# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=720 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 721 --- ## [Whether notifications are available in elk cloud](https://discuss.elastic.co/t/whether-notifications-are-available-in-elk-cloud/317769)
**Author:** [@wodhgud](https://discuss.elastic.co/u/wodhgud)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 1:15am UTC](https://discuss.elastic.co/t/whether-notifications-are-available-in-elk-cloud/317769 "2022-10-31T01:15:07Z")
hello. I am a user using elk cloud. I have a question while using elk cloud. If elk cloud does not receive the metricbeat agent installed on the server, You can display or check a target that has not been received fr… --- ## [Can I label which entry of a nested property triggered a match in a nested query?](https://discuss.elastic.co/t/can-i-label-which-entry-of-a-nested-property-triggered-a-match-in-a-nested-query/319833)
**Author:** [@iamFIREcracker](https://discuss.elastic.co/u/iamFIREcracker)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 3:22pm UTC](https://discuss.elastic.co/t/can-i-label-which-entry-of-a-nested-property-triggered-a-match-in-a-nested-query/319833 "2022-11-25T15:22:43Z")
Let's say you were trying to model a "user" and decided that the following schema would be good enough for the job: first, the user's first name last, the user's last name custom, an array of of custom fields (i.e. … --- ## [Elastic-agent as non-root - possible?](https://discuss.elastic.co/t/elastic-agent-as-non-root-possible/319321)
**Author:** [@el\_gg](https://discuss.elastic.co/u/el_gg)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 1:14am UTC](https://discuss.elastic.co/t/elastic-agent-as-non-root-possible/319321 "2022-11-21T01:14:10Z")
Hi, We're doing a POC on the ELK stack and are now looking into the elastic-agent and fleet. Our install is on RHEL8 VMs. We now ran into this: Error: unable to perform install command, not executed with root permissi… --- ## [Hot nodes full](https://discuss.elastic.co/t/hot-nodes-full/318693)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 8\ **Last updated:** [November 25, 2022, 2:52pm UTC](https://discuss.elastic.co/t/hot-nodes-full/318693 "2022-11-25T14:52:24Z")
Hey Peeps, I have a theoretical question. What happens when you have nodes split by tiers - hot, warm, cold, and you have the indices managed by ILM. In case the hot nodes get filled up to the frozen watermark, would yo… --- ## [Find not updated indices through logsatsh](https://discuss.elastic.co/t/find-not-updated-indices-through-logsatsh/319829)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 2:24pm UTC](https://discuss.elastic.co/t/find-not-updated-indices-through-logsatsh/319829 "2022-11-25T14:24:35Z")
We have around 50 indices in elastic and their data are being updated daily basis. But if data is not updated in a day We want to log that index name so we can take some action. All indexes will have updatedAt field fro… --- ## [Barracuda WAF integration](https://discuss.elastic.co/t/barracuda-waf-integration/318749)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 2\ **Last updated:** [November 25, 2022, 2:11pm UTC](https://discuss.elastic.co/t/barracuda-waf-integration/318749 "2022-11-25T14:11:43Z")
Has anyone managed to successfully send Barracuda WAF logs to the Barracuda integration in Fleet? --- ## [How to replace comma with double quotes in Elasticsearch ingest pipeline?](https://discuss.elastic.co/t/how-to-replace-comma-with-double-quotes-in-elasticsearch-ingest-pipeline/319807)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 10:05am UTC](https://discuss.elastic.co/t/how-to-replace-comma-with-double-quotes-in-elasticsearch-ingest-pipeline/319807 "2022-11-25T10:05:20Z")
Hi Experts, Could you please assist me on how I can format the field value in Elasticsearch? I tried gsub under ingest pipeline , but it is not working as expected. code "gsub": { "field": "destination", … --- ## [Metric visualization vs number formatting](https://discuss.elastic.co/t/metric-visualization-vs-number-formatting/319735)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [November 25, 2022, 10:14am UTC](https://discuss.elastic.co/t/metric-visualization-vs-number-formatting/319735 "2022-11-25T10:14:39Z")
