# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=705 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 706 --- ## [Rollup Index Empty Data](https://discuss.elastic.co/t/rollup-index-empty-data/320860)
**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 6:37am UTC](https://discuss.elastic.co/t/rollup-index-empty-data/320860 "2022-12-09T06:37:05Z")
Hi I created rollup jobs for my index xxx\_113 but the rollups index is empty { - "jobs": \[ - { - "config": { - "id": "test\_rollup", "index\_pattern": "xxx\_113", "rollup\_index": "… --- ## [How to use min\_score parameter in ES percolator query?](https://discuss.elastic.co/t/how-to-use-min-score-parameter-in-es-percolator-query/320845)
**Author:** [@aneeshkoya](https://discuss.elastic.co/u/aneeshkoya)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 6:28am UTC](https://discuss.elastic.co/t/how-to-use-min-score-parameter-in-es-percolator-query/320845 "2022-12-09T06:28:20Z")
Hi all. My case scenario is such that when the documents are percolated against the stored queries, only those queries that have a score greater than a threshold give a hit for the respective document. I tried min\_score… --- ## [Can We move mapping and template without moving data with snapshot and restore?](https://discuss.elastic.co/t/can-we-move-mapping-and-template-without-moving-data-with-snapshot-and-restore/320857)
**Author:** [@Vijaykumar\_Deshmukh1](https://discuss.elastic.co/u/Vijaykumar_Deshmukh1)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 6:16am UTC](https://discuss.elastic.co/t/can-we-move-mapping-and-template-without-moving-data-with-snapshot-and-restore/320857 "2022-12-09T06:16:56Z")
Is it Possible? like i dont want take snapshot of any index but just want to take snapshot of cluster state and restore it ! --- ## [What exactly elasticsearch is? Is it database or search engine](https://discuss.elastic.co/t/what-exactly-elasticsearch-is-is-it-database-or-search-engine/320856)
**Author:** [@Vijaykumar\_Deshmukh1](https://discuss.elastic.co/u/Vijaykumar_Deshmukh1)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 6:10am UTC](https://discuss.elastic.co/t/what-exactly-elasticsearch-is-is-it-database-or-search-engine/320856 "2022-12-09T06:10:15Z")
Just Want Clarity Please Help --- ## [Kibana equivalent to lookup table](https://discuss.elastic.co/t/kibana-equivalent-to-lookup-table/320839)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 5:48am UTC](https://discuss.elastic.co/t/kibana-equivalent-to-lookup-table/320839 "2022-12-09T05:48:49Z")
I have a list of all user.names in a lens table and another list of user.names in another table. I want to perform lookup between the two tables to create a list of user.names are in the first table but not in the other … --- ## [A logstash to bigquery transmission problem](https://discuss.elastic.co/t/a-logstash-to-bigquery-transmission-problem/320771)
**Author:** [@dalaopo](https://discuss.elastic.co/u/dalaopo)\ **Replies:** 4\ **Last updated:** [December 9, 2022, 2:01am UTC](https://discuss.elastic.co/t/a-logstash-to-bigquery-transmission-problem/320771 "2022-12-09T02:01:50Z")
Hello！ I encountered an error when I used logstash to transfer kafka data to google bigquery \[ERROR\]\[logstash.outputs.googlebigquery\]\[main\]\[30729410306cb4d98635a59cbf171cea3b769fd734b29b17e925785d4edac5ba\] Error upload… --- ## [How to set the browser time zone for Vega?](https://discuss.elastic.co/t/how-to-set-the-browser-time-zone-for-vega/320155)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 11:38pm UTC](https://discuss.elastic.co/t/how-to-set-the-browser-time-zone-for-vega/320155 "2022-12-08T23:38:32Z")
I have a Vega visualization within Kibana. The vega part looks like this { $schema: https://vega.github.io/schema/vega-lite/v5.json title: Event counts from all indexes data: { url: { %context%: true … --- ## [Kibana URL not updating with Filters](https://discuss.elastic.co/t/kibana-url-not-updating-with-filters/318602)
