# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=742 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 743 --- ## [Alert index is not getting generated](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240)
**Author:** [@breakingcode](https://discuss.elastic.co/u/breakingcode)\ **Replies:** 3\ **Last updated:** [November 6, 2022, 3:37pm UTC](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240 "2022-11-06T15:37:02Z")
Hii, I am creating alerts for my data view. I configured the rule as if salary property in data view extends some value an document with alert info will be saved in alert index. But when I enable my rule no alert index i… --- ## [Flattened Data Type Sorting](https://discuss.elastic.co/t/flattened-data-type-sorting/318262)
**Author:** [@kailash\_lambe](https://discuss.elastic.co/u/kailash_lambe)\ **Replies:** 0\ **Last updated:** [November 6, 2022, 2:41pm UTC](https://discuss.elastic.co/t/flattened-data-type-sorting/318262 "2022-11-06T14:41:22Z")
Hi Team, I need your input for one of the tasks, I am working on one of the project where I need the different multiple price combinations for each product and since we do not have control over the number of combination… --- ## [Dev tools painless lab vs Watcher transform Context (Map Stream)](https://discuss.elastic.co/t/dev-tools-painless-lab-vs-watcher-transform-context-map-stream/318256)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [November 6, 2022, 11:05am UTC](https://discuss.elastic.co/t/dev-tools-painless-lab-vs-watcher-transform-context-map-stream/318256 "2022-11-06T11:05:35Z")
hi I could use below logic successfully in Watcher transforms def documents = ctx.payload.hits.hits.stream() .map(hit -\> \[ "sum\_other\_doc\_count": hit.\_source.event\_dataset.sum\_other\_doc\_count \]) .coll… --- ## [Wrong timestamp in Alert index](https://discuss.elastic.co/t/wrong-timestamp-in-alert-index/318247)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [November 6, 2022, 5:51am UTC](https://discuss.elastic.co/t/wrong-timestamp-in-alert-index/318247 "2022-11-06T05:51:18Z")
Hi All, I have created an alert which will do send alert on a specified index. I have chosen elasticsearch query index. I have used metricbeat-\* index for monitoring system uptime if node goes down i will get the alert … --- ## [Relevance of results on multiple fields](https://discuss.elastic.co/t/relevance-of-results-on-multiple-fields/318245)
**Author:** [@ChristopherHS](https://discuss.elastic.co/u/ChristopherHS)\ **Replies:** 0\ **Last updated:** [November 5, 2022, 6:55pm UTC](https://discuss.elastic.co/t/relevance-of-results-on-multiple-fields/318245 "2022-11-05T18:55:20Z")
Hello, We are new to the use of Elasticsearch, we can't make a setting to display the results with the right relevance on the phrase in the search. To give an example, when we do a search with the phrase Facebook Data … --- ## [Correct understanding of "aliases" in elasticsearch](https://discuss.elastic.co/t/correct-understanding-of-aliases-in-elasticsearch/318126)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 3\ **Last updated:** [November 5, 2022, 5:09pm UTC](https://discuss.elastic.co/t/correct-understanding-of-aliases-in-elasticsearch/318126 "2022-11-05T17:09:11Z")
Hello everyone, the question may be stupid, but I want to clarify: aliases in elasticsearch are essentially like links to one or more indexes or data streams, but recently during the creation of the ILM, I saw an error -… --- ## [Inner\_hits in has parent giving error-"Couldn't find nested source for path currentCompany"](https://discuss.elastic.co/t/inner-hits-in-has-parent-giving-error-couldnt-find-nested-source-for-path-currentcompany/318232)
**Author:** [@Venkat\_Koushik](https://discuss.elastic.co/u/Venkat_Koushik)\ **Replies:** 0\ **Last updated:** [November 5, 2022, 10:18am UTC](https://discuss.elastic.co/t/inner-hits-in-has-parent-giving-error-couldnt-find-nested-source-for-path-currentcompany/318232 "2022-11-05T10:18:28Z")
Hello We are migrating to Elasticsearch 8 and when we are trying to fetch the data of parent document inner hits using has parent query it is returning exception but the reverse scenario is working good.Elasticsearch re… --- ## [Pretty option for kibana rest api?](https://discuss.elastic.co/t/pretty-option-for-kibana-rest-api/318213)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 2\ **Last updated:** [November 5, 2022, 1:58am UTC](https://discuss.elastic.co/t/pretty-option-for-kibana-rest-api/318213 "2022-11-05T01:58:58Z")
