# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=773 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 774 --- ## [Options not available in Kibana Discover for keyword field](https://discuss.elastic.co/t/options-not-available-in-kibana-discover-for-keyword-field/315872)
**Author:** [@gaurav\_soni](https://discuss.elastic.co/u/gaurav_soni)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 2:18pm UTC](https://discuss.elastic.co/t/options-not-available-in-kibana-discover-for-keyword-field/315872 "2022-10-05T14:18:01Z")
I imported some data , one of the fields had a mapping of type "text" , i later modified the mapping using the following. PUT /restaurant\_data/\_mapping { "properties": { "name": { "type": "text", "fiel… --- ## [Splunk eval Command Equivalent](https://discuss.elastic.co/t/splunk-eval-command-equivalent/314810)
**Author:** [@hi\_xavier](https://discuss.elastic.co/u/hi_xavier)\ **Replies:** 3\ **Last updated:** [October 5, 2022, 1:17pm UTC](https://discuss.elastic.co/t/splunk-eval-command-equivalent/314810 "2022-10-05T13:17:30Z")
Hi, My team is in process of moving from Splunk to Elk. Does Elk have an equivalent to Splunk's eval command? Thanks ! --- ## [Mockito Test for Elastic Java api client](https://discuss.elastic.co/t/mockito-test-for-elastic-java-api-client/315773)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 12:23pm UTC](https://discuss.elastic.co/t/mockito-test-for-elastic-java-api-client/315773 "2022-10-04T12:23:56Z")
I have tried to mock the response for the below method, but it's not working. Not able to mock the search.hits().hits() method. SearchResponse\ search = client.search(s -\> s .index("products") .query(q -\>… --- ## [Metricbeat PostgreSQL module missing Database Name](https://discuss.elastic.co/t/metricbeat-postgresql-module-missing-database-name/315881)
**Author:** [@robdiluca](https://discuss.elastic.co/u/robdiluca)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 1:09pm UTC](https://discuss.elastic.co/t/metricbeat-postgresql-module-missing-database-name/315881 "2022-10-05T13:09:41Z")
Hi all, I'm using the Metricbeat PostgreSQL module and the related default Kibana Dashboard. However, when activating the "statement" metricset, I noticed the documents it produce do not contain the field "postgresql.da… --- ## [Index routing allocation require does not work and throws confusing explain](https://discuss.elastic.co/t/index-routing-allocation-require-does-not-work-and-throws-confusing-explain/315873)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 12:18pm UTC](https://discuss.elastic.co/t/index-routing-allocation-require-does-not-work-and-throws-confusing-explain/315873 "2022-10-05T12:18:24Z")
Hello, I have a cluster on version 7.17 where I'm using a node attribute called node\_type with the values hot and warm to allocate shards and move between node type with ILM, all indices have an index.routing.allocatio… --- ## [Best way to form a cluster](https://discuss.elastic.co/t/best-way-to-form-a-cluster/315680)
**Author:** [@FredericB](https://discuss.elastic.co/u/FredericB)\ **Replies:** 5\ **Last updated:** [October 5, 2022, 11:19am UTC](https://discuss.elastic.co/t/best-way-to-form-a-cluster/315680 "2022-10-05T11:19:30Z")
Hi there, i'm new to ELK and also read lot of documentations from elastic.co I've tested many combinations to form a cluster and wondering can't find the best way to form it: 1-Creating the 1st Node (that is also a clu… --- ## [Convert kibana query language in json format automatically?](https://discuss.elastic.co/t/convert-kibana-query-language-in-json-format-automatically/315762)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 11:08am UTC](https://discuss.elastic.co/t/convert-kibana-query-language-in-json-format-automatically/315762 "2022-10-05T11:08:50Z")
