# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=673 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 674 --- ## [Dutation field type - days to weeks error](https://discuss.elastic.co/t/dutation-field-type-days-to-weeks-error/320996)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 4\ **Last updated:** [December 12, 2022, 9:11pm UTC](https://discuss.elastic.co/t/dutation-field-type-days-to-weeks-error/320996 "2022-12-12T21:11:15Z")
using a horizontal lens vis and a duration metric to human readable duration metrics, there appears to be a conversion miscalculation between days to weeks. the attached except shows the x axis increasing by 2.3 days un… --- ## [Java ElasticsearchClient ping timeout](https://discuss.elastic.co/t/java-elasticsearchclient-ping-timeout/322749)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 2\ **Last updated:** [January 9, 2023, 5:51pm UTC](https://discuss.elastic.co/t/java-elasticsearchclient-ping-timeout/322749 "2023-01-09T17:51:11Z")
Hi, We are caching the created connection, and use ping often to ensure that the connection is still valid and would like it to fail quickly if not so we can create a new one. With the Java High Level REST Client we ca… --- ## [Can i increase performance on one host?](https://discuss.elastic.co/t/can-i-increase-performance-on-one-host/322748)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 5:50pm UTC](https://discuss.elastic.co/t/can-i-increase-performance-on-one-host/322748 "2023-01-09T17:50:16Z")
I have one host with a lot of memory, cpus and disk. and I have static database of 700gb and 217M records, with only one client querying. can I increase the search speed?. now I get connection timeout sometimes. --- ## [Syslog client doesn't send to Logstash](https://discuss.elastic.co/t/syslog-client-doesnt-send-to-logstash/322618)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 6\ **Last updated:** [January 9, 2023, 4:52pm UTC](https://discuss.elastic.co/t/syslog-client-doesnt-send-to-logstash/322618 "2023-01-09T16:52:03Z")
Hello, Hello, I would like to get some advice for this configuration: Send rsyslog to my logstash. I tested both configurations without success. One moment it worked after restarting the pipeline nothing. $ModLoad i… --- ## [Custom Log integration multiple pipelines](https://discuss.elastic.co/t/custom-log-integration-multiple-pipelines/322485)
**Author:** [@searchtastic](https://discuss.elastic.co/u/searchtastic)\ **Replies:** 7\ **Last updated:** [January 9, 2023, 3:43pm UTC](https://discuss.elastic.co/t/custom-log-integration-multiple-pipelines/322485 "2023-01-09T15:43:39Z")
I have a custom integration setup with Elastic agent. At the moment I have a directory with several log files containing quite different data. I can't use the same pipeline so I would like to reference another pipeline.… --- ## [Best Practices for Adding New Logs?](https://discuss.elastic.co/t/best-practices-for-adding-new-logs/322743)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 0\ **Last updated:** [January 9, 2023, 3:01pm UTC](https://discuss.elastic.co/t/best-practices-for-adding-new-logs/322743 "2023-01-09T15:01:22Z")
Does anyone have a good process for adding a new system to monitor into Elastic? We're deploying the Elastic Agent to the servers now, so now I've got to come up with a standard process to discover data and determine be… --- ## [Best Optimization for wildcard queries](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738)
**Author:** [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\ **Replies:** 4\ **Last updated:** [January 9, 2023, 2:30pm UTC](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738 "2023-01-09T14:30:09Z")
Hello, I am working with elasticsearch on audit log data. I wanted to know what are the best optimizations and tokenizer/analyzer/term usages for optimizing elastic for wildcard queries. I have looked at n-grams and the… --- ## [Continuous transform not working as expected](https://discuss.elastic.co/t/continuous-transform-not-working-as-expected/321834)
**Author:** [@Dominik\_Solc](https://discuss.elastic.co/u/Dominik_Solc)\ **Replies:** 3\ **Last updated:** [January 9, 2023, 2:20pm UTC](https://discuss.elastic.co/t/continuous-transform-not-working-as-expected/321834 "2023-01-09T14:20:43Z")
Hello, I have problem that my continuous transform doesn't update as the index, which it takes data from, is getting new and new data. The original index, let's name it playwright-test-runs-data (as i have it named), i… --- ## [Define Multiple Conditions in an Alert](https://discuss.elastic.co/t/define-multiple-conditions-in-an-alert/322652)