**Author:** [@pk80103](https://discuss.elastic.co/u/pk80103)\ **Replies:** 6\ **Last updated:** [December 8, 2022, 11:38pm UTC](https://discuss.elastic.co/t/kibana-url-not-updating-with-filters/318602 "2022-12-08T23:38:18Z")
Hi Everyone, I have an issue with my Kibana Dashboard. Whenever I update some filter the vlaues of the URL is expected to be changes but it is not changing. It is remaining same. Currect values for URL in Kibana Dashbo… --- ## [Scatter plot by VEGA](https://discuss.elastic.co/t/scatter-plot-by-vega/318701)
**Author:** [@sshota](https://discuss.elastic.co/u/sshota)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 2:24am UTC](https://discuss.elastic.co/t/scatter-plot-by-vega/318701 "2022-11-11T02:24:59Z")
We have created attached scatter plot by VEGA. The code what we use is as below (We concealed critical information): { "$schema": "https://vega.github.io/schema/vega-lite/v2.json", "mark": { type:"point", filled… --- ## [Fuzzy matching hashtag with Simple Query String Query](https://discuss.elastic.co/t/fuzzy-matching-hashtag-with-simple-query-string-query/320416)
**Author:** [@kabcampbell](https://discuss.elastic.co/u/kabcampbell)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 10:44pm UTC](https://discuss.elastic.co/t/fuzzy-matching-hashtag-with-simple-query-string-query/320416 "2022-12-08T22:44:51Z")
I have an indexed field named "searchBucket" with the term "#revit" in it. Here is the analyzer applied to that field: "default" : { "filter" : \[ "lowercase", "asciifolding"… --- ## [Show bar horizontal as percentage](https://discuss.elastic.co/t/show-bar-horizontal-as-percentage/320752)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 9:36pm UTC](https://discuss.elastic.co/t/show-bar-horizontal-as-percentage/320752 "2022-12-08T21:36:52Z")
Hello, i have this bar horizontal lens: I wanted to show the numbers of volume\_total (5,797,557) as percentage (the application\_name's volume\_total divided by the sum of volume\_total of all application). But if i use… --- ## [Elasticsearch can't start service](https://discuss.elastic.co/t/elasticsearch-cant-start-service/320823)
**Author:** [@natthanon\_khr](https://discuss.elastic.co/u/natthanon_khr)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 9:23pm UTC](https://discuss.elastic.co/t/elasticsearch-cant-start-service/320823 "2022-12-08T21:23:39Z")
I can't start and restart systemctl elasticsearch after reboot server, I want to know what is the reason please. this is log! \[2022-12-09T00:59:50,406\]\[WARN \]\[o.e.b.Natives \] \[vmcbmsudbu01\] unable to load JN… --- ## [Batch Upload with Enrich Policy Suddenly taking much longer](https://discuss.elastic.co/t/batch-upload-with-enrich-policy-suddenly-taking-much-longer/320493)
**Author:** [@cj\_hillbrand](https://discuss.elastic.co/u/cj_hillbrand)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 9:13pm UTC](https://discuss.elastic.co/t/batch-upload-with-enrich-policy-suddenly-taking-much-longer/320493 "2022-12-08T21:13:27Z")
Hello all, My team has been running a single-vm elasticsearch instance for about a year and we are currently facing an issue when it comes to batch uploading documents, which is also assigned an enrichment policy. To h… --- ## [Error in logstash plain file](https://discuss.elastic.co/t/error-in-logstash-plain-file/320624)
**Author:** [@michaeljsamuel](https://discuss.elastic.co/u/michaeljsamuel)\ **Replies:** 18\ **Last updated:** [December 8, 2022, 8:39pm UTC](https://discuss.elastic.co/t/error-in-logstash-plain-file/320624 "2022-12-08T20:39:04Z")
Hi there, I am trying to use logstash on windows and believe I have downloaded it correctly however i am unable to forward any logs and this is what is in my plain file \[2022-12-07T10:41:03,853\]\[INFO \]\[logstash.runner … --- ## [Escaping a forward slash / in a regex match](https://discuss.elastic.co/t/escaping-a-forward-slash-in-a-regex-match/320828)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 8:05pm UTC](https://discuss.elastic.co/t/escaping-a-forward-slash-in-a-regex-match/320828 "2022-12-08T20:05:41Z")
Hello, This should be rather simple but I'm definitely overthinking this. I've tried escaping a forward slash in a regex match for a painless script in an ingest pipeline and it fails every combination I try. I have t… --- ## [Infinite extent for field “amount”: \[Infinity, -Infinity\]](https://discuss.elastic.co/t/infinite-extent-for-field-amount-infinity-infinity/319876)