Wonder how to define the format of a metric value in a Metric panel to only show the integer value, ie. no decimals, not sure if this can be defined somehow under Options-\>Settings-\>Percentage mode, Format pattern as a N… --- ## [Search query is very slow while using spring-data-elasticsearch](https://discuss.elastic.co/t/search-query-is-very-slow-while-using-spring-data-elasticsearch/319803)
**Author:** [@Farhan\_Nazmul](https://discuss.elastic.co/u/Farhan_Nazmul)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 9:26am UTC](https://discuss.elastic.co/t/search-query-is-very-slow-while-using-spring-data-elasticsearch/319803 "2022-11-25T09:26:33Z")
I've an index which have: 6 shards 6 replica shards more than 1crore doc (row) in that single index 27 fields fields types are text, long and date index.max\_return\_result = 50000 Now I run the following query from pos… --- ## [Filebeat failed to load](https://discuss.elastic.co/t/filebeat-failed-to-load/319749)
**Author:** [@shubham.s](https://discuss.elastic.co/u/shubham.s)\ **Replies:** 4\ **Last updated:** [November 25, 2022, 8:03am UTC](https://discuss.elastic.co/t/filebeat-failed-to-load/319749 "2022-11-25T08:03:22Z")
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled) Active: failed (Result: start-lim… --- ## [Filebeat batch size taking default value and not changing](https://discuss.elastic.co/t/filebeat-batch-size-taking-default-value-and-not-changing/319796)
**Author:** [@vinit0711](https://discuss.elastic.co/u/vinit0711)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 7:39am UTC](https://discuss.elastic.co/t/filebeat-batch-size-taking-default-value-and-not-changing/319796 "2022-11-25T07:39:53Z")
I am running a single Node Elastic Cluster on a Server . Filebeat is used as collector for netflow data . Further Filebeat is giving output to Elastic . I am trying to improve the indexing rate in elastic by changing th… --- ## [Unknown key for a START\_OBJECT in \[knn\]](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-knn/319381)
**Author:** [@Scott\_M](https://discuss.elastic.co/u/Scott_M)\ **Replies:** 13\ **Last updated:** [November 25, 2022, 7:22am UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-knn/319381 "2022-11-25T07:22:12Z")
Has anybody actually used the knn sample in the documentation here:k-nearest neighbor (kNN) search | Elasticsearch Guide \[master\] | Elastic ? Here is their sample: POST image-index/\_search { "query": { "match": {… --- ## [How to loop through the values of array list to exactly match all the values](https://discuss.elastic.co/t/how-to-loop-through-the-values-of-array-list-to-exactly-match-all-the-values/319787)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 5\ **Last updated:** [November 25, 2022, 6:56am UTC](https://discuss.elastic.co/t/how-to-loop-through-the-values-of-array-list-to-exactly-match-all-the-values/319787 "2022-11-25T06:56:41Z")
Consider the below documents: Documents Doc 1 { "id": \[ "1a", "1b", "1c" \] } Doc 2 { "id": \[ "1a", "1b" \] } Doc 3 { "id": \[ "1a" \] } Now if … --- ## [Managed Elastic search for billion scale dense vector index and performance](https://discuss.elastic.co/t/managed-elastic-search-for-billion-scale-dense-vector-index-and-performance/316312)
**Author:** [@cvgoudar](https://discuss.elastic.co/u/cvgoudar)\ **Replies:** 2\ **Last updated:** [November 25, 2022, 6:51am UTC](https://discuss.elastic.co/t/managed-elastic-search-for-billion-scale-dense-vector-index-and-performance/316312 "2022-11-25T06:51:05Z")
We want to understand on the requirements and expected response time for vector based search with close to 1 Billion semantic vector index. The dense vector is 768 dimensional. What would be the appropriate configuratio… --- ## [Dense vector field space requirements](https://discuss.elastic.co/t/dense-vector-field-space-requirements/316304)
**Author:** [@ruslaniv](https://discuss.elastic.co/u/ruslaniv)\ **Replies:** 2\ **Last updated:** [November 25, 2022, 6:49am UTC](https://discuss.elastic.co/t/dense-vector-field-space-requirements/316304 "2022-11-25T06:49:25Z")
Hi! We are experimenting with dense vector field type for the purpose of similarity search. So we have a test index with approx 5\_000\_000 documents, each document has about 30 fields and 25 of these fields are mapped t… --- ## [Logstash sometimes ignoring datastream configuration in elasticsearch output](https://discuss.elastic.co/t/logstash-sometimes-ignoring-datastream-configuration-in-elasticsearch-output/319743)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 1\ **Last updated:** [November 25, 2022, 6:25am UTC](https://discuss.elastic.co/t/logstash-sometimes-ignoring-datastream-configuration-in-elasticsearch-output/319743 "2022-11-25T06:25:26Z")
