# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=718 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 719 --- ## [Elastic Search - Partial Update to around 30 million records in Elastic search index](https://discuss.elastic.co/t/elastic-search-partial-update-to-around-30-million-records-in-elastic-search-index/319167)
**Author:** [@harish0309](https://discuss.elastic.co/u/harish0309)\ **Replies:** 3\ **Last updated:** [November 29, 2022, 1:05am UTC](https://discuss.elastic.co/t/elastic-search-partial-update-to-around-30-million-records-in-elastic-search-index/319167 "2022-11-29T01:05:22Z")
Hi, I need to update some of the attributes of the document daily for around 30m records. Can you please suggest a suitable way to do it. --- ## [Reserved underscore field names](https://discuss.elastic.co/t/reserved-underscore-field-names/319212)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 3\ **Last updated:** [November 29, 2022, 12:59am UTC](https://discuss.elastic.co/t/reserved-underscore-field-names/319212 "2022-11-29T00:59:10Z")
Hello, ELK stack version: v7.x ... latest (Elasticsearch + Kibana + Filebeat) there are fields in the documents like \_id, \_index, \_score, \_type . I would like to add custom fields with names starting with an undersco… --- ## [Aliases not created in Index management](https://discuss.elastic.co/t/aliases-not-created-in-index-management/319052)
**Author:** [@anushyaadam](https://discuss.elastic.co/u/anushyaadam)\ **Replies:** 4\ **Last updated:** [November 29, 2022, 12:55am UTC](https://discuss.elastic.co/t/aliases-not-created-in-index-management/319052 "2022-11-29T00:55:11Z")
Hi Team, We are facing index lifecycle error in index management and it couldn't be rollover also, it shows Aliases as none status. Could you please help us to fix the issue. Please find the attached snapshot. Regar… --- ## [Kibana dashboards - global filter vs individual filters performance](https://discuss.elastic.co/t/kibana-dashboards-global-filter-vs-individual-filters-performance/319961)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 2\ **Last updated:** [November 29, 2022, 12:51am UTC](https://discuss.elastic.co/t/kibana-dashboards-global-filter-vs-individual-filters-performance/319961 "2022-11-29T00:51:34Z")
Right now I have three objects on a dashboard (one saved search, two data table lens) that are using the logs-system\* namespace. Each LENs is using this filter: event.dataset:"system.system" Is there any performance … --- ## [Text Markdown visualization fails when copying to other spaces](https://discuss.elastic.co/t/text-markdown-visualization-fails-when-copying-to-other-spaces/317900)
**Author:** [@mmartinez](https://discuss.elastic.co/u/mmartinez)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 10:03am UTC](https://discuss.elastic.co/t/text-markdown-visualization-fails-when-copying-to-other-spaces/317900 "2022-11-02T10:03:00Z")
Hello, I have a Dashboard with a text visualization that I use to jump from that Dashboard to another. This is the markdown of the visualization: \[Nginx logs overview\](#/dashboard/39ad9660-3e40-11ed-ab98-8766b05540f5)… --- ## [How to find the button for creating a dashboard?](https://discuss.elastic.co/t/how-to-find-the-button-for-creating-a-dashboard/319976)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 11:24pm UTC](https://discuss.elastic.co/t/how-to-find-the-button-for-creating-a-dashboard/319976 "2022-11-28T23:24:20Z")
Hi, i am stuck in a fresh installed Cloud-Trial version having no option to create a dashboard. What i see if i click on the 3 stripes and then on "dashboard" is: But what i want to see is something l… --- ## [Result window is too large](https://discuss.elastic.co/t/result-window-is-too-large/319979)
**Author:** [@rayyanalbaz1](https://discuss.elastic.co/u/rayyanalbaz1)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 11:01pm UTC](https://discuss.elastic.co/t/result-window-is-too-large/319979 "2022-11-28T23:01:51Z")
Hello, I am facing an issue when using from and size to query the last page for example: my index contains 122000 documents if I specify size = 100 and from = 121000 I get the following error: {"type":"illegal\_argume… --- ## [Logstash Pipeline Tester 2.0 - Now more user friendly](https://discuss.elastic.co/t/logstash-pipeline-tester-2-0-now-more-user-friendly/319984)
