# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=724 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 725 --- ## [Should I need raw data to create a Grok Filter?](https://discuss.elastic.co/t/should-i-need-raw-data-to-create-a-grok-filter/319386)
**Author:** [@aaron.chang](https://discuss.elastic.co/u/aaron.chang)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 8:33am UTC](https://discuss.elastic.co/t/should-i-need-raw-data-to-create-a-grok-filter/319386 "2022-11-22T08:33:08Z")
Hi , I am a new user to use ELK. I want to analyze Aruba Controller & MM's syslog. But ELK don't have Aruba's template to show clearly. So I need to grok it by myself. From some article ,I know that ELK will not save… --- ## [Can We set a Node to be both ML Node and Content Node](https://discuss.elastic.co/t/can-we-set-a-node-to-be-both-ml-node-and-content-node/319304)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 7:40am UTC](https://discuss.elastic.co/t/can-we-set-a-node-to-be-both-ml-node-and-content-node/319304 "2022-11-22T07:40:52Z")
Hello Team, I am new to Elastic and Machine Learning but what I have gathered by documentation is that to Use machine learning ( For the production cluster) it is better to use a dedicated machine learning node. Now in … --- ## [Search single character](https://discuss.elastic.co/t/search-single-character/319516)
**Author:** [@Zaid\_Raza](https://discuss.elastic.co/u/Zaid_Raza)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 7:23am UTC](https://discuss.elastic.co/t/search-single-character/319516 "2022-11-22T07:23:34Z")
Hi, I am creating a search query in which I am searching course name. For example if I search "Introduction to R" then the output is "Introduction to Scrum". In this query "R" is not considered as a single word while se… --- ## [Error sending data to APM server: Read timed out, response code is -1](https://discuss.elastic.co/t/error-sending-data-to-apm-server-read-timed-out-response-code-is-1/319515)
**Author:** [@greeshma](https://discuss.elastic.co/u/greeshma)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 7:23am UTC](https://discuss.elastic.co/t/error-sending-data-to-apm-server-read-timed-out-response-code-is-1/319515 "2022-11-22T07:23:15Z")
I have installed ELK 8.4.0 version and it is running successfully and installed elastic agent 1.8.1 version and apm server of 8.5 version. I have configured the tomcat application but while executing the server a found e… --- ## [Hierarchical-facets](https://discuss.elastic.co/t/hierarchical-facets/319512)
**Author:** [@athiraaravindan](https://discuss.elastic.co/u/athiraaravindan)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 6:11am UTC](https://discuss.elastic.co/t/hierarchical-facets/319512 "2022-11-22T06:11:20Z")
ho to create a nested facets like the picture below using elastic app-search-ui --- ## [Logstash server label shipped with logs](https://discuss.elastic.co/t/logstash-server-label-shipped-with-logs/319478)
**Author:** [@lubimamp](https://discuss.elastic.co/u/lubimamp)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 2:46am UTC](https://discuss.elastic.co/t/logstash-server-label-shipped-with-logs/319478 "2022-11-22T02:46:37Z")
Hi Everyone, i have 2+ logstash servers in cluster and i would like to have some tag/flag/whatever which to tell me from which logstash server exactly the message was shipped. I have cases in which one of the logstash s… --- ## [Data nodes unable to see the data in path.data](https://discuss.elastic.co/t/data-nodes-unable-to-see-the-data-in-path-data/319385)
**Author:** [@Joseph\_Khoury](https://discuss.elastic.co/u/Joseph_Khoury)\ **Replies:** 9\ **Last updated:** [November 22, 2022, 1:40am UTC](https://discuss.elastic.co/t/data-nodes-unable-to-see-the-data-in-path-data/319385 "2022-11-22T01:40:38Z")
Hello all, Initially my Elastic cluster was down after a trial license expired. I was able to successfully delete the license and revert back to the basic one. After that, all the nodes are up with a master. Nonethele… --- ## [Dynamic template vs Index template with explicit mapping in terms of performance](https://discuss.elastic.co/t/dynamic-template-vs-index-template-with-explicit-mapping-in-terms-of-performance/319399)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 4\ **Last updated:** [November 22, 2022, 12:42am UTC](https://discuss.elastic.co/t/dynamic-template-vs-index-template-with-explicit-mapping-in-terms-of-performance/319399 "2022-11-22T00:42:01Z")