I tried running this command: curl -X GET -u myuser:mypass "https://localhost:5601/api/alerting/rules/\_find?pretty=true" But I get the error {"statusCode":400,"error":"Bad Request","message":"\[request query.pretty\]: d… --- ## [Elasticsearch 7.17.3: \[parent\] Data too large, data for \[cluster:monitor/nodes/stats\[n\]\]](https://discuss.elastic.co/t/elasticsearch-7-17-3-parent-data-too-large-data-for-cluster-monitor-nodes-stats-n/317349)
**Author:** [@alecswan](https://discuss.elastic.co/u/alecswan)\ **Replies:** 12\ **Last updated:** [November 5, 2022, 12:22am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-3-parent-data-too-large-data-for-cluster-monitor-nodes-stats-n/317349 "2022-11-05T00:22:43Z")
Hello, We recently upgraded from ES 7.9.2 to 7.17.3 (in preparation for the subsequent 8.x upgrade) and noticed that the cluster spends a lot more time in Yellow state than it used to. The root cause appears to be the "… --- ## [How can I add a ilm policy to an existing datastream index](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 4\ **Last updated:** [November 4, 2022, 11:12pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931 "2022-11-04T23:12:37Z")
Some how I have got an index (currently being written) in a data stream which does not have an ilm setting and therefore is not getting rolled over. It is unclear to me what I should do. When I tried to close the index… --- ## [Index key XXX did not match any of the cached resources (intermittent issue)](https://discuss.elastic.co/t/index-key-xxx-did-not-match-any-of-the-cached-resources-intermittent-issue/318219)
**Author:** [@vddmpo](https://discuss.elastic.co/u/vddmpo)\ **Replies:** 0\ **Last updated:** [November 4, 2022, 9:07pm UTC](https://discuss.elastic.co/t/index-key-xxx-did-not-match-any-of-the-cached-resources-intermittent-issue/318219 "2022-11-04T21:07:21Z")
Hi, There is intermittent problem with "add\_kubernetes\_metadata" (resource type: pod) when the log is not enriched. The debug logs show the following: {"log.level":"debug","@timestamp":"2022-11-04T18:57:06.524Z","log.l… --- ## [Unable to query for exact term](https://discuss.elastic.co/t/unable-to-query-for-exact-term/318215)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 9:08pm UTC](https://discuss.elastic.co/t/unable-to-query-for-exact-term/318215 "2022-11-04T21:08:51Z")
I'm still new to working with elasticsearch queries. I find that my query is returning too many results despite my attempts to request specific results. For example, if I run this query: GET /test-index/\_search { "que… --- ## [Help extracting logs from message field with /t delimiter](https://discuss.elastic.co/t/help-extracting-logs-from-message-field-with-t-delimiter/318212)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 3\ **Last updated:** [November 4, 2022, 7:50pm UTC](https://discuss.elastic.co/t/help-extracting-logs-from-message-field-with-t-delimiter/318212 "2022-11-04T19:50:03Z")
hello, I would like to know how I can extract the fields from this log, using grok or another way, I've tried with grok but I completely messed up, the question is how can i separate the fields with the /t delimiter? I … --- ## [Specific Encyption at Rest Algorithm?](https://discuss.elastic.co/t/specific-encyption-at-rest-algorithm/318210)
**Author:** [@tensor](https://discuss.elastic.co/u/tensor)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 7:26pm UTC](https://discuss.elastic.co/t/specific-encyption-at-rest-algorithm/318210 "2022-11-04T19:26:01Z")
Hi One of our customers is insisting we provide evidence of encryption used by our third party processors (which includes Elastic). I can find published statements that data is encrypted at rest in the SOC-3 compliance… --- ## [Logstash fails to start with SQS Input](https://discuss.elastic.co/t/logstash-fails-to-start-with-sqs-input/318142)
**Author:** [@garohde](https://discuss.elastic.co/u/garohde)\ **Replies:** 6\ **Last updated:** [November 4, 2022, 6:04pm UTC](https://discuss.elastic.co/t/logstash-fails-to-start-with-sqs-input/318142 "2022-11-04T18:04:02Z")
Hey everyone. New to the forum; hope I'm creating this thread in the right place. Been battling this odd problem for a few days and could really use some help. We have a Logstash server on an AWS EC2 server currently … --- ## [ECS field for pre-aggregated messages](https://discuss.elastic.co/t/ecs-field-for-pre-aggregated-messages/318143)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 5:38pm UTC](https://discuss.elastic.co/t/ecs-field-for-pre-aggregated-messages/318143 "2022-11-04T17:38:03Z")