**Author:** [@epacke](https://discuss.elastic.co/u/epacke)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 10:05pm UTC](https://discuss.elastic.co/t/logstash-pipeline-tester-2-0-now-more-user-friendly/319984 "2022-11-28T22:05:57Z")
Hi there! A few years ago I wrote a a tool for testing logstash pipelines. This year I did a complete redesign of the web interface using Material UI making it more user friendly. Basically it's a tool that: Gives yo… --- ## [Minimum\_should\_match ignore specific should property](https://discuss.elastic.co/t/minimum-should-match-ignore-specific-should-property/319982)
**Author:** [@hgr](https://discuss.elastic.co/u/hgr)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 9:33pm UTC](https://discuss.elastic.co/t/minimum-should-match-ignore-specific-should-property/319982 "2022-11-28T21:33:50Z")
Hi there, I have a query with 3 should filters, with different boost values, like this "should": \[ { "constant\_score": { "filter": { "term": { … --- ## [Result window is too large when using from and size](https://discuss.elastic.co/t/result-window-is-too-large-when-using-from-and-size/319978)
**Author:** [@rayyanalbaz1](https://discuss.elastic.co/u/rayyanalbaz1)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 9:16pm UTC](https://discuss.elastic.co/t/result-window-is-too-large-when-using-from-and-size/319978 "2022-11-28T21:16:48Z")
(topic deleted by author) --- ## [Visualize changes of an aggregation result over time](https://discuss.elastic.co/t/visualize-changes-of-an-aggregation-result-over-time/319897)
**Author:** [@daverin](https://discuss.elastic.co/u/daverin)\ **Replies:** 2\ **Last updated:** [November 28, 2022, 7:53pm UTC](https://discuss.elastic.co/t/visualize-changes-of-an-aggregation-result-over-time/319897 "2022-11-28T19:53:48Z")
Hi there. I have been using Elastic for the past year but I am relatively new to Kibana. Basic info on my setup and usecase: I have my database records streaming into Elastic via Kafka Connect. When a record changes i… --- ## [TSL: Unable to connect to remote cluster, certificate missing "common-names"](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855)
**Author:** [@hkhalil](https://discuss.elastic.co/u/hkhalil)\ **Replies:** 5\ **Last updated:** [November 28, 2022, 5:51pm UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855 "2022-11-28T17:51:28Z")
Hi, We would like to use markdown to display images on our Kibana dashboards which are hosted in the cloud (i.e.: "Elastic Cloud"). Those images are confidential. As such, we cannot host them on a server accessible fro… --- ## [Filebeat shipping same (rotated) logs over and over](https://discuss.elastic.co/t/filebeat-shipping-same-rotated-logs-over-and-over/319357)
**Author:** [@ori45654](https://discuss.elastic.co/u/ori45654)\ **Replies:** 2\ **Last updated:** [November 28, 2022, 2:40pm UTC](https://discuss.elastic.co/t/filebeat-shipping-same-rotated-logs-over-and-over/319357 "2022-11-28T14:40:47Z")
Hey, I want tp ship .log files from one server to another through filebeat-8.4.2-windows, they're both windows servers. the log files are rotated, from xxx.log to xxx.lo\_ . I'm testing new configurations in filebeat.yml … --- ## [Problem in elasticsearch-create-enrollment-token for Kibana](https://discuss.elastic.co/t/problem-in-elasticsearch-create-enrollment-token-for-kibana/319645)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 6\ **Last updated:** [November 28, 2022, 3:18pm UTC](https://discuss.elastic.co/t/problem-in-elasticsearch-create-enrollment-token-for-kibana/319645 "2022-11-28T15:18:49Z")
Hello all, I have a new installation of Elasticsearch 8.2 and KIbana 8.2 on my Windows Server. I have installed it on a Windows Server. Elasticsearch is up and running and configured to be an Windows Service. I can ac… --- ## [The length of the variable to display on visualization](https://discuss.elastic.co/t/the-length-of-the-variable-to-display-on-visualization/319510)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 5\ **Last updated:** [November 28, 2022, 1:37pm UTC](https://discuss.elastic.co/t/the-length-of-the-variable-to-display-on-visualization/319510 "2022-11-28T13:37:30Z")