Considering both search response speed and indexing rate (in my case the latter is more important ), which is more efficient? Dynamic template or Index template with explicit mapping ? It depends on my environment? --- ## [Does the aggregation-based area graph visualize correctly in Kibana v.7.17.0?](https://discuss.elastic.co/t/does-the-aggregation-based-area-graph-visualize-correctly-in-kibana-v-7-17-0/319394)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 12:09am UTC](https://discuss.elastic.co/t/does-the-aggregation-based-area-graph-visualize-correctly-in-kibana-v-7-17-0/319394 "2022-11-22T00:09:10Z")
I'm comparing the visualization of the aggregation-based area graph between Kibana v.7.6.1 and v.7.17.0. Each graph's view looks like below here. ・Kibana v.7.6.1 ・Kibana v.7.17.0 The graph of the later version(v… --- ## [About the dense vector compression](https://discuss.elastic.co/t/about-the-dense-vector-compression/319398)
**Author:** [@myazi](https://discuss.elastic.co/u/myazi)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 12:00am UTC](https://discuss.elastic.co/t/about-the-dense-vector-compression/319398 "2022-11-22T00:00:18Z")
Does elasticsearch have plans to support product quantization and SQ8 quantization? we have close to 10 Billion semantic vector index. The dense vector is 768 dimensional. --- ## [Elastic 8.0 refuses connections using hostname instead of localhost](https://discuss.elastic.co/t/elastic-8-0-refuses-connections-using-hostname-instead-of-localhost/319416)
**Author:** [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 10:51pm UTC](https://discuss.elastic.co/t/elastic-8-0-refuses-connections-using-hostname-instead-of-localhost/319416 "2022-11-21T22:51:59Z")
Hello team, I would like to ask you for your expertized advice. After an one of Elastic restart WITHOUT TOUCHING CONFIG :slight\_smile: it started refuse connections using hostname:9200. I have tried variations found … --- ## [Sometimes events write issues from Logstash to Elasticsearch](https://discuss.elastic.co/t/sometimes-events-write-issues-from-logstash-to-elasticsearch/319417)
**Author:** [@Jonathan\_G](https://discuss.elastic.co/u/Jonathan_G)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 10:03am UTC](https://discuss.elastic.co/t/sometimes-events-write-issues-from-logstash-to-elasticsearch/319417 "2022-11-21T10:03:30Z")
Hello! Issue: Usually everything works correctly. Logstash succsessfuly writes bulk requests with events to Elasticsearch. But sometimes we have issue with connectivity between Logstash && Elasticsearch. Issue relates … --- ## [Elasticsearch 7.17.7 ReadOnly Root FileSystem/Privileged Container](https://discuss.elastic.co/t/elasticsearch-7-17-7-readonly-root-filesystem-privileged-container/319473)
**Author:** [@rsoares82](https://discuss.elastic.co/u/rsoares82)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 3:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-17-7-readonly-root-filesystem-privileged-container/319473 "2022-11-21T15:37:23Z")
Hi all, I am using elasticsearch on version 7.17.7 we deploy to kubernetes using helm charts, it happens that our containers are marked vulnerable because they don't have a read only root file system and the containers … --- ## [Deleting document by query](https://discuss.elastic.co/t/deleting-document-by-query/318570)
**Author:** [@sssamant](https://discuss.elastic.co/u/sssamant)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 12:09am UTC](https://discuss.elastic.co/t/deleting-document-by-query/318570 "2022-11-21T00:09:00Z")
I am trying to use delete\_by\_query to delete some documents for a particular index. But it fails with illegal version value and I read that delete\_by\_query cannot be used to delete documents with index version zero. Is t… --- ## [Logstash s3 input .gz/folder/file patter possible?](https://discuss.elastic.co/t/logstash-s3-input-gz-folder-file-patter-possible/319493)