**Author:** [@sieky](https://discuss.elastic.co/u/sieky)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 7:26pm UTC](https://discuss.elastic.co/t/infinite-extent-for-field-amount-infinity-infinity/319876 "2022-12-08T19:26:46Z")
I am a new to vega.I just follow vega website's tutorials and create a bar chart sucessfully.But,when I replace data source: "data": \[ { "name": "table", "values": \[ {"category": "A", "amount": 28}, {"category": "B", "a… --- ## [Is there an easy way to manage custom ingest pipeline and custom fields for Elastic Agent Integrations?](https://discuss.elastic.co/t/is-there-an-easy-way-to-manage-custom-ingest-pipeline-and-custom-fields-for-elastic-agent-integrations/319682)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 7:01pm UTC](https://discuss.elastic.co/t/is-there-an-easy-way-to-manage-custom-ingest-pipeline-and-custom-fields-for-elastic-agent-integrations/319682 "2022-12-08T19:01:37Z")
Hello, We are trying to find a way to manage custom ingest pipelines and fields/mappings for our integrations. As an example, we are using the Cisco Duo integration, this integration has the following ingest pipelines. … --- ## [Extract logs from the message field and create new separate runtime fields](https://discuss.elastic.co/t/extract-logs-from-the-message-field-and-create-new-separate-runtime-fields/320670)
**Author:** [@Ajmal\_Khalil](https://discuss.elastic.co/u/Ajmal_Khalil)\ **Replies:** 19\ **Last updated:** [December 8, 2022, 6:58pm UTC](https://discuss.elastic.co/t/extract-logs-from-the-message-field-and-create-new-separate-runtime-fields/320670 "2022-12-08T18:58:03Z")
Hi everyone, I'm using ELK stack version 8.4.0 and i need to extract logs data from message field that is something like "ERRORS" "EXCEPTIONS" etc and i want a new field for every extracted value so that i can easily cr… --- ## [Kibana not accessible in browser after allowing port in firewall-cmd](https://discuss.elastic.co/t/kibana-not-accessible-in-browser-after-allowing-port-in-firewall-cmd/316526)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 10:46pm UTC](https://discuss.elastic.co/t/kibana-not-accessible-in-browser-after-allowing-port-in-firewall-cmd/316526 "2022-10-13T22:46:18Z")
Hello, i have installed kibana in remote host from ssh. I tried curl from the host and it succeed. I tried to access it from browser, but it said ERR\_CONNECTION\_TIMED\_OUT. here is my firewalld # firewall-cmd --list-… --- ## [How query\_string work underlying](https://discuss.elastic.co/t/how-query-string-work-underlying/320807)
**Author:** [@hieple18](https://discuss.elastic.co/u/hieple18)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 6:01pm UTC](https://discuss.elastic.co/t/how-query-string-work-underlying/320807 "2022-12-08T18:01:52Z")
I am trying to figure out how query\_string work underlying. cause I want to compare performance of using query\_string with other solution I tried to deep dive into source code but no answer example I have a query { … --- ## [Connect filebeat to logstash](https://discuss.elastic.co/t/connect-filebeat-to-logstash/320399)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 5\ **Last updated:** [December 8, 2022, 5:00pm UTC](https://discuss.elastic.co/t/connect-filebeat-to-logstash/320399 "2022-12-08T17:00:30Z")
Hi! created openssl keys and copied to filebeat host in /etc/ssl/ folder: \[root@fbeat ssl\]# ls -l total 8 lrwxrwxrwx. 1 root root 16 Oct 23 20:02 certs -\> ../pki/tls/certs -rw-r--r--. 1 root root 1704 Nov 28 23:46 l… --- ## [Jboss logs module](https://discuss.elastic.co/t/jboss-logs-module/320813)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 4:59pm UTC](https://discuss.elastic.co/t/jboss-logs-module/320813 "2022-12-08T16:59:01Z")
Hello! which is the best module in filebeat to parse jboss logs? Thank you --- ## [Self-hosting and license](https://discuss.elastic.co/t/self-hosting-and-license/320767)
