# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=702 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 703 --- ## [Is there any way to get past logs with elasticsearch?](https://discuss.elastic.co/t/is-there-any-way-to-get-past-logs-with-elasticsearch/320001)
**Author:** [@Halil\_Ibrahim\_Celik](https://discuss.elastic.co/u/Halil_Ibrahim_Celik)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 12:16pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-get-past-logs-with-elasticsearch/320001 "2022-12-12T12:16:14Z")
Hello everyone, I am using Elasticsearch and Kibana version 7.17.6 with UiPath orchestrator to view logs. I created dashboard in Kibana to view UiPath robot's usage. Sometimes Elasticsearch and Kibana is closing because… --- ## [Enrich index from two sources](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 3\ **Last updated:** [November 14, 2022, 1:27pm UTC](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846 "2022-11-14T13:27:05Z")
Hello! I need enrich one index from two another indexes simultaneously. I know how enrich index from one source using ingest pipeline. But I don't find examples for two sources. How I can realize it? --- ## [Index size increased in Data Stream, in ES 8.x version](https://discuss.elastic.co/t/index-size-increased-in-data-stream-in-es-8-x-version/320986)
**Author:** [@da-head0](https://discuss.elastic.co/u/da-head0)\ **Replies:** 12\ **Last updated:** [December 12, 2022, 11:52am UTC](https://discuss.elastic.co/t/index-size-increased-in-data-stream-in-es-8-x-version/320986 "2022-12-12T11:52:10Z")
Hello, I have a ES 7.10 version Cluster with normal index, and recently I make a ECK cluster with 8.4.2 version with same data but with data stream. But I figured out in new cluster with data stream, the same data woul… --- ## [Ordering of two fields in ELastic, specifically first one is of text and second is from integer](https://discuss.elastic.co/t/ordering-of-two-fields-in-elastic-specifically-first-one-is-of-text-and-second-is-from-integer/321026)
**Author:** [@rvadiga](https://discuss.elastic.co/u/rvadiga)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 11:50am UTC](https://discuss.elastic.co/t/ordering-of-two-fields-in-elastic-specifically-first-one-is-of-text-and-second-is-from-integer/321026 "2022-12-12T11:50:12Z")
Hi Team, Could someone please show hints to implement the below requirement? I have an index where two fields, first one is text field, and second is of integer. I need to take the highest number row from the unique(f… --- ## [Reindex API and child queries](https://discuss.elastic.co/t/reindex-api-and-child-queries/321025)
**Author:** [@MattG1](https://discuss.elastic.co/u/MattG1)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 11:34am UTC](https://discuss.elastic.co/t/reindex-api-and-child-queries/321025 "2022-12-12T11:34:48Z")
Hey, We're investigating the best way to reindex our ES data after an index mapping update and came up with a way that could potentially work for us: new\_index is the index we'll be creating old\_index is the previous … --- ## [A Google Bigquery output plugin error](https://discuss.elastic.co/t/a-google-bigquery-output-plugin-error/321021)
**Author:** [@dalaopo](https://discuss.elastic.co/u/dalaopo)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 11:22am UTC](https://discuss.elastic.co/t/a-google-bigquery-output-plugin-error/321021 "2022-12-12T11:22:19Z")
Hello! The old field data I read from Kafka is object，It seems that there is no way to identify the setting record This is my first configuration csv\_schema =\> "old:STRING,...." And first error \[2022-12-12T19:06:04,… --- ## [How to show the percentage of each terms in kibana dashboard](https://discuss.elastic.co/t/how-to-show-the-percentage-of-each-terms-in-kibana-dashboard/320873)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 9\ **Last updated:** [December 12, 2022, 11:25am UTC](https://discuss.elastic.co/t/how-to-show-the-percentage-of-each-terms-in-kibana-dashboard/320873 "2022-12-12T11:25:10Z")
Hello, I'm working on a requirement where I'll have to create a dashboard that shows the Inbound traffic (in percentage) of each interface in the network. I have the fields 'system.network.in.bytes' having the inbound … --- ## [A rollover (ILM) on rollup indexes](https://discuss.elastic.co/t/a-rollover-ilm-on-rollup-indexes/316597)