**Author:** [@acavalier](https://discuss.elastic.co/u/acavalier)\ **Replies:** 3\ **Last updated:** [November 21, 2022, 9:14pm UTC](https://discuss.elastic.co/t/logstash-s3-input-gz-folder-file-patter-possible/319493 "2022-11-21T21:14:29Z")
I want the s3 input to read the .gz/folder/file is this possible or will i need to use somthing else i.e. lambda to extract the files first. Currently the s3 input is reading the folder as the file. Any help is appreciat… --- ## [Elasticsearch refreshing indices, but documents still don't show up in search](https://discuss.elastic.co/t/elasticsearch-refreshing-indices-but-documents-still-dont-show-up-in-search/319325)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearch-refreshing-indices-but-documents-still-dont-show-up-in-search/319325 "2022-11-21T20:51:45Z")
I'm creating some documents on an index, using bulk. I can access them using get or mget. When I did a search, those documents didn't show up. So, I decided to refresh the indices. However, in some cases, it still happen… --- ## [Problem bringing string part in ElasticSearch](https://discuss.elastic.co/t/problem-bringing-string-part-in-elasticsearch/319492)
**Author:** [@Diego\_Souza](https://discuss.elastic.co/u/Diego_Souza)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 8:04pm UTC](https://discuss.elastic.co/t/problem-bringing-string-part-in-elasticsearch/319492 "2022-11-21T20:04:55Z")
I'm having a problem getting string part in Elasticsearch. Below is the configuration of index. PUT exemplo { "settings": { "analysis": { "analyzer": { "portuguese\_br": { "type": "portugu… --- ## [Beats vs Elastic Agent - use case of SIEM](https://discuss.elastic.co/t/beats-vs-elastic-agent-use-case-of-siem/319377)
**Author:** [@SirMuffington](https://discuss.elastic.co/u/SirMuffington)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 7:00pm UTC](https://discuss.elastic.co/t/beats-vs-elastic-agent-use-case-of-siem/319377 "2022-11-21T19:00:15Z")
Hello dear Community! I wanted to ask a beginner question - what is the difference between Beats and Elastic Agent and what is better for SIEM analysis? Cheers --- ## [Logstash input google pubsub - clarification](https://discuss.elastic.co/t/logstash-input-google-pubsub-clarification/319489)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 6:48pm UTC](https://discuss.elastic.co/t/logstash-input-google-pubsub-clarification/319489 "2022-11-21T18:48:28Z")
Hi, I wanted clarification on the below statement in the docs for the logstash Google pubsub input plugin All messages received from Pub/Sub will be converted to a logstash event and added to the processing pipeline qu… --- ## [Error setup passwords](https://discuss.elastic.co/t/error-setup-passwords/319370)
**Author:** [@ardue](https://discuss.elastic.co/u/ardue)\ **Replies:** 6\ **Last updated:** [November 21, 2022, 6:38pm UTC](https://discuss.elastic.co/t/error-setup-passwords/319370 "2022-11-21T18:38:47Z")
Hello, I am currently trying to connect two nodes to make a cluster Here is the configuration for node1 cluster.name: underpass node.name: node-01 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch … --- ## [\[Java\] new equivalent of boolQuery.hasClauses() in ES 8 Java client?](https://discuss.elastic.co/t/java-new-equivalent-of-boolquery-hasclauses-in-es-8-java-client/319485)
**Author:** [@toto12214](https://discuss.elastic.co/u/toto12214)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 5:44pm UTC](https://discuss.elastic.co/t/java-new-equivalent-of-boolquery-hasclauses-in-es-8-java-client/319485 "2022-11-21T17:44:59Z")
Hello, I'm looking for the new equivalent of the old BoolQueryBuilder.hasClauses() for Elasticsearch 8 Java client. It seems to have completely dissapear ? Any workaround about ? --- ## [Kibana TSVB how to visualize unique records count](https://discuss.elastic.co/t/kibana-tsvb-how-to-visualize-unique-records-count/319474)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 5:28pm UTC](https://discuss.elastic.co/t/kibana-tsvb-how-to-visualize-unique-records-count/319474 "2022-11-21T17:28:48Z")
Hi there! I'm exploring TSVB and I couldn't find a way to report unique record count w/ the "counter" viz. Any guidance on that? TIA Azulgrana --- ## [Request for help/direction to create node certificates/keys using own CA certificates in place](https://discuss.elastic.co/t/request-for-help-direction-to-create-node-certificates-keys-using-own-ca-certificates-in-place/317884)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 3\ **Last updated:** [November 21, 2022, 5:05pm UTC](https://discuss.elastic.co/t/request-for-help-direction-to-create-node-certificates-keys-using-own-ca-certificates-in-place/317884 "2022-11-21T17:05:22Z")