hello i ve this query on discover message :"AREAS ENGINEERING" and message:"20220925104256" how convert in this format GET /myindex/\_search { "query": { "match\_phrase\_prefix": { "message": ????? why p… --- ## [How to partial update es in the output plugin of logstash](https://discuss.elastic.co/t/how-to-partial-update-es-in-the-output-plugin-of-logstash/315864)
**Author:** [@Juno163](https://discuss.elastic.co/u/Juno163)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 11:03am UTC](https://discuss.elastic.co/t/how-to-partial-update-es-in-the-output-plugin-of-logstash/315864 "2022-10-05T11:03:22Z")
By default, logstash output cannot partial update Elasticsearch but fully update. In my case, I can only search some fields which need to update, when it comes to es, the fields which didn't searched will update as blan… --- ## [Filebeat blocked after bulk file insertion](https://discuss.elastic.co/t/filebeat-blocked-after-bulk-file-insertion/315747)
**Author:** [@Marco\_Lagalla](https://discuss.elastic.co/u/Marco_Lagalla)\ **Replies:** 3\ **Last updated:** [October 5, 2022, 10:52am UTC](https://discuss.elastic.co/t/filebeat-blocked-after-bulk-file-insertion/315747 "2022-10-05T10:52:52Z")
Hi all, I am running an ELK platform where Filebeat is installed as agent in a container, monitoring a file written by Nginx. This nginx gets close to 30mln of requests at day. The ingestion of access logs is performin… --- ## [Sort data based on a field value](https://discuss.elastic.co/t/sort-data-based-on-a-field-value/315857)
**Author:** [@HadiKhai](https://discuss.elastic.co/u/HadiKhai)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 10:14am UTC](https://discuss.elastic.co/t/sort-data-based-on-a-field-value/315857 "2022-10-05T10:14:59Z")
Hello, I am saving priority inside the data and I am looking for a way to boost the score based on the priority. "userA":{ "specialities": \[ { "speciality\_priority": 3, "sp… --- ## [Unable to search for flattened (nested) field existence](https://discuss.elastic.co/t/unable-to-search-for-flattened-nested-field-existence/315863)
**Author:** [@ruslaniv](https://discuss.elastic.co/u/ruslaniv)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 10:47am UTC](https://discuss.elastic.co/t/unable-to-search-for-flattened-nested-field-existence/315863 "2022-10-05T10:47:51Z")
I'm storing an arbitrary nested object as a flattened field "\_meta" which contains various information related to a product. Here is the mapping for that field: "mappings": { "dynamic": "strict", "prope… --- ## [How to get doc\_count in terms aggregation?](https://discuss.elastic.co/t/how-to-get-doc-count-in-terms-aggregation/315855)
**Author:** [@Be-poz](https://discuss.elastic.co/u/Be-poz)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 10:10am UTC](https://discuss.elastic.co/t/how-to-get-doc-count-in-terms-aggregation/315855 "2022-10-05T10:10:37Z")
Hi i'd like to get doc\_count when i did terms aggregation. here is example i used. PUT sample { "mappings": { "properties": { "updateType": {"type": "keyword"}, "date": {"type": "date", "format": "epoc… --- ## [Date\_histogram breakdown](https://discuss.elastic.co/t/date-histogram-breakdown/315846)
**Author:** [@aa09](https://discuss.elastic.co/u/aa09)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 10:04am UTC](https://discuss.elastic.co/t/date-histogram-breakdown/315846 "2022-10-05T10:04:12Z")
I want to be able to break down my data by year and then further by month, im pretty sure this is possible but cant see exactly how. I am using the following at the moment to get a yearly breakdown: 'by\_year'… --- ## [Elasticsearch v8 Java API client search with filter (not postFilter)](https://discuss.elastic.co/t/elasticsearch-v8-java-api-client-search-with-filter-not-postfilter/315823)