**Author:** [@jlucas](https://discuss.elastic.co/u/jlucas)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 1:49pm UTC](https://discuss.elastic.co/t/define-multiple-conditions-in-an-alert/322652 "2023-01-09T13:49:41Z")
Is it possible to define multiple conditions in an alert? Based on this documentation (Alerting | Kibana Guide \[8.5\] | Elastic) it doesn't appear to. I would like to trigger an alert when 2 conditions are met. I want to … --- ## [CORS error while adding ServiceNow ITSM connector](https://discuss.elastic.co/t/cors-error-while-adding-servicenow-itsm-connector/321042)
**Author:** [@rakeshl](https://discuss.elastic.co/u/rakeshl)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 2:40pm UTC](https://discuss.elastic.co/t/cors-error-while-adding-servicenow-itsm-connector/321042 "2022-12-12T14:40:12Z")
I have installed ECK with kibana 8.5.3. I have used logstash to forward the logs to ELK stack. I am able to see the logs in kibana. Now, I am trying to integrate elastic to ServiceNow ITSM for creating incidents for the … --- ## [Elasticsearch cosine similarity query question](https://discuss.elastic.co/t/elasticsearch-cosine-similarity-query-question/322729)
**Author:** [@ward](https://discuss.elastic.co/u/ward)\ **Replies:** 3\ **Last updated:** [January 9, 2023, 1:22pm UTC](https://discuss.elastic.co/t/elasticsearch-cosine-similarity-query-question/322729 "2023-01-09T13:22:23Z")
Hi there, I'm currently working on a face recognition project using Elasticsearch. I can't seem to get a working query for matching two datasets with each other. My most recent attempt is shown below the mapping. I was h… --- ## [Replicating data between an Elastic Cluster Nodes](https://discuss.elastic.co/t/replicating-data-between-an-elastic-cluster-nodes/322737)
**Author:** [@A.Hani](https://discuss.elastic.co/u/A.Hani)\ **Replies:** 2\ **Last updated:** [January 9, 2023, 1:08pm UTC](https://discuss.elastic.co/t/replicating-data-between-an-elastic-cluster-nodes/322737 "2023-01-09T13:08:53Z")
Hi New to Elastic here and would like to get help with some inquiries. Scenario: 1- Let's assume that I have a cluster of (2) master nodes, is it possible to configure each node to hold its own data? In other words, N… --- ## [Filebeat and updating existing docs](https://discuss.elastic.co/t/filebeat-and-updating-existing-docs/320781)
**Author:** [@Marcin\_Frankiewicz](https://discuss.elastic.co/u/Marcin_Frankiewicz)\ **Replies:** 30\ **Last updated:** [January 9, 2023, 12:57pm UTC](https://discuss.elastic.co/t/filebeat-and-updating-existing-docs/320781 "2023-01-09T12:57:04Z")
Hi, I'm trying to update documents when they exists.. it is possible with filebeat? Logstash has that functionality... output { elasticsearch { doc\_as\_upsert =\> true document\_id =\> "%{fingerprint}" The fing… --- ## [Lens Table - "wrong" selection of top N elements](https://discuss.elastic.co/t/lens-table-wrong-selection-of-top-n-elements/321784)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 8\ **Last updated:** [January 9, 2023, 11:12am UTC](https://discuss.elastic.co/t/lens-table-wrong-selection-of-top-n-elements/321784 "2023-01-09T11:12:53Z")
Hi! I want to display a table like this: | File Name | Number of warnings | | path/to/foo.cpp | 123 | | path/to/bar.cpp | 30 … --- ## [Unable to find Upgrade Assistant option in 8.3.3 version](https://discuss.elastic.co/t/unable-to-find-upgrade-assistant-option-in-8-3-3-version/322458)
**Author:** [@Abj\_Ins](https://discuss.elastic.co/u/Abj_Ins)\ **Replies:** 3\ **Last updated:** [January 9, 2023, 11:46am UTC](https://discuss.elastic.co/t/unable-to-find-upgrade-assistant-option-in-8-3-3-version/322458 "2023-01-09T11:46:56Z")
Hi Team, we are trying to upgrade from version 8.2.3 to 8.5 but, unable to find Upgrade Assistant option. Kindly help us and let us know the process, how to upgrade to the latest version. Thanks. --- ## [Error fields script in the Index Pattern](https://discuss.elastic.co/t/error-fields-script-in-the-index-pattern/321314)