Hello, we are running logstash 8.5.0 with multiple pipelines outputting to elasticsearch. Most of the time this works fine, but sometimes logstash will ignore the datastream configuration on startup and tries to write … --- ## [Happy Thanksgiving! & QQ)](https://discuss.elastic.co/t/happy-thanksgiving-qq/319769)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 6\ **Last updated:** [November 25, 2022, 4:30am UTC](https://discuss.elastic.co/t/happy-thanksgiving-qq/319769 "2022-11-25T04:30:54Z")
Hello World :wink: Happy Thanksgiving to everyone! Is there a way to see size per shard per node w/ sorting?) Thanks in advance! --- ## [Does "track\_total\_hits" affect "max\_score" calculation?](https://discuss.elastic.co/t/does-track-total-hits-affect-max-score-calculation/319784)
**Author:** [@zhang8473](https://discuss.elastic.co/u/zhang8473)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 3:08am UTC](https://discuss.elastic.co/t/does-track-total-hits-affect-max-score-calculation/319784 "2022-11-25T03:08:45Z")
If I setup track\_total\_hits:1 in a \_search query, it only tracks one document, then how about the max\_score, will it be accurate or just approx? I tried some. It looks like the "max\_score" is still accurate. Is that cor… --- ## [Heartbeat not in elastic support matrix since 8.3.0](https://discuss.elastic.co/t/heartbeat-not-in-elastic-support-matrix-since-8-3-0/319208)
**Author:** [@Jonathan\_Albrecht](https://discuss.elastic.co/u/Jonathan_Albrecht)\ **Replies:** 3\ **Last updated:** [November 24, 2022, 10:01pm UTC](https://discuss.elastic.co/t/heartbeat-not-in-elastic-support-matrix-since-8-3-0/319208 "2022-11-24T22:01:35Z")
The elastic support matrix Support Matrix | Elastic doesn't have any entries for heartbeat for versions after 8.3.0. Are 8.4.0 and later versions still supported on any distros? --- ## [Elastic-agent with system module does not send any data to elasticsearch](https://discuss.elastic.co/t/elastic-agent-with-system-module-does-not-send-any-data-to-elasticsearch/319689)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 24\ **Last updated:** [November 24, 2022, 8:38pm UTC](https://discuss.elastic.co/t/elastic-agent-with-system-module-does-not-send-any-data-to-elasticsearch/319689 "2022-11-24T20:38:20Z")
Hello, I have deployed a simple elastic-agent with a system system module where I wanted to have the /var/log/syslog ad messages parsed and send metrics (pretty default). But the module does not send any data into the e… --- ## [Logstash retries 404 instead of dropping - output stuck](https://discuss.elastic.co/t/logstash-retries-404-instead-of-dropping-output-stuck/319741)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 3\ **Last updated:** [November 24, 2022, 7:08pm UTC](https://discuss.elastic.co/t/logstash-retries-404-instead-of-dropping-output-stuck/319741 "2022-11-24T19:08:08Z")
Hi! Today I had a situation where one of our Elasticsearch outputs in logstash got unavailable. It replied with a 404. Based upon the documentation logstash should give a warning and drop the event. We have no DLQ confi… --- ## [Exiting: no outputs are defined, please define one under the output section](https://discuss.elastic.co/t/exiting-no-outputs-are-defined-please-define-one-under-the-output-section/319674)
**Author:** [@PunithRaj](https://discuss.elastic.co/u/PunithRaj)\ **Replies:** 11\ **Last updated:** [November 24, 2022, 5:48pm UTC](https://discuss.elastic.co/t/exiting-no-outputs-are-defined-please-define-one-under-the-output-section/319674 "2022-11-24T17:48:31Z")
Hello All, I am new to elastic and filebeats. I have installed filebeat to collect logs from defender apt via microsoft module and store them as file in linux server via file output method. But when i run the configurat… --- ## [How to use other language stop filter in \_analyze?](https://discuss.elastic.co/t/how-to-use-other-language-stop-filter-in-analyze/319767)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 2\ **Last updated:** [November 24, 2022, 5:47pm UTC](https://discuss.elastic.co/t/how-to-use-other-language-stop-filter-in-analyze/319767 "2022-11-24T17:47:37Z")
