# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=271 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 272 --- ## [Problem with unique count and cardinality](https://discuss.elastic.co/t/problem-with-unique-count-and-cardinality/356298)
**Author:** [@Peter\_K](https://discuss.elastic.co/u/Peter_K)\ **Replies:** 3\ **Last updated:** [April 3, 2024, 10:14am UTC](https://discuss.elastic.co/t/problem-with-unique-count-and-cardinality/356298 "2024-04-03T10:14:55Z")
There are the following fields: documentnumber user (user identifier) @timestamp field I want to create the following monitoring (as EQL or other query, as alert and if possible in dashboard form) in Kibana: Show the … --- ## [Logstash synced with MySQL taking to long to execute the queries](https://discuss.elastic.co/t/logstash-synced-with-mysql-taking-to-long-to-execute-the-queries/356646)
**Author:** [@abhinavtyagi](https://discuss.elastic.co/u/abhinavtyagi)\ **Replies:** 17\ **Last updated:** [April 3, 2024, 10:07am UTC](https://discuss.elastic.co/t/logstash-synced-with-mysql-taking-to-long-to-execute-the-queries/356646 "2024-04-03T10:07:17Z")
Look at the below screenshot, you can see that while querying a table with just 146 records it's taking 6.2 seconds to execute. Now, take a look at my configuration files for logstash: base.conf: input { jdbc { … --- ## [How can i modify the index name when using ILM?](https://discuss.elastic.co/t/how-can-i-modify-the-index-name-when-using-ilm/355659)
**Author:** [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Replies:** 5\ **Last updated:** [April 3, 2024, 8:22am UTC](https://discuss.elastic.co/t/how-can-i-modify-the-index-name-when-using-ilm/355659 "2024-04-03T08:22:20Z")
Hi, i'm using ILM. I'd like to have index names which reflect the source of the data, e.g. index-mysql-hostname. I read that i can configure the index name in filebeat, but only without ILM. Is there a way to create an… --- ## [Vega visualization Issue](https://discuss.elastic.co/t/vega-visualization-issue/356653)
**Author:** [@Zzh\_Peter](https://discuss.elastic.co/u/Zzh_Peter)\ **Replies:** 2\ **Last updated:** [April 3, 2024, 7:53am UTC](https://discuss.elastic.co/t/vega-visualization-issue/356653 "2024-04-03T07:53:43Z")
Hi, I'm a new user using vega to customize my own dashboard. However, I'm facing some strange issues now... what I'm trying to do is use vega to create a bar chart showing some results from the Elasticsearch data pool. … --- ## [In facet i want to show all result?](https://discuss.elastic.co/t/in-facet-i-want-to-show-all-result/356648)
**Author:** [@Deshant\_Pandit](https://discuss.elastic.co/u/Deshant_Pandit)\ **Replies:** 1\ **Last updated:** [April 3, 2024, 7:03am UTC](https://discuss.elastic.co/t/in-facet-i-want-to-show-all-result/356648 "2024-04-03T07:03:25Z")
In facet i want all the result. I found show prop which only take number and i don't know exact result. How to show all results in facet? I do not want to use more button instead i will use scroller. So, I want all the… --- ## [Data is duplicating without restart of any services of kibana](https://discuss.elastic.co/t/data-is-duplicating-without-restart-of-any-services-of-kibana/356616)
**Author:** [@2328943\_dc](https://discuss.elastic.co/u/2328943_dc)\ **Replies:** 3\ **Last updated:** [April 3, 2024, 6:15am UTC](https://discuss.elastic.co/t/data-is-duplicating-without-restart-of-any-services-of-kibana/356616 "2024-04-03T06:15:37Z")
for payment URL index hits are coming after every one min for 2 different urls. i.e for each url we are getting 60 hits per min. we have created sincedb path for index and observed data but we found that data is duplic… --- ## [Webhook - Case Management connector \`PUT\` updates fails to send \`Content-Type: application/json\` header](https://discuss.elastic.co/t/webhook-case-management-connector-put-updates-fails-to-send-content-type-application-json-header/356492)