**Author:** [@rpc29y](https://discuss.elastic.co/u/rpc29y)\ **Replies:** 4\ **Last updated:** [January 9, 2023, 11:21am UTC](https://discuss.elastic.co/t/error-fields-script-in-the-index-pattern/321314 "2023-01-09T11:21:41Z")
Hello. I have an elastic version 7.10 and in the Index Pattern of one of the indexes I have created a simple fields script: "doc\['temperature'\]\* 10" Apparently the creation is correct, but I can't get to display the v… --- ## [Logstash SSL verification](https://discuss.elastic.co/t/logstash-ssl-verification/322615)
**Author:** [@hanna](https://discuss.elastic.co/u/hanna)\ **Replies:** 7\ **Last updated:** [January 9, 2023, 11:15am UTC](https://discuss.elastic.co/t/logstash-ssl-verification/322615 "2023-01-09T11:15:05Z")
Hello, how can I enable SSL certificate verification in my logstash pipeline output to elasticsearch? I don't find any documentation on which certificates to use here. The cluster version is 8.5.3. This is my logstash… --- ## [Translation does not work in EUI Core components](https://discuss.elastic.co/t/translation-does-not-work-in-eui-core-components/322636)
**Author:** [@wsbr](https://discuss.elastic.co/u/wsbr)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 11:10am UTC](https://discuss.elastic.co/t/translation-does-not-work-in-eui-core-components/322636 "2023-01-09T11:10:05Z")
Hi, We are using Elasticsearch 8.4.1 and some actions does not be translated. How to solve this problem? In the packages/core/i18n/core-i18n-browser-internal/src/i18n\_eui\_mapping.tsx file we find at line 1161 'euiQu… --- ## [Function score query with decay function on huge dataset](https://discuss.elastic.co/t/function-score-query-with-decay-function-on-huge-dataset/322724)
**Author:** [@minhdao](https://discuss.elastic.co/u/minhdao)\ **Replies:** 0\ **Last updated:** [January 9, 2023, 11:09am UTC](https://discuss.elastic.co/t/function-score-query-with-decay-function-on-huge-dataset/322724 "2023-01-09T11:09:40Z")
Good day everyone. Background I'm building a search engine for a marketplace. Our market has products, sellers, and customers. Each product has many sellers with their locations. The number of sellers might be around 10… --- ## [Download csv file option directly on visualization/dashboard](https://discuss.elastic.co/t/download-csv-file-option-directly-on-visualization-dashboard/322658)
**Author:** [@amarkoli](https://discuss.elastic.co/u/amarkoli)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 11:02am UTC](https://discuss.elastic.co/t/download-csv-file-option-directly-on-visualization-dashboard/322658 "2023-01-09T11:02:27Z")
the Download CSV option in visible when clicked on the "Inspect" which is open when clicked on the 3 dots icons. But can we have the Download CSV option directly on the visualization/dashboard or somewhere else. if ther… --- ## [KQL Query Date filter on non timeseries data](https://discuss.elastic.co/t/kql-query-date-filter-on-non-timeseries-data/321839)
**Author:** [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)\ **Replies:** 4\ **Last updated:** [January 9, 2023, 10:44am UTC](https://discuss.elastic.co/t/kql-query-date-filter-on-non-timeseries-data/321839 "2023-01-09T10:44:56Z")
Hi, I'm tying to use Lens to plot data changing over a period of time. We generate the data once a week at single point in time, and so it doesn't look good as a time series. We also want to plot the count of a data … --- ## [Docker-compose setup healthcheck unhealthy](https://discuss.elastic.co/t/docker-compose-setup-healthcheck-unhealthy/321665)
**Author:** [@divadpoc](https://discuss.elastic.co/u/divadpoc)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 10:36am UTC](https://discuss.elastic.co/t/docker-compose-setup-healthcheck-unhealthy/321665 "2023-01-09T10:36:39Z")
Hello, I'm using the example docker-compose file as presented here - with stack version 8.5.2 . I wrapped the docker-compose command into a systemd script. All services were running until today when I had to restart my … --- ## [Data Pipeline Design Considerations](https://discuss.elastic.co/t/data-pipeline-design-considerations/322717)
**Author:** [@Tiharqa](https://discuss.elastic.co/u/Tiharqa)\ **Replies:** 0\ **Last updated:** [January 9, 2023, 9:47am UTC](https://discuss.elastic.co/t/data-pipeline-design-considerations/322717 "2023-01-09T09:47:21Z")
So I have a confluent kafka with multiple topics per network divided as follows NET1: Data NET1-SYSLG NET1-WIN ====== NET2 : Data NET2-SYSLG NET2-WIN I have 2 logstash servers reading from those topics on Kafka … --- ## [SentinelOne Integration - Missing Logs](https://discuss.elastic.co/t/sentinelone-integration-missing-logs/322336)