**Author:** [@mguggi](https://discuss.elastic.co/u/mguggi)\ **Replies:** 7\ **Last updated:** [December 12, 2022, 11:23am UTC](https://discuss.elastic.co/t/a-rollover-ilm-on-rollup-indexes/316597 "2022-12-12T11:23:20Z")
Referring to the post I have some more questions: Since the issue #48003 is closed is there a plan until when this feature will be available? I would also like to know if a numeric rollover works for rollup indexes? If… --- ## ["Unable to Tessellate shape....Possible malformed shape detected." Error while indexing in ES 7.17.7](https://discuss.elastic.co/t/unable-to-tessellate-shape-possible-malformed-shape-detected-error-while-indexing-in-es-7-17-7/319922)
**Author:** [@amal\_antony](https://discuss.elastic.co/u/amal_antony)\ **Replies:** 23\ **Last updated:** [December 12, 2022, 11:15am UTC](https://discuss.elastic.co/t/unable-to-tessellate-shape-possible-malformed-shape-detected-error-while-indexing-in-es-7-17-7/319922 "2022-12-12T11:15:50Z")
Greetings to the community! We have a logstash pipeline writing a geojson file to Elasticsearch. The file never gets fully indexed and some geo\_shape records get dropped by Elasticsearch. Identified the records that cau… --- ## [Kibana lens bar chart horizontal not centering vertically](https://discuss.elastic.co/t/kibana-lens-bar-chart-horizontal-not-centering-vertically/320998)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 11:15am UTC](https://discuss.elastic.co/t/kibana-lens-bar-chart-horizontal-not-centering-vertically/320998 "2022-12-12T11:15:16Z")
Hello, I have this bar chart horizontal: The result of the break down by is not centered to the application name/too small. Is it possible to make it centered vertically to each application name? (like this but c… --- ## [What is the different between Elasticsearch Platinum license](https://discuss.elastic.co/t/what-is-the-different-between-elasticsearch-platinum-license/321017)
**Author:** [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 10:39am UTC](https://discuss.elastic.co/t/what-is-the-different-between-elasticsearch-platinum-license/321017 "2022-12-12T10:39:57Z")
Hi, We have Elasticsearch Platinum license and it has two types of licenses such as Production and Non-production, so what is the difference between these two, and what are the limitations between them? --- ## [Support for quote\_analyzer in simple\_query\_string query](https://discuss.elastic.co/t/support-for-quote-analyzer-in-simple-query-string-query/321016)
**Author:** [@mkr-os](https://discuss.elastic.co/u/mkr-os)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 10:11am UTC](https://discuss.elastic.co/t/support-for-quote-analyzer-in-simple-query-string-query/321016 "2022-12-12T10:11:00Z")
I want to support queries mixing exact (phrase) and more lenient matching without parsing the user query myself. The simple\_query\_string query with its quote\_field\_suffix parameter seemed like a good candidate for this. … --- ## [Index and Alias name exact name](https://discuss.elastic.co/t/index-and-alias-name-exact-name/320989)
**Author:** [@QuestBevan](https://discuss.elastic.co/u/QuestBevan)\ **Replies:** 5\ **Last updated:** [December 12, 2022, 9:29am UTC](https://discuss.elastic.co/t/index-and-alias-name-exact-name/320989 "2022-12-12T09:29:11Z")
Hi, An index and alias with the exact same name was accidently created and now our Elasticsearch node won't connect to our cluster. Luckily only 1 node was restarted before we read a support article saying DO NOT restar… --- ## [Co.elastic.metrics/raw to "simpler" format](https://discuss.elastic.co/t/co-elastic-metrics-raw-to-simpler-format/321009)
**Author:** [@firecow](https://discuss.elastic.co/u/firecow)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 8:49am UTC](https://discuss.elastic.co/t/co-elastic-metrics-raw-to-simpler-format/321009 "2022-12-12T08:49:34Z")
Hey guys, i'm trying to convert this to a more "simpler" version for better Yaml anchoring reusage. co.elastic.metrics/raw: \>- \[ { "enabled": "true", "module": "http", "metricsets": \[ … --- ## [Which version of Angular to use for custom external plugin?](https://discuss.elastic.co/t/which-version-of-angular-to-use-for-custom-external-plugin/321006)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 8:36am UTC](https://discuss.elastic.co/t/which-version-of-angular-to-use-for-custom-external-plugin/321006 "2022-12-12T08:36:57Z")
Hi, I am building a custom external plugin using Angular. Can I use the latest version of Angular, Angular 15 for the plugin? If not, which version can be used? Thanks --- ## [Add Translation to dashboard visualization](https://discuss.elastic.co/t/add-translation-to-dashboard-visualization/320548)