**Author:** [@W24800](https://discuss.elastic.co/u/W24800)\ **Replies:** 2\ **Last updated:** [April 2, 2024, 11:53pm UTC](https://discuss.elastic.co/t/webhook-case-management-connector-put-updates-fails-to-send-content-type-application-json-header/356492 "2024-04-02T23:53:46Z")
Elastic Version: 8.12.0 As the title states, the "Webhook - Case Management" connector PUT update fails to send the Content-Type: application/json HTTP header to case management platform. In my case, the platform is Red… --- ## [Kibana Dashboard Filter](https://discuss.elastic.co/t/kibana-dashboard-filter/356640)
**Author:** [@0593098](https://discuss.elastic.co/u/0593098)\ **Replies:** 0\ **Last updated:** [April 2, 2024, 9:33pm UTC](https://discuss.elastic.co/t/kibana-dashboard-filter/356640 "2024-04-02T21:33:36Z")
How do i fetch only top values of column Transaction.Status for latest time value in last\_date field Currently kibana shows data based on alphabetical order .I am unable to rank transaction\_status on last value functi… --- ## [Kibana monitoring issues with task not found](https://discuss.elastic.co/t/kibana-monitoring-issues-with-task-not-found/356403)
**Author:** [@Maxime\_Beaudry](https://discuss.elastic.co/u/Maxime_Beaudry)\ **Replies:** 1\ **Last updated:** [April 2, 2024, 9:22pm UTC](https://discuss.elastic.co/t/kibana-monitoring-issues-with-task-not-found/356403 "2024-04-02T21:22:48Z")
Currently working out some issues on our ELK deployment related to data loss and corrupted snapshots. I've since fixed the snapshot but previous ones are essentially lost. Now, for context, we've had to remove the data\_… --- ## [How to properly prepare and cleanse a search term before sending to Elastic?](https://discuss.elastic.co/t/how-to-properly-prepare-and-cleanse-a-search-term-before-sending-to-elastic/356635)
**Author:** [@vitor-awork](https://discuss.elastic.co/u/vitor-awork)\ **Replies:** 0\ **Last updated:** [April 2, 2024, 7:22pm UTC](https://discuss.elastic.co/t/how-to-properly-prepare-and-cleanse-a-search-term-before-sending-to-elastic/356635 "2024-04-02T19:22:02Z")
I am using Elasticsearch with C# NEST and my application does some cleansing and preparation when getting a search term in the API. A few scenarios: Removal of special characters, such as " \\ ' ( ) \[ \] { } Escaping ce… --- ## [Logstash 8.13.0-1 Ubuntu/Debian Package Missing](https://discuss.elastic.co/t/logstash-8-13-0-1-ubuntu-debian-package-missing/356429)
**Author:** [@gt2847c](https://discuss.elastic.co/u/gt2847c)\ **Replies:** 1\ **Last updated:** [April 2, 2024, 6:29pm UTC](https://discuss.elastic.co/t/logstash-8-13-0-1-ubuntu-debian-package-missing/356429 "2024-04-02T18:29:54Z")
Tried to do a package upgrade and while the rest of the elastic packages upgraded to 8.13 just fine, getting a 404 failure on the 8.13 Logstash package download. Apt shows the latest Logstash version avail as 8.13.0-1 w… --- ## [ES for logs -- field conflict hell 🔥](https://discuss.elastic.co/t/es-for-logs-field-conflict-hell/355849)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 18\ **Last updated:** [April 2, 2024, 5:17pm UTC](https://discuss.elastic.co/t/es-for-logs-field-conflict-hell/355849 "2024-04-02T17:17:23Z")