Hi, i am sending a variable tag to the logs. I can see the variable value in elastic discovery but I am unable to see the value of that particular variable for a particular value on the lens table. if the length of the … --- ## [Fleet output](https://discuss.elastic.co/t/fleet-output/319834)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 3:42pm UTC](https://discuss.elastic.co/t/fleet-output/319834 "2022-11-25T15:42:17Z")
Is it possible to prevent Kibana from creating a default Fleet output? In my kibana.yml file that preconfigures Kibana before it gets installed I have created a custom fleet output doing the following: xpack.fleet.outp… --- ## [Ingest pipeline](https://discuss.elastic.co/t/ingest-pipeline/319931)
**Author:** [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\ **Replies:** 2\ **Last updated:** [November 28, 2022, 1:19pm UTC](https://discuss.elastic.co/t/ingest-pipeline/319931 "2022-11-28T13:19:23Z")
Hi there, Im new to ELK, and trying to extract some custom log no covered by filebeat module into kibana. So I tried to create a ingest node pipeline between filebeat and ES. So on filebeat.yml: 1) Add the pipeline nam… --- ## [Unable Return Multiple Variables from a transform in Elasticsearch Watcher script](https://discuss.elastic.co/t/unable-return-multiple-variables-from-a-transform-in-elasticsearch-watcher-script/319816)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 2\ **Last updated:** [November 28, 2022, 1:18pm UTC](https://discuss.elastic.co/t/unable-return-multiple-variables-from-a-transform-in-elasticsearch-watcher-script/319816 "2022-11-28T13:18:34Z")
Hi team, I have written a watch script where I need to pass the total hits value from an es search query and also a variable that I have created using transform. I have referred the following link for this -- Watcher: M… --- ## [Messsage throws \[beats\_input\_codec\_plain\_applied, \_grokparsefailure\] although the Grok pattern is accepted in Dev Tools Debugger](https://discuss.elastic.co/t/messsage-throws-beats-input-codec-plain-applied-grokparsefailure-although-the-grok-pattern-is-accepted-in-dev-tools-debugger/319942)
**Author:** [@franknord](https://discuss.elastic.co/u/franknord)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 1:15pm UTC](https://discuss.elastic.co/t/messsage-throws-beats-input-codec-plain-applied-grokparsefailure-although-the-grok-pattern-is-accepted-in-dev-tools-debugger/319942 "2022-11-28T13:15:49Z")
In my Logstash configuration I have a block saying: else if \[fields\]\[source\] == "Scan4SoftwareAndLicenses" { grok { match =\> { "message" =\> "\\"MachineData\\",\\"%{WORD:host\_… --- ## [Fleet enroll with --ca-sha256](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 0\ **Last updated:** [November 27, 2022, 8:43pm UTC](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891 "2022-11-27T20:43:37Z")
Hello, I am trying to enroll an elastic-agent to a self managed fleet server using the --ca-sha256 parameter. I have setup the fleet server security following this guide: If I try to enroll the agent using the follo… --- ## [Max limit context value in Kibana Alerts](https://discuss.elastic.co/t/max-limit-context-value-in-kibana-alerts/319929)
**Author:** [@Danny\_Dijkzeul](https://discuss.elastic.co/u/Danny_Dijkzeul)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 9:45am UTC](https://discuss.elastic.co/t/max-limit-context-value-in-kibana-alerts/319929 "2022-11-28T09:45:10Z")
Hi, I have a short question. In the standard Kibana Alert, there is a way to represent the value as {{context.value}}. However in the message it is always limited to 10.000, is there a way to show the real value? --- ## [Greater throughput in Standalone nodes compared to Multiple instances in same Hardware](https://discuss.elastic.co/t/greater-throughput-in-standalone-nodes-compared-to-multiple-instances-in-same-hardware/319918)
**Author:** [@Ritik\_Singhal](https://discuss.elastic.co/u/Ritik_Singhal)\ **Replies:** 7\ **Last updated:** [November 28, 2022, 12:52pm UTC](https://discuss.elastic.co/t/greater-throughput-in-standalone-nodes-compared-to-multiple-instances-in-same-hardware/319918 "2022-11-28T12:52:07Z")
We found below mentioned stats using esrally on comparing multiple instances on same node with standalone instances .Everything was same including configs and cluster size . | … --- ## [Elasticsearch Upgrade from 7.17.1 to 8.4.3](https://discuss.elastic.co/t/elasticsearch-upgrade-from-7-17-1-to-8-4-3/319872)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 11:37am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-from-7-17-1-to-8-4-3/319872 "2022-11-28T11:37:07Z")