**Author:** [@leo\_girault](https://discuss.elastic.co/u/leo_girault)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 4:52pm UTC](https://discuss.elastic.co/t/self-hosting-and-license/320767 "2022-12-08T16:52:21Z")
Hi there, First I'm sorry if this question has already been answered but I've not been able to find this information neither on official Elasticsearch documentation nor on Discussion / Forums. So far we are using in my… --- ## [Using ElasticSearch(from ECK) storage with Azure remote storages](https://discuss.elastic.co/t/using-elasticsearch-from-eck-storage-with-azure-remote-storages/320797)
**Author:** [@OlLap](https://discuss.elastic.co/u/OlLap)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 2:09pm UTC](https://discuss.elastic.co/t/using-elasticsearch-from-eck-storage-with-azure-remote-storages/320797 "2022-12-08T14:09:26Z")
Hello, is it possible to use any of the Azure storage types (Files share or Blob container) with Elasticsearch installed on Azure Kubernetes Cluster? I tried with Azure Disks and everything works, but building Hot-Warm-… --- ## [Logstash | pubsub |Consume the early message instead of the oldest?](https://discuss.elastic.co/t/logstash-pubsub-consume-the-early-message-instead-of-the-oldest/320802)
**Author:** [@dfraz](https://discuss.elastic.co/u/dfraz)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 3:13pm UTC](https://discuss.elastic.co/t/logstash-pubsub-consume-the-early-message-instead-of-the-oldest/320802 "2022-12-08T15:13:50Z")
Hi Could it be possible to configure logstash to consume the early messages in Pubsub instead of the oldest ? thx for the help. --- ## [Update alert using index API](https://discuss.elastic.co/t/update-alert-using-index-api/320800)
**Author:** [@Med2](https://discuss.elastic.co/u/Med2)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 2:48pm UTC](https://discuss.elastic.co/t/update-alert-using-index-api/320800 "2022-12-08T14:48:03Z")
In order to retrieve all alerts that appear on kibana I used the "GET /.internal.alerts-security.alerts-\*/\_search" API. I know there is an API for updating indexes and was wondering if I can use it to update an alert in… --- ## [FIlebeat error-too many cases](https://discuss.elastic.co/t/filebeat-error-too-many-cases/320172)
**Author:** [@bharat97](https://discuss.elastic.co/u/bharat97)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-error-too-many-cases/320172 "2022-12-08T14:24:28Z")
Hi Community, My filebeat is crashing with this error. {"log.level":"info","@timestamp":"2022-11-30T14:39:55.579Z","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":185},"message":"Non-zero m… --- ## [How to setup elastic apm agent in Chalice framework (Python)](https://discuss.elastic.co/t/how-to-setup-elastic-apm-agent-in-chalice-framework-python/320793)
**Author:** [@Abhishek22](https://discuss.elastic.co/u/Abhishek22)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 1:54pm UTC](https://discuss.elastic.co/t/how-to-setup-elastic-apm-agent-in-chalice-framework-python/320793 "2022-12-08T13:54:23Z")
As we have chalice framework which we deploy to lambda (aws) but there is no any document on how to do the setup of APM agent on chalice framework python. As chalice don't use flask so it is getting difficult to add APM … --- ## [Push notification from Elasticsearch to Microsoft teams via Logstash pipeline](https://discuss.elastic.co/t/push-notification-from-elasticsearch-to-microsoft-teams-via-logstash-pipeline/320159)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 1:40pm UTC](https://discuss.elastic.co/t/push-notification-from-elasticsearch-to-microsoft-teams-via-logstash-pipeline/320159 "2022-12-08T13:40:16Z")
Hi All, I want to send some notifications from Elasticsearch to Microsoft teams via logstash pipeline. Based on my knowledge, I should use http output plugin to connect to Microsoft teams and push notification under me… --- ## [Rollup jobs with distinct/unique count on metrics](https://discuss.elastic.co/t/rollup-jobs-with-distinct-unique-count-on-metrics/318606)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 2:12pm UTC](https://discuss.elastic.co/t/rollup-jobs-with-distinct-unique-count-on-metrics/318606 "2022-11-10T14:12:03Z")
Hello, i was trying to set up a rollup job in kibana. Is it possible to aggregate using unique/distinct count in metric? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=704) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=706)