In a large enterprise with diverse log sources, if you want to provide the benefits of structured logging you could turn on dynamic mapping. But those diverse sources may not be able to coordinate and share schema, and … --- ## [Faceting after Collapse](https://discuss.elastic.co/t/faceting-after-collapse/356453)
**Author:** [@fvsadem](https://discuss.elastic.co/u/fvsadem)\ **Replies:** 3\ **Last updated:** [April 2, 2024, 4:26pm UTC](https://discuss.elastic.co/t/faceting-after-collapse/356453 "2024-04-02T16:26:13Z")
Hi, I struggle to migrated from Algolia to Elasticsearch. My problem is facet after distinct option equivalent in Elasticsaerch. I successfuly collapse my index to distinct by an attribute but there is a problem with t… --- ## [How can i increase text field limit on aggregations?](https://discuss.elastic.co/t/how-can-i-increase-text-field-limit-on-aggregations/356552)
**Author:** [@barisbeytur](https://discuss.elastic.co/u/barisbeytur)\ **Replies:** 6\ **Last updated:** [April 2, 2024, 3:13pm UTC](https://discuss.elastic.co/t/how-can-i-increase-text-field-limit-on-aggregations/356552 "2024-04-02T15:13:21Z")
Hello, I have a SearchGroupedErrorByCriteria method for take data on Elasticsearch and view it on a admin panel table. I'm using Elasticsearch .NET Client. I have a search descriptor: var searchDescriptor = new Search… --- ## [Is there a processor that can group my data correctly?](https://discuss.elastic.co/t/is-there-a-processor-that-can-group-my-data-correctly/356200)
**Author:** [@Nama\_Chintamani\_Illo](https://discuss.elastic.co/u/Nama_Chintamani_Illo)\ **Replies:** 4\ **Last updated:** [April 2, 2024, 2:53pm UTC](https://discuss.elastic.co/t/is-there-a-processor-that-can-group-my-data-correctly/356200 "2024-04-02T14:53:31Z")
I have tried multiple methods and they all seem to keep the data in an array of the same field instead of the grouping to match. I am attempting to turn this type of grouping: "service": { "name": \[ "value… --- ## [Search by sum of nested objects](https://discuss.elastic.co/t/search-by-sum-of-nested-objects/356621)
**Author:** [@pikorro](https://discuss.elastic.co/u/pikorro)\ **Replies:** 0\ **Last updated:** [April 2, 2024, 2:46pm UTC](https://discuss.elastic.co/t/search-by-sum-of-nested-objects/356621 "2024-04-02T14:46:17Z")
I have list of docs with following struct: { "name": "John Doe", "work\_experiences": \[ { "company": "Accenture", "duration": 24 }, { "company": "IBM", "duration": 36 } \] } c… --- ## [ECS RFC process questions](https://discuss.elastic.co/t/ecs-rfc-process-questions/356576)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 4\ **Last updated:** [April 2, 2024, 2:11pm UTC](https://discuss.elastic.co/t/ecs-rfc-process-questions/356576 "2024-04-02T14:11:53Z")
The RFC process includes at least one step that I'm not sure how to participate in, highlighted here: Create a new RFC document from the RFC template (described below) Fill in the details for your strawperson Open a P… --- ## [Parsing IRC Logs](https://discuss.elastic.co/t/parsing-irc-logs/356574)
**Author:** [@moep](https://discuss.elastic.co/u/moep)\ **Replies:** 2\ **Last updated:** [April 2, 2024, 1:17pm UTC](https://discuss.elastic.co/t/parsing-irc-logs/356574 "2024-04-02T13:17:12Z")
Im running an ELK-Stack in Docker and my goal is, to parse and filter my IRC logs, for learning. 2024-04-01 20:25:02 me foo 2024-04-01 20:25:46 me bar I found some logstash related stuff on Github. I guess the … --- ## [How to upgrade elasticsearch cluster from 7.9 to 8.13 without data loss](https://discuss.elastic.co/t/how-to-upgrade-elasticsearch-cluster-from-7-9-to-8-13-without-data-loss/356606)