Hello, I am upgrading the Elasticsearch instance from 7.5.1 to 8.4.3 but it's not working. I have created an Elasticsearch instance in Ubuntu 18.04 with version 7.5.1 and created a sample index and populated the data. … --- ## [Java exclude framework related classes](https://discuss.elastic.co/t/java-exclude-framework-related-classes/319940)
**Author:** [@APandey](https://discuss.elastic.co/u/APandey)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 11:28am UTC](https://discuss.elastic.co/t/java-exclude-framework-related-classes/319940 "2022-11-28T11:28:14Z")
Hello everyone, How can we filter out framework related classes from the final stack trace that we get for a transaction? For reference, { "stacktrace" : \[ { "exclude\_from\_gro… --- ## [Any esrally track which can index and query at the same time](https://discuss.elastic.co/t/any-esrally-track-which-can-index-and-query-at-the-same-time/319772)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 11:19am UTC](https://discuss.elastic.co/t/any-esrally-track-which-can-index-and-query-at-the-same-time/319772 "2022-11-28T11:19:19Z")
I watched two videos here (Quantitative Cluster Sizing | Elastic / Using Rally to Get Your Elasticsearch Cluster Size Right | Elastic Videos) and both of them emphasize the importance of testing indexing and querying a… --- ## [Getting error on starting elasticsearch ingest.geoip.downloader.enabled: false](https://discuss.elastic.co/t/getting-error-on-starting-elasticsearch-ingest-geoip-downloader-enabled-false/319388)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 24\ **Last updated:** [November 28, 2022, 9:26am UTC](https://discuss.elastic.co/t/getting-error-on-starting-elasticsearch-ingest-geoip-downloader-enabled-false/319388 "2022-11-28T09:26:05Z")
Hi, I have installed elk stack 8.5.1. with authentication without https on elasticsearch xpack.security.http.ssl: enabled: false keystore.path: certs/http.p12 When i start elasticsearch and kibana it shows active, … --- ## [Elasticsearch service fails](https://discuss.elastic.co/t/elasticsearch-service-fails/319650)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 5\ **Last updated:** [November 28, 2022, 9:20am UTC](https://discuss.elastic.co/t/elasticsearch-service-fails/319650 "2022-11-28T09:20:32Z")
Hi i have elk 8.5.1 installed on a machine with 8 gb ram and 50 gb hardisk. i've set jvm options to 2g for elasticsearch and 2g for logstash. I've elk stack +filebeat installed here. and i am getting logs from jenkins, n… --- ## [Can we use basic Elasticsearch for commercial use](https://discuss.elastic.co/t/can-we-use-basic-elasticsearch-for-commercial-use/319710)
**Author:** [@lhy507613824](https://discuss.elastic.co/u/lhy507613824)\ **Replies:** 7\ **Last updated:** [November 28, 2022, 9:10am UTC](https://discuss.elastic.co/t/can-we-use-basic-elasticsearch-for-commercial-use/319710 "2022-11-28T09:10:40Z")
Can we use basic Elasticsearch8.5 for commercial use --- ## [How to get the cpu usage of a user process?](https://discuss.elastic.co/t/how-to-get-the-cpu-usage-of-a-user-process/319919)
**Author:** [@sourabh\_rawat](https://discuss.elastic.co/u/sourabh_rawat)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 8:46am UTC](https://discuss.elastic.co/t/how-to-get-the-cpu-usage-of-a-user-process/319919 "2022-11-28T08:46:25Z")
Hi, I am trying to get the CPU usage of a process running in the user context but the process is not showing on the metrics overview page, I am able to get the details of processes which are running in the root context … --- ## [Disable scroll instructions on map](https://discuss.elastic.co/t/disable-scroll-instructions-on-map/317625)
**Author:** [@Cory34](https://discuss.elastic.co/u/Cory34)\ **Replies:** 5\ **Last updated:** [November 1, 2022, 12:56am UTC](https://discuss.elastic.co/t/disable-scroll-instructions-on-map/317625 "2022-11-01T00:56:00Z")
How do we disable the "Use control + scroll to zoom the map..." message which appears on the map? Thanks. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=717) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=719)