**Author:** [@ijaxahmed](https://discuss.elastic.co/u/ijaxahmed)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 10:02am UTC](https://discuss.elastic.co/t/elasticsearch-v8-java-api-client-search-with-filter-not-postfilter/315823 "2022-10-05T10:02:25Z")
I wanted to replace postFilter with filter in the search, but not sure how to because Query has "query.postFilter(postFilters) " method but nothing as ".filter(filters) " . Current implementations is like , Creating Que… --- ## [Enrichment Policy does not match the values of an array/object](https://discuss.elastic.co/t/enrichment-policy-does-not-match-the-values-of-an-array-object/315562)
**Author:** [@hanna](https://discuss.elastic.co/u/hanna)\ **Replies:** 4\ **Last updated:** [October 5, 2022, 8:59am UTC](https://discuss.elastic.co/t/enrichment-policy-does-not-match-the-values-of-an-array-object/315562 "2022-10-05T08:59:36Z")
Hi, i have the following enrichmentpolicy that i cant get to work. The targetfield cveintel from the enrichmentpolicy is never created. Any help is appreciated. \> PUT \_enrich/policy/cve\_enrichment\_policy \> { \> "matc… --- ## [Cannot read configured \[PKCS12\] keystore (as a truststore)](https://discuss.elastic.co/t/cannot-read-configured-pkcs12-keystore-as-a-truststore/315849)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 8:33am UTC](https://discuss.elastic.co/t/cannot-read-configured-pkcs12-keystore-as-a-truststore/315849 "2022-10-05T08:33:05Z")
Hello, I configure TLS on all 5 nodes of my cluster. I followed this documentation: https://www.elastic.co/guide/en/elasticsearch/reference/8.0/security-basic-setup.html#encrypt-internode-communication I generated a C… --- ## [FSCrawler && SSL && SANs](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 28\ **Last updated:** [October 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263 "2022-10-05T08:27:52Z")
Hello There! I am trying to set up a FSCrawler. This is my \_settings.yaml file: --- name: "test-job" fs: url: "/tmp/es" update\_rate: "15m" excludes: - "\*/~\*" json\_support: false filename\_as\_id: false add… --- ## [FSCrawler and frozen indicies](https://discuss.elastic.co/t/fscrawler-and-frozen-indicies/314997)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 13\ **Last updated:** [October 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/fscrawler-and-frozen-indicies/314997 "2022-10-05T08:27:21Z")
Hello There! I have downloaded ans successfully started FSCrawler for my Elasticsearch cluster. This is how I start an instance: 08:11:23,753 INFO \[f.p.e.c.f.c.BootstrapChecks\] Memory \[Free/Total=Percent\]: HEAP \[83.3… --- ## [Metricbeat not able to recognise AWS modules](https://discuss.elastic.co/t/metricbeat-not-able-to-recognise-aws-modules/315661)
**Author:** [@Hasnain\_Raza](https://discuss.elastic.co/u/Hasnain_Raza)\ **Replies:** 4\ **Last updated:** [October 5, 2022, 7:17am UTC](https://discuss.elastic.co/t/metricbeat-not-able-to-recognise-aws-modules/315661 "2022-10-05T07:17:46Z")
Problem statement: Need to fetch logs from AWS resources ELB, cloudwatch, ecs etc. Need help in understanding the configs and why this error is coming. Metricbeat returns error Elastic version: 7.6.2 Exiting: 1 error:… --- ## [Automatically increase number of shards](https://discuss.elastic.co/t/automatically-increase-number-of-shards/315749)
**Author:** [@MaVa](https://discuss.elastic.co/u/MaVa)\ **Replies:** 5\ **Last updated:** [October 5, 2022, 6:43am UTC](https://discuss.elastic.co/t/automatically-increase-number-of-shards/315749 "2022-10-05T06:43:07Z")
Hi! I have few indices where all the data is equally relevant no matter how old it is. Over time these indices will increase in size (from 5-10MB to 1000GB). I want to optimize the number of shards in these indices, and … --- ## [Snapshot failed for a shard](https://discuss.elastic.co/t/snapshot-failed-for-a-shard/315794)
