter/357388)
**Author:** [@Yoann\_Buzenet](https://discuss.elastic.co/u/Yoann_Buzenet)\ **Replies:** 5\ **Last updated:** [April 16, 2024, 1:26pm UTC](https://discuss.elastic.co/t/term-behave-srangely-in-knn-filter/357388 "2024-04-16T13:26:17Z")
Hello, My range filters are working perfectly, but when I use a term that doesn't match anything, results are strange. For example, I'm trying to get boardgames by age. I use a range filters that does work. If I use a … --- ## [Need help to setup filebeat and want to connect with logstash to elasticsearch to kibana for multi indexer for our multiple clients](https://discuss.elastic.co/t/need-help-to-setup-filebeat-and-want-to-connect-with-logstash-to-elasticsearch-to-kibana-for-multi-indexer-for-our-multiple-clients/357506)
**Author:** [@Darshan1](https://discuss.elastic.co/u/Darshan1)\ **Replies:** 1\ **Last updated:** [April 16, 2024, 12:40pm UTC](https://discuss.elastic.co/t/need-help-to-setup-filebeat-and-want-to-connect-with-logstash-to-elasticsearch-to-kibana-for-multi-indexer-for-our-multiple-clients/357506 "2024-04-16T12:40:24Z")
We are not able to start port on logstash 5044 port and not able to connect from filebeat. as of now our elasticsearch cluster is up and running in green status. and kibana also running and able to reach dashboard fronte… --- ## [Parse Json](https://discuss.elastic.co/t/parse-json/357405)
**Author:** [@AndrewO](https://discuss.elastic.co/u/AndrewO)\ **Replies:** 3\ **Last updated:** [April 16, 2024, 11:34am UTC](https://discuss.elastic.co/t/parse-json/357405 "2024-04-16T11:34:37Z")
Hello Help me parse the logs, I'm a beginner, I don't understand how to do it. My log: {"bucket":"22-11-2023-test1111111111","time":"2024-04-15T10:01:53.539568Z","time\_local":"2024-04-15T10:01:53.539568+0000","remote\_… --- ## [How can I install multiple admin console to enhance the availability?](https://discuss.elastic.co/t/how-can-i-install-multiple-admin-console-to-enhance-the-availability/357357)
**Author:** [@shorouqamin](https://discuss.elastic.co/u/shorouqamin)\ **Replies:** 5\ **Last updated:** [April 16, 2024, 10:07am UTC](https://discuss.elastic.co/t/how-can-i-install-multiple-admin-console-to-enhance-the-availability/357357 "2024-04-16T10:07:56Z")
we need to enhance prod availability, so we think about installing multiple admin console. Please any suggestion of how to apply this or if there is better way. Thanks --- ## [Any alternative solution to phrase query?](https://discuss.elastic.co/t/any-alternative-solution-to-phrase-query/357502)
**Author:** [@zouxiang1993](https://discuss.elastic.co/u/zouxiang1993)\ **Replies:** 0\ **Last updated:** [April 16, 2024, 9:59am UTC](https://discuss.elastic.co/t/any-alternative-solution-to-phrase-query/357502 "2024-04-16T09:59:22Z")
I use Elasticsearch to store large amount of log data, so I'm particularly concerned abount storage costs. This is a Lucene segment in my ES index: 1.5K \_3ee.fdm 2.4G \_3ee.fdt 172K \_3ee.fdx 3.4K \_3ee.fnm 172M … --- ## [ElasticSearch Watcher http request input is not getting any response](https://discuss.elastic.co/t/elasticsearch-watcher-http-request-input-is-not-getting-any-response/357489)
**Author:** [@JasonREC](https://discuss.elastic.co/u/JasonREC)\ **Replies:** 2\ **Last updated:** [April 16, 2024, 9:39am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-http-request-input-is-not-getting-any-response/357489 "2024-04-16T09:39:54Z")
Hi, I am trying to use elastic watcher to fetch data from my api which hosted in the aws lambda with api gateway setup. Below is my input query but it just returned something which says "Validation Failed: 1: a watch e… --- ## [Elastic search document access based control and vector search](https://discuss.elastic.co/t/elastic-search-document-access-based-control-and-vector-search/357023)
**Author:** [@anuj99](https://discuss.elastic.co/u/anuj99)\ **Replies:** 12\ **Last updated:** [April 16, 2024, 9:33am UTC](https://discuss.elastic.co/t/elastic-search-document-access-based-control-and-vector-search/357023 "2024-04-16T09:33:29Z")
Following is my use case to store data in Elasticsearch for workspace search connecting different data sources. Text from file is chunked and stored in different document used to vector and keyword search chunk. Howeve… --- ## [Datehistogram on DayLightSaving time range produces wrong buckets](https://discuss.elastic.co/t/datehistogram-on-daylightsaving-time-range-produces-wrong-buckets/355902)
**Author:** [@Vishnu\_R](https://discuss.elastic.co/u/Vishnu_R)\ **Replies:** 1\ **Last updated:** [April 16, 2024, 8:49am UTC](https://discuss.elastic.co/t/datehistogram-on-daylightsaving-time-range-produces-wrong-buckets/355902 "2024-04-16T08:49:28Z")
Time Zone: America/Los\_Angeles Search Start Time - 10/03/2024 00:00 Search End Time - 10/03/2024 04:00 Note - On DST clock forwards one hour, after 10/03/2024 1:59 we will have 10/03/2024 3:00. Date histogram interva… --- ## [Kibana behind firewall](https://discuss.elastic.co/t/kibana-behind-firewall/356558)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 14\ **Last updated:** [April 16, 2024, 8:32am UTC](https://discuss.elastic.co/t/kibana-behind-firewall/356558 "2024-04-16T08:32:50Z")
I have my kibana running behind firewall and can't connect to outside world. I don't need to connect either. it is working fine but getting following error. how do I stop kibana to even trying.? I already has this in k… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=260) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=262)