**Author:** [@User101](https://discuss.elastic.co/u/User101)\ **Replies:** 8\ **Last updated:** [December 12, 2022, 8:33am UTC](https://discuss.elastic.co/t/add-translation-to-dashboard-visualization/320548 "2022-12-12T08:33:22Z")
Hi guys im new to kibana and i want to know can i add translation to visualization custom label in en.json --- ## [Simpler Vega example?](https://discuss.elastic.co/t/simpler-vega-example/320688)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 8:31am UTC](https://discuss.elastic.co/t/simpler-vega-example/320688 "2022-12-12T08:31:55Z")
Hi! I'm new to Kibana and Vega. I'm following this guide: So far so good with the "Data-Driven" graph. I have however a lot of trouble to understand and make the jump to the "Dynamic Data with Elasticsearch and Kibana… --- ## [Metric Beat stops after few Minutes in AWS EC2 Server](https://discuss.elastic.co/t/metric-beat-stops-after-few-minutes-in-aws-ec2-server/320680)
**Author:** [@Umer\_Tahir](https://discuss.elastic.co/u/Umer_Tahir)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 8:30am UTC](https://discuss.elastic.co/t/metric-beat-stops-after-few-minutes-in-aws-ec2-server/320680 "2022-12-12T08:30:00Z")
I have installed Metricbeats on my ECS Docker Instance and I am monitoring logs of Docker from ECS to Elastic Search Kabana Dashboard. There is an issue with the Kabana that whenever I do any release by updating docker i… --- ## [Any examples to use Elastic Search as Graph Database?](https://discuss.elastic.co/t/any-examples-to-use-elastic-search-as-graph-database/320997)
**Author:** [@Shraddha29](https://discuss.elastic.co/u/Shraddha29)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 8:20am UTC](https://discuss.elastic.co/t/any-examples-to-use-elastic-search-as-graph-database/320997 "2022-12-12T08:20:25Z")
Any examples to use Elastic Search as Graph Database? --- ## [Error fetching data for metricset logstash.node\_stats: error making http request: Get \\"http://localhost:9600/\\": dial tcp 127.0.0.1:9600: connect: connection refused](https://discuss.elastic.co/t/error-fetching-data-for-metricset-logstash-node-stats-error-making-http-request-get-http-localhost-9600-dial-tcp-127-0-0-1-connect-connection-refused/321005)
**Author:** [@maxxl](https://discuss.elastic.co/u/maxxl)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 8:12am UTC](https://discuss.elastic.co/t/error-fetching-data-for-metricset-logstash-node-stats-error-making-http-request-get-http-localhost-9600-dial-tcp-127-0-0-1-connect-connection-refused/321005 "2022-12-12T08:12:53Z")
3 logstash node works fine i\`m add 4th node configs the sames /etc/metricbeat/modules.d/logstash-xpack.yml # Module: logstash # Docs: https://www.elastic.co/guide/en/beats/metricbeat/main/metricbeat-module-logstas… --- ## [Elasticsearch audit log take more size](https://discuss.elastic.co/t/elasticsearch-audit-log-take-more-size/319627)
**Author:** [@Nitin08bisht](https://discuss.elastic.co/u/Nitin08bisht)\ **Replies:** 12\ **Last updated:** [December 12, 2022, 8:07am UTC](https://discuss.elastic.co/t/elasticsearch-audit-log-take-more-size/319627 "2022-12-12T08:07:01Z")
Hi Team, Elasticsearch audit log take 20-25 GB size every day. I'm using elasticsearch 7.16.2 and same version for filebeat. I have enable the audit key by enabling the below keys in elasticsearch.yml file. xpack.secur… --- ## [Getting fields in ascending order from aggregation in watcher](https://discuss.elastic.co/t/getting-fields-in-ascending-order-from-aggregation-in-watcher/320013)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 7:58am UTC](https://discuss.elastic.co/t/getting-fields-in-ascending-order-from-aggregation-in-watcher/320013 "2022-12-12T07:58:56Z")
hi I have a watcher for tracking high request time on my website urls, with the following request: { "trigger": { "schedule": { "interval": "2m" } }, "input": { "search": { "request": { … --- ## [Indices don't have primary shards \[.transform-notifications-000002, .watches, .kibana\_task\_manager\_7.17.0\_001\]"](https://discuss.elastic.co/t/indices-dont-have-primary-shards-transform-notifications-000002-watches-kibana-task-manager-7-17-0-001/320963)