**Author:** [@clintonm9](https://discuss.elastic.co/u/clintonm9)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 9:54am UTC](https://discuss.elastic.co/t/sentinelone-integration-missing-logs/322336 "2023-01-09T09:54:43Z")
I have set up SentinelOne Integration and have enabled all of the log collections. I see logs coming in, but there is not much detail. Does anyone know if more details like you see in S1 console should be ingested? --- ## [Brand new master doesn't join cluster bootstrap error](https://discuss.elastic.co/t/brand-new-master-doesnt-join-cluster-bootstrap-error/322567)
**Author:** [@faxm0dem](https://discuss.elastic.co/u/faxm0dem)\ **Replies:** 10\ **Last updated:** [January 9, 2023, 9:48am UTC](https://discuss.elastic.co/t/brand-new-master-doesnt-join-cluster-bootstrap-error/322567 "2023-01-09T09:48:36Z")
Hi, We have a 7.10.2 cluster with multiple data-only nodes and 3 master-only nodes. We wiped one of the 3 masters clean (reinstall), and now it refuses to join the cluster: master not discovered yet, this node has not… --- ## [Yearly reset of cumulative sum with monthly buckets](https://discuss.elastic.co/t/yearly-reset-of-cumulative-sum-with-monthly-buckets/321315)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 2\ **Last updated:** [January 9, 2023, 9:36am UTC](https://discuss.elastic.co/t/yearly-reset-of-cumulative-sum-with-monthly-buckets/321315 "2023-01-09T09:36:49Z")
Hello, i have a table lens with a monthly date histogram and a cumulative sum column. Is there a way to "reset" the cumulative sum to 0 at the start of a year? So 1.1.2007 would start with 0 instead of 3867 from the… --- ## [Filebeat autodiscover filestream input have error logs with ID already exists](https://discuss.elastic.co/t/filebeat-autodiscover-filestream-input-have-error-logs-with-id-already-exists/322716)
**Author:** [@andry.zhu](https://discuss.elastic.co/u/andry.zhu)\ **Replies:** 0\ **Last updated:** [January 9, 2023, 9:35am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-filestream-input-have-error-logs-with-id-already-exists/322716 "2023-01-09T09:35:24Z")
HI! I am running a filebeat version 8.5.3 daemonset in kubernetes cluster. I has configured autodiscover filestream input each namespace. it have error logs with ID already exists are often reported during run time. My … --- ## [Webhdfs Output plugin does not working with use\_kerberos\_auth](https://discuss.elastic.co/t/webhdfs-output-plugin-does-not-working-with-use-kerberos-auth/322714)
**Author:** [@vincent.ea3](https://discuss.elastic.co/u/vincent.ea3)\ **Replies:** 0\ **Last updated:** [January 9, 2023, 9:20am UTC](https://discuss.elastic.co/t/webhdfs-output-plugin-does-not-working-with-use-kerberos-auth/322714 "2023-01-09T09:20:05Z")
Hello, I am working to deploy logstash in k8s container to output message to hadoop. https://github.com/elastic/helm-charts According to the documentation, webHDFS and Kerberos authentication are supported. https://w… --- ## [\[8.5.3\] Unable to download CSV from dashboard / visualizations](https://discuss.elastic.co/t/8-5-3-unable-to-download-csv-from-dashboard-visualizations/321835)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 8\ **Last updated:** [January 9, 2023, 9:14am UTC](https://discuss.elastic.co/t/8-5-3-unable-to-download-csv-from-dashboard-visualizations/321835 "2023-01-09T09:14:49Z")
None of my Kibana dashboard or viz have a "Download to CVS" option showing up in 8.5.3. What am I missing? Below is my setup: I've installed the 8.5.3 stack of elasticsearch and kibana from this official doc. My kibana… --- ## [Logstash in Docker and Elastic down](https://discuss.elastic.co/t/logstash-in-docker-and-elastic-down/322675)
**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\ **Replies:** 2\ **Last updated:** [January 9, 2023, 9:06am UTC](https://discuss.elastic.co/t/logstash-in-docker-and-elastic-down/322675 "2023-01-09T09:06:38Z")
Hello, I'm running Logstash in Docker. Sometimes it happens that Elasticsearch is unavailable and when I restart the Logstash docker container, Logstash removing messages are they are no longer saved to Elasticsearch. I… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=672) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=674)