Hi All, We have our OWN CA certificates namely: ABC-Issuing-CA.crt ABC-Root-CA.crt With this we would like to create new Elasticsearch node certificates where we could not find any resource online for it. I am new t… --- ## [Elasticsearch does not start CentOS7](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 36\ **Last updated:** [November 21, 2022, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373 "2022-11-21T16:54:38Z")
Hi! Installed Elasticsearch as mentioned in Elastic Docs Generated certificates and keys - followed this link - How to install Elasticsearch and Kibana 8.0 on Centos 7 puppet here in the log - just name of the serve… --- ## [Ingesting csv data to elastic cloud by doc generator to specific index](https://discuss.elastic.co/t/ingesting-csv-data-to-elastic-cloud-by-doc-generator-to-specific-index/316299)
**Author:** [@ramreddy09](https://discuss.elastic.co/u/ramreddy09)\ **Replies:** 1\ **Last updated:** [October 25, 2022, 2:42pm UTC](https://discuss.elastic.co/t/ingesting-csv-data-to-elastic-cloud-by-doc-generator-to-specific-index/316299 "2022-10-25T14:42:05Z")
we in our project scrapping tweets using tweepy the data collected is in the csv that should be updated to index using python to elastic cloud in our code it is showing successful but we are unable to see index in the da… --- ## [GuardDuty en Elastic](https://discuss.elastic.co/t/guardduty-en-elastic/317442)
**Author:** [@Gonzalo\_Sandoval\_A](https://discuss.elastic.co/u/Gonzalo_Sandoval_A)\ **Replies:** 6\ **Last updated:** [November 21, 2022, 4:18pm UTC](https://discuss.elastic.co/t/guardduty-en-elastic/317442 "2022-11-21T16:18:07Z")
I am trying to create dashboard with information from AWS GuadDuty. I was already able to bring data to elastic through the elastic agent by enabling SQS integration from S3. The relevant information is in a field call… --- ## [DSL Query to filter an IP type field to display documents that have a public IP address](https://discuss.elastic.co/t/dsl-query-to-filter-an-ip-type-field-to-display-documents-that-have-a-public-ip-address/319007)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 4:10pm UTC](https://discuss.elastic.co/t/dsl-query-to-filter-an-ip-type-field-to-display-documents-that-have-a-public-ip-address/319007 "2022-11-21T16:10:20Z")
Hi there! I have documents with an IP type field showing 1 or more IP addresses and I need to apply a filter to the documents to show only the documents where there's a public IP address ( non-RFC1918). For example, le… --- ## [CA and certs](https://discuss.elastic.co/t/ca-and-certs/319422)
**Author:** [@davidafolabi](https://discuss.elastic.co/u/davidafolabi)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 3:39pm UTC](https://discuss.elastic.co/t/ca-and-certs/319422 "2022-11-21T15:39:18Z")
Hi, I have been able to create a CA, what command do I use to create an instance of that certificate. P.S: this is on a Windows OS. Thank you in advance for your help, David. --- ## [Logstash dissect change datatype to timestamp](https://discuss.elastic.co/t/logstash-dissect-change-datatype-to-timestamp/319470)
**Author:** [@edim2525](https://discuss.elastic.co/u/edim2525)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/logstash-dissect-change-datatype-to-timestamp/319470 "2022-11-21T15:04:40Z")
Hi , Is there a way to change the mapping field to timestamp ? This is my input "Time :2022-11-21 12:01:30.85" I'm using "dissect \> mapping" to map this field, but the output data type is "text" and I want it as a tim… --- ## [Kibana Vega Gantt chart](https://discuss.elastic.co/t/kibana-vega-gantt-chart/319351)
**Author:** [@liorh](https://discuss.elastic.co/u/liorh)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 2:51pm UTC](https://discuss.elastic.co/t/kibana-vega-gantt-chart/319351 "2022-11-21T14:51:43Z")
Hi guys I got this very simple example of Gantt chart with Vega: { "$schema": "https://vega.github.io/schema/vega-lite/v2.json", "description": "A simple bar chart with ranged data (aka Gantt Chart).", "data": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=723) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=725)