**Author:** [@Ravi\_S1](https://discuss.elastic.co/u/Ravi_S1)\ **Replies:** 0\ **Last updated:** [December 11, 2022, 6:38am UTC](https://discuss.elastic.co/t/indices-dont-have-primary-shards-transform-notifications-000002-watches-kibana-task-manager-7-17-0-001/320963 "2022-12-11T06:38:23Z")
From last 2 4 weeks, Sanpshots are failing with the following the same error message. Finding a solution for snapshot creation where the same policies were working fine earlier but all of sudden the same policies are wor… --- ## [How can create script field by using SQL or DSL instead of painless?](https://discuss.elastic.co/t/how-can-create-script-field-by-using-sql-or-dsl-instead-of-painless/320863)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 4\ **Last updated:** [December 12, 2022, 5:30am UTC](https://discuss.elastic.co/t/how-can-create-script-field-by-using-sql-or-dsl-instead-of-painless/320863 "2022-12-12T05:30:10Z")
hi everyone, as i know Es support create script field, running\_time filed while query by using painless. But can I create an script field like that by using SQL ? Example: select case when col1 = 1 then 2 else 0 end as … --- ## [Connect to remote cluster](https://discuss.elastic.co/t/connect-to-remote-cluster/320952)
**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 5:23am UTC](https://discuss.elastic.co/t/connect-to-remote-cluster/320952 "2022-12-12T05:23:26Z")
hi guys i want to connect two clusters elasticsearch for cross search this is my query : PUT /\_cluster/settings { "persistent" : { "cluster" : { "remote" : { "c2" : { "seeds" : \[ "\*\*\*\*\*\*\*\*\*\*\*\*\*.westeurope.azure… --- ## [Store size in esrally summary report doesn't match real index size](https://discuss.elastic.co/t/store-size-in-esrally-summary-report-doesnt-match-real-index-size/320908)
**Author:** [@tmdgk490255](https://discuss.elastic.co/u/tmdgk490255)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 2:43am UTC](https://discuss.elastic.co/t/store-size-in-esrally-summary-report-doesnt-match-real-index-size/320908 "2022-12-12T02:43:22Z")
I'm using custom track and benchmarking on existing cluster(single node) This is my summary report for custom track \_\_\_\_ \_\_\_\_ / \_\_ \\\_\_\_\_ \_/ / /\_ \_\_ / /\_/ / \_\_ \`/ / / / / / / \_, \_/ /\_/ / / / /\_/ / /\_/ … --- ## [Integration node needed for Fleetserver on ECE](https://discuss.elastic.co/t/integration-node-needed-for-fleetserver-on-ece/320943)
**Author:** [@stobbe](https://discuss.elastic.co/u/stobbe)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 2:40am UTC](https://discuss.elastic.co/t/integration-node-needed-for-fleetserver-on-ece/320943 "2022-12-12T02:40:01Z")
Hello, Found this in the documentation that when you deploy a fleetserver on ECE, you also need to start an Integration node. This is not needed for the regular elastic stack. Can anybody explain this a little more… --- ## [Logstash won't send data to ES after re-create ES Cluster(Kafka Input)](https://discuss.elastic.co/t/logstash-wont-send-data-to-es-after-re-create-es-cluster-kafka-input/320230)
**Author:** [@da-head0](https://discuss.elastic.co/u/da-head0)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 2:15am UTC](https://discuss.elastic.co/t/logstash-wont-send-data-to-es-after-re-create-es-cluster-kafka-input/320230 "2022-12-12T02:15:12Z")
Hello, ELK version : 8.4.2 Environment: Logstash in EKS, ECK Elasticsearch Hello, I used to send data to Elasticsearch with these config. input { kafka { bootstrap\_servers =\> "xx:9094, xx2:909… --- ## [Questions about the system.memory field](https://discuss.elastic.co/t/questions-about-the-system-memory-field/320984)
**Author:** [@inwoox](https://discuss.elastic.co/u/inwoox)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 2:08am UTC](https://discuss.elastic.co/t/questions-about-the-system-memory-field/320984 "2022-12-12T02:08:35Z")
As the number in this field increased, the memory usage increased significantly with it. what is this? system.memory.page\_stats.pgsteal\_direct.pages system.memory.page\_stats.pgscan\_direct.pages Thank you always. --- ## [Can't store an async search response larger than \[10485760\] bytes. This limit can be set by changing the \[search.max\_async\_search\_response\_size\] setting](https://discuss.elastic.co/t/cant-store-an-async-search-response-larger-than-10485760-bytes-this-limit-can-be-set-by-changing-the-search-max-async-search-response-size-setting/316865)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 9:19am UTC](https://discuss.elastic.co/t/cant-store-an-async-search-response-larger-than-10485760-bytes-this-limit-can-be-set-by-changing-the-search-max-async-search-response-size-setting/316865 "2022-10-18T09:19:13Z")
Can't store an async search response larger than \[10485760\] bytes. This limit can be set by changing the \[search.max\_async\_search\_response\_size\] setting. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=701) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=703)