**Author:** [@Krishna\_Sailesh](https://discuss.elastic.co/u/Krishna_Sailesh)\ **Replies:** 3\ **Last updated:** [April 2, 2024, 12:24pm UTC](https://discuss.elastic.co/t/how-to-upgrade-elasticsearch-cluster-from-7-9-to-8-13-without-data-loss/356606 "2024-04-02T12:24:51Z")
Hi I am running Elasticsearch with a 3-node cluster with 7.9.2 version which contains some huge data. I need to upgrade it to 8.10.3 without the data loss. can someone help me with how to do it? Thanks Krishna --- ## [Help parsing ndjson as json using json filter](https://discuss.elastic.co/t/help-parsing-ndjson-as-json-using-json-filter/356560)
**Author:** [@bibbidi](https://discuss.elastic.co/u/bibbidi)\ **Replies:** 8\ **Last updated:** [April 2, 2024, 12:18pm UTC](https://discuss.elastic.co/t/help-parsing-ndjson-as-json-using-json-filter/356560 "2024-04-02T12:18:56Z")
Hi, I am trying to use Winlogbeat to get a json file with Windows events. Winlogbeat produces ndjson, so I was trying to convert it to json like this: When I run logstash with this configuration file, it does not save a… --- ## [Elasticsearch Multi-Tier Architecture – Master/Hot/Frozen](https://discuss.elastic.co/t/elasticsearch-multi-tier-architecture-master-hot-frozen/356383)
**Author:** [@bouzeghoub](https://discuss.elastic.co/u/bouzeghoub)\ **Replies:** 18\ **Last updated:** [April 2, 2024, 12:00pm UTC](https://discuss.elastic.co/t/elasticsearch-multi-tier-architecture-master-hot-frozen/356383 "2024-04-02T12:00:58Z")
Hello, I want deploy Elasticsearch Multi-Tier Architecture – Master/Hot/Frozen on prime. Please could you help me with documents or blog. Best regards. --- ## [Timestamp is no longer transferred correctly](https://discuss.elastic.co/t/timestamp-is-no-longer-transferred-correctly/356608)
**Author:** [@benhartwich](https://discuss.elastic.co/u/benhartwich)\ **Replies:** 3\ **Last updated:** [April 2, 2024, 11:31am UTC](https://discuss.elastic.co/t/timestamp-is-no-longer-transferred-correctly/356608 "2024-04-02T11:31:33Z")
Hello everyone, I import values from a CSV via Logstash to Elasticsearch, whereby the timestamp is correctly determined from the name of the CSV and then the correct format is also written to Elasticsearch - e.g.: 2024-… --- ## [Merging buckets after top\_hits](https://discuss.elastic.co/t/merging-buckets-after-top-hits/356609)
**Author:** [@Vivek\_Burman](https://discuss.elastic.co/u/Vivek_Burman)\ **Replies:** 0\ **Last updated:** [April 2, 2024, 11:29am UTC](https://discuss.elastic.co/t/merging-buckets-after-top-hits/356609 "2024-04-02T11:29:49Z")
Hi, I've a use case which I need help with. The mapping is as shown below of an elastic index: { "test\_case":{ "type":"nested", "properties":{ "end\_timestamp":{ "type":"date" … --- ## [Packetbeat error connecting to elasticsearch](https://discuss.elastic.co/t/packetbeat-error-connecting-to-elasticsearch/356545)
**Author:** [@Syphax](https://discuss.elastic.co/u/Syphax)\ **Replies:** 3\ **Last updated:** [April 2, 2024, 11:12am UTC](https://discuss.elastic.co/t/packetbeat-error-connecting-to-elasticsearch/356545 "2024-04-02T11:12:10Z")
hi everyone, my elasticsearch server receives IPs dynamically from a DHCP server. my elastic server had an address of 192.168.100.116 when I installed it, the next day the address was changed to 192.168.100.126 and when… --- ## [Fleet unhealthy in GUI + could not setup certificate reloader can not convert 'object' into 'string'](https://discuss.elastic.co/t/fleet-unhealthy-in-gui-could-not-setup-certificate-reloader-can-not-convert-object-into-string/355997)