ES 7.11 brought us the \_doc\_count metadata field and the ability to properly compute aggregations over individual ES documents that represent multiple occurrences. I would like to make use of this feature to preserve th… --- ## [How to get a date\_range boundary on script](https://discuss.elastic.co/t/how-to-get-a-date-range-boundary-on-script/318148)
**Author:** [@Victor\_Garcia](https://discuss.elastic.co/u/Victor_Garcia)\ **Replies:** 0\ **Last updated:** [November 4, 2022, 2:22am UTC](https://discuss.elastic.co/t/how-to-get-a-date-range-boundary-on-script/318148 "2022-11-04T02:22:09Z")
Hi, How can I access to a date\_range field boundary on a script? I tried doc\['field.gte'\] Also, I debug the class of the field Debug.explain(doc\['status.dates'\]) and get org.elasticsearch.index.fielddata.ScriptDocVa… --- ## [Search all doc between 2 times each day](https://discuss.elastic.co/t/search-all-doc-between-2-times-each-day/318124)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 3\ **Last updated:** [November 4, 2022, 4:16pm UTC](https://discuss.elastic.co/t/search-all-doc-between-2-times-each-day/318124 "2022-11-04T16:16:24Z")
Hi, I have an ES query where i want to search the doc created between 06 AM and 23 PM. I have add this to my query: "range": { "timestamp": { "format": "strict\_hour", … --- ## [Filebeat - processors parameters not being applied to all logs](https://discuss.elastic.co/t/filebeat-processors-parameters-not-being-applied-to-all-logs/318206)
**Author:** [@godisnemus](https://discuss.elastic.co/u/godisnemus)\ **Replies:** 0\ **Last updated:** [November 4, 2022, 3:47pm UTC](https://discuss.elastic.co/t/filebeat-processors-parameters-not-being-applied-to-all-logs/318206 "2022-11-04T15:47:53Z")
Fairly new to this. I'm trying to understand why some of our Filebeat logs are not being subject to the parameters defined in "processors". It is my understanding that the processor parameters should be applied to all d… --- ## [No runtime directory making kibana failed to start](https://discuss.elastic.co/t/no-runtime-directory-making-kibana-failed-to-start/318199)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 0\ **Last updated:** [November 4, 2022, 2:29pm UTC](https://discuss.elastic.co/t/no-runtime-directory-making-kibana-failed-to-start/318199 "2022-11-04T14:29:40Z")
Hi, I installed kibana 8.4.1-1 on a RHEL server using Elastic RPM's. After the first reboot, kibana failed to start because of missing /run/kibana directory: FATAL Error: ENOENT: no such file or directory, open '/run… --- ## [Unassigned primary + replica shard, minimise data loss](https://discuss.elastic.co/t/unassigned-primary-replica-shard-minimise-data-loss/317393)
**Author:** [@tg295](https://discuss.elastic.co/u/tg295)\ **Replies:** 11\ **Last updated:** [November 4, 2022, 2:27pm UTC](https://discuss.elastic.co/t/unassigned-primary-replica-shard-minimise-data-loss/317393 "2022-11-04T14:27:53Z")
Hello, my cluster is currently in red state due to one of both the primary and replica shard of an index becoming unassigned. This happened after a number of large tasks were executed simultaneously by accident on the sa… --- ## [How to Update Mapping using Object Initializer Syntax](https://discuss.elastic.co/t/how-to-update-mapping-using-object-initializer-syntax/318198)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 0\ **Last updated:** [November 4, 2022, 2:27pm UTC](https://discuss.elastic.co/t/how-to-update-mapping-using-object-initializer-syntax/318198 "2022-11-04T14:27:53Z")
Can someone help me with how to achieve below query using NEST in object initializer syntax. PUT /my-index-000001/\_mapping { "properties": { "email": { "type": "keyword" } } } --- ## [F5 VIP as syslog destination on network devices](https://discuss.elastic.co/t/f5-vip-as-syslog-destination-on-network-devices/318196)