Hi, States that it has a \[Stop Token Filter\] (disabled by default) So to test the Standard Analyzer we type: POST \_analyze { "analyzer": "standard", "text": "The 2 QUICK Brown-Foxes jumped over the lazy dog's b… --- ## [Mapping keyword as date during ingestion - es 8.4.2, spark 3.2.0 on emr 6.6.0](https://discuss.elastic.co/t/mapping-keyword-as-date-during-ingestion-es-8-4-2-spark-3-2-0-on-emr-6-6-0/319546)
**Author:** [@Marcin\_Gasior](https://discuss.elastic.co/u/Marcin_Gasior)\ **Replies:** 7\ **Last updated:** [November 24, 2022, 5:16pm UTC](https://discuss.elastic.co/t/mapping-keyword-as-date-during-ingestion-es-8-4-2-spark-3-2-0-on-emr-6-6-0/319546 "2022-11-24T17:16:34Z")
I'm migrating our solution between elastic 7.1.0 and 8.4.2. Previously we used spark 2.4 and scala 2.11, now upgraded to latest and greatest versions :slight\_smile: The mapping is strict { "mappings": { "dynamic… --- ## [How to run two Elasticsearch Service on Window Server 2019?](https://discuss.elastic.co/t/how-to-run-two-elasticsearch-service-on-window-server-2019/319477)
**Author:** [@stramzik](https://discuss.elastic.co/u/stramzik)\ **Replies:** 5\ **Last updated:** [November 24, 2022, 4:21pm UTC](https://discuss.elastic.co/t/how-to-run-two-elasticsearch-service-on-window-server-2019/319477 "2022-11-24T16:21:59Z")
Hello, I have two instance of Elastic installed and configured to run on a different port on Windows server. I am required to run both the instance simultaneously. However when I try to run the second Elasticsearch ser… --- ## [Permission denied just after installation](https://discuss.elastic.co/t/permission-denied-just-after-installation/319568)
**Author:** [@Broot](https://discuss.elastic.co/u/Broot)\ **Replies:** 5\ **Last updated:** [November 24, 2022, 3:58pm UTC](https://discuss.elastic.co/t/permission-denied-just-after-installation/319568 "2022-11-24T15:58:35Z")
I'm trying to install and run Elasticsearch and Kibana and I can't do it because every time I try, I always get some Access Permission Denied. I'm on Ubuntu 20.04 thus installing via Debian for example : /usr/share/el… --- ## [Need help in undertsanding Elastic Hot Threads API output](https://discuss.elastic.co/t/need-help-in-undertsanding-elastic-hot-threads-api-output/319265)
**Author:** [@vinit0711](https://discuss.elastic.co/u/vinit0711)\ **Replies:** 16\ **Last updated:** [November 24, 2022, 2:43pm UTC](https://discuss.elastic.co/t/need-help-in-undertsanding-elastic-hot-threads-api-output/319265 "2022-11-24T14:43:30Z")
I am running a single Node Elastic Cluster on a Server . Filebeat is used as collector for netflow data . Further FIlebeat is giving output to Elastic . Some Important Point Server has 32 core CPU and 500 GB RAM . I se… --- ## [Kibana Rules & Connectors for Webhook body format - JSON format](https://discuss.elastic.co/t/kibana-rules-connectors-for-webhook-body-format-json-format/317643)
**Author:** [@TXBigDawg1836](https://discuss.elastic.co/u/TXBigDawg1836)\ **Replies:** 1\ **Last updated:** [October 27, 2022, 8:49pm UTC](https://discuss.elastic.co/t/kibana-rules-connectors-for-webhook-body-format-json-format/317643 "2022-10-27T20:49:27Z")
Attempting to send an alert using a webhook to a Microsoft Power Automate flow. We can see the alert fire from Kibana but the body is coming across as one, long string to the Power Automate flow. Wondering how the cont… --- ## [Multi matching wildcard text](https://discuss.elastic.co/t/multi-matching-wildcard-text/319619)
**Author:** [@Chitrank\_Bisht](https://discuss.elastic.co/u/Chitrank_Bisht)\ **Replies:** 2\ **Last updated:** [November 24, 2022, 2:38pm UTC](https://discuss.elastic.co/t/multi-matching-wildcard-text/319619 "2022-11-24T14:38:12Z")
I have to apply search on two fields, and I have a wildcard text to search. if the text is found in either of the fields that should result in a hit. I am using Olivere golang package. I tried a combination of should and… --- ## [Combining queries while preserving order](https://discuss.elastic.co/t/combining-queries-while-preserving-order/319760)
**Author:** [@Peter\_Strasser](https://discuss.elastic.co/u/Peter_Strasser)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 1:59pm UTC](https://discuss.elastic.co/t/combining-queries-while-preserving-order/319760 "2022-11-24T13:59:09Z")
Hi Elastic Community, I have the use case, that I want to search blocks of data in order. If we take products as an example a requirement could look like this: Group1: First 5 products are products with the id 120, 12… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=719) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=721)