**Author:** [@DineshNaik](https://discuss.elastic.co/u/DineshNaik)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 6:32am UTC](https://discuss.elastic.co/t/snapshot-failed-for-a-shard/315794 "2022-10-05T06:32:23Z")
Hi all, I am trying to take a one time backup and was planning to restore it to other cluster. During snapshot , i see one failed shard , is there a way to handle this ? { "snapshots" : \[ { "snapshot" : "s… --- ## [Role Mapping via App Role in Azure SSO](https://discuss.elastic.co/t/role-mapping-via-app-role-in-azure-sso/315831)
**Author:** [@Zesty\_Lemon](https://discuss.elastic.co/u/Zesty_Lemon)\ **Replies:** 3\ **Last updated:** [October 5, 2022, 5:35am UTC](https://discuss.elastic.co/t/role-mapping-via-app-role-in-azure-sso/315831 "2022-10-05T05:35:57Z")
Hi, New to Elastic here; seeking information on how to use a App Role on the Enterprise Application for Elastic SSO to assign a user to a particular role mapping; We are using instructions; I can see in the SAML resp… --- ## [Adding a node to cluster](https://discuss.elastic.co/t/adding-a-node-to-cluster/315239)
**Author:** [@rahulgupta18](https://discuss.elastic.co/u/rahulgupta18)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 5:24am UTC](https://discuss.elastic.co/t/adding-a-node-to-cluster/315239 "2022-10-05T05:24:15Z")
Hi , I am looking to add one more node to our existing 2-node ELK cluster running in production. We're running version 8.1. I was looking at the elasticsearch documents, for 8.1, it says just to add the cluster name a… --- ## [Can logstash\_admin built-in role make indices?](https://discuss.elastic.co/t/can-logstash-admin-built-in-role-make-indices/315834)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 4:36am UTC](https://discuss.elastic.co/t/can-logstash-admin-built-in-role-make-indices/315834 "2022-10-05T04:36:38Z")
Hello, i'm planning to add a new user in kibana for logstash operation. I noticed the role logstash\_admin which is alerady built-in. My question is, can the logstash\_admin role make new indices (as configured in logstash… --- ## [Restoring snapshots of observability indexes](https://discuss.elastic.co/t/restoring-snapshots-of-observability-indexes/315813)
**Author:** [@matt.snyder](https://discuss.elastic.co/u/matt.snyder)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 3:46am UTC](https://discuss.elastic.co/t/restoring-snapshots-of-observability-indexes/315813 "2022-10-05T03:46:06Z")
I have a snapshot profile created with defaults, which, for observability indexes, results in one snapshot per index, so I have about 100 snapshots from the same minute, each containing one index. If I want to use these… --- ## [Extract originals timestamp from logs?](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 6\ **Last updated:** [October 5, 2022, 3:06am UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798 "2022-10-05T03:06:35Z")
hello i've see with send log with logstash not respect the originals timestamp this is my generic msg builded with spring-boot 2022-09-25 21:19:57,175 INFO \[it.unidoc.cdr.core.bean.ForwardProvideAndRegisterManager\] (C… --- ## [Timestamp pattern not working for logstash filtering](https://discuss.elastic.co/t/timestamp-pattern-not-working-for-logstash-filtering/315827)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 2:53am UTC](https://discuss.elastic.co/t/timestamp-pattern-not-working-for-logstash-filtering/315827 "2022-10-05T02:53:24Z")
I have 3 lines of logs with different structure and i am constructing a grok pattern to filter the logs. But the pattern I have isn't working. Even when I use just the timestamp pattern, it doesn't match. \[2022-10-04 21… --- ## [Duplicated date in my elastic](https://discuss.elastic.co/t/duplicated-date-in-my-elastic/315506)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 5\ **Last updated:** [October 4, 2022, 10:56pm UTC](https://discuss.elastic.co/t/duplicated-date-in-my