**Author:** [@amitpal](https://discuss.elastic.co/u/amitpal)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 2:27pm UTC](https://discuss.elastic.co/t/f5-vip-as-syslog-destination-on-network-devices/318196 "2022-11-04T14:27:13Z")
We have all the network devices pointing to F5 Virtual server and under that server we have elastic nodes . In elastic , we see logs but all of them have source as F5 Self IP, i have marked NAT as none on F5 VIP but sti… --- ## [Unassigned Replica Shards](https://discuss.elastic.co/t/unassigned-replica-shards/317923)
**Author:** [@James\_Stallings](https://discuss.elastic.co/u/James_Stallings)\ **Replies:** 7\ **Last updated:** [November 4, 2022, 12:47pm UTC](https://discuss.elastic.co/t/unassigned-replica-shards/317923 "2022-11-04T12:47:36Z")
How often does the control loop run that checks to attempt to re-assign an unassigned replica shard? Is there documentation to this effect? Is there source code I can look at? --- ## [How exactly elasticsearch update an document when use update?](https://discuss.elastic.co/t/how-exactly-elasticsearch-update-an-document-when-use-update/318178)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 3\ **Last updated:** [November 4, 2022, 11:25am UTC](https://discuss.elastic.co/t/how-exactly-elasticsearch-update-an-document-when-use-update/318178 "2022-11-04T11:25:52Z")
hi everyone, as i read elasticsearch doc that, everytime I update an document, es will create new doc then merge old doc with new doc with new data. but what if my udpate API not change any filed of it, will it still c… --- ## [Best option for working with MySQL](https://discuss.elastic.co/t/best-option-for-working-with-mysql/318084)
**Author:** [@ChristopherHS](https://discuss.elastic.co/u/ChristopherHS)\ **Replies:** 2\ **Last updated:** [November 4, 2022, 11:10am UTC](https://discuss.elastic.co/t/best-option-for-working-with-mysql/318084 "2022-11-04T11:10:40Z")
Hello, We currently use Percona but to improve the search, we want to delegate this task to Elasticsearch. We have a videos table which contains over 4 million recordings. The search is done on all the fields below li… --- ## [Invalid data view without timeFieldName](https://discuss.elastic.co/t/invalid-data-view-without-timefieldname/318046)
**Author:** [@breakingcode](https://discuss.elastic.co/u/breakingcode)\ **Replies:** 10\ **Last updated:** [November 4, 2022, 10:48am UTC](https://discuss.elastic.co/t/invalid-data-view-without-timefieldname/318046 "2022-11-04T10:48:58Z")
Hi, I am trying to configure alerts from Kibana console. I using the option from Stack Management -\> Rules and Connector. I want to create the alert for documents in es index. For example: If I index the document where "… --- ## [How can i insert the history data into the data stream](https://discuss.elastic.co/t/how-can-i-insert-the-history-data-into-the-data-stream/318081)
**Author:** [@bo8888](https://discuss.elastic.co/u/bo8888)\ **Replies:** 2\ **Last updated:** [November 4, 2022, 9:53am UTC](https://discuss.elastic.co/t/how-can-i-insert-the-history-data-into-the-data-stream/318081 "2022-11-04T09:53:23Z")
{ "index\_templates": \[ { "name": "my-weather-sensor-index-template", "index\_template": { "index\_patterns": \[ "metrics-weather\_sensors-\*" \], "template": { "set… --- ## [Logstash-Twitter input error "undefined method \`filter' for nil:NilClass"](https://discuss.elastic.co/t/logstash-twitter-input-error-undefined-method-filter-for-nil-nilclass/317874)
**Author:** [@True](https://discuss.elastic.co/u/True)\ **Replies:** 5\ **Last updated:** [November 4, 2022, 9:44am UTC](https://discuss.elastic.co/t/logstash-twitter-input-error-undefined-method-filter-for-nil-nilclass/317874 "2022-11-04T09:44:42Z")
Hello. I have been facing issues using the 'Twitter input' in Logstash. LS version : 8.2.2 ES version : 8.2.2 When I run Logstash, Twit are not indexed and the error message below continues to appear. Did I write th… --- ## [Master\_not\_discovered\_exception error while setting up passwords for user](https://discuss.elastic.co/t/master-not-discovered-exception-error-while-setting-up-passwords-for-user/318079)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 9:39am UTC](https://discuss.elastic.co/t/master-not-discovered-exception-error-while-setting-up-passwords-for-user/318079 "2022-11-04T09:39:19Z")
While setting up the pasword for the built-in ES accounts by logging into the newly setup 3 node cluster docker exec -it es01 sh then running bin/elasticsearch-setup-passwords interactive --url https://localhost:9200 G… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=741) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=743)