**Author:** [@ksmithdafm](https://discuss.elastic.co/u/ksmithdafm)\ **Replies:** 35\ **Last updated:** [April 2, 2024, 11:02am UTC](https://discuss.elastic.co/t/fleet-unhealthy-in-gui-could-not-setup-certificate-reloader-can-not-convert-object-into-string/355997 "2024-04-02T11:02:07Z")
Fleet Server unhealthy in GUI and from CLI. Hello All, I have been wrestling with adding the fleet server for sometime now. I am running self managed ELK with 3 nodes as follows. master/data - Also runs kibana data01 … --- ## [I am getting elastic\_transport.node\_pool WARNING when doing elastic search benchmarking using rally](https://discuss.elastic.co/t/i-am-getting-elastic-transport-node-pool-warning-when-doing-elastic-search-benchmarking-using-rally/356607)
**Author:** [@Mukul](https://discuss.elastic.co/u/Mukul)\ **Replies:** 0\ **Last updated:** [April 2, 2024, 11:01am UTC](https://discuss.elastic.co/t/i-am-getting-elastic-transport-node-pool-warning-when-doing-elastic-search-benchmarking-using-rally/356607 "2024-04-02T11:01:39Z")
I am doing benchmarking on our cluster using rally but data is not getting ingested in index and getting below warnings. 024-03-26 07:31:51,713 -not-actor-/PID:141 elastic\_transport.node\_pool WARNING Node \ **Author:** [@mislav.kuzmic](https://discuss.elastic.co/u/mislav.kuzmic)\ **Replies:** 1\ **Last updated:** [April 2, 2024, 9:54am UTC](https://discuss.elastic.co/t/kibana-visualization-aggregating-data-for-dashboard/356601 "2024-04-02T09:54:13Z") Hello, we're trying to come up with a dashboard to monitor our services running in a Kubernetes cluster. We use prometheus to scrape metrics and push them to Elastic Kibana via remove write feature. We managed to get t… --- ## [Impact of RHEL upgrade from 7.9 to 8.9 on ELK stack](https://discuss.elastic.co/t/impact-of-rhel-upgrade-from-7-9-to-8-9-on-elk-stack/356602)
**Author:** [@Justo1982](https://discuss.elastic.co/u/Justo1982)\ **Replies:** 0\ **Last updated:** [April 2, 2024, 9:40am UTC](https://discuss.elastic.co/t/impact-of-rhel-upgrade-from-7-9-to-8-9-on-elk-stack/356602 "2024-04-02T09:40:33Z")
Hi All, I have been tasked with upgrading my OS software from RHEL 7.9 to RHEL 8.9. Can someone confirm if the ELK stack supports in-place OS upgrade (i.e upgrading to a later version of the OS while the ELK stack is r… --- ## [Visualization split series doesn't bring all the data](https://discuss.elastic.co/t/visualization-split-series-doesnt-bring-all-the-data/356537)
**Author:** [@box2m](https://discuss.elastic.co/u/box2m)\ **Replies:** 1\ **Last updated:** [April 2, 2024, 8:41am UTC](https://discuss.elastic.co/t/visualization-split-series-doesnt-bring-all-the-data/356537 "2024-04-02T08:41:19Z")
On a basic visualization, when I add a "Split series" by significant terms, it doesn't show all data. This was executed using Elasticsearch & Kibana version 8.13.0 hosted in Kubernetes. Both queries are successful in th… --- ## [Unmarshaling JSON for metricbeat (Talend Management Console)](https://discuss.elastic.co/t/unmarshaling-json-for-metricbeat-talend-management-console/356596)
**Author:** [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\ **Replies:** 0\ **Last updated:** [April 2, 2024, 7:42am UTC](https://discuss.elastic.co/t/unmarshaling-json-for-metricbeat-talend-management-console/356596 "2024-04-02T07:42:49Z")
Hi Team, I am trying to setup a http metricbeat which monitors a Talend Management Console. My error is: Blockquote Apr 02 07:17:55 ip-172-31-28-66 metricbeat\[387\]: {"log.level":"error","@timestamp":"2024-04-02T07:17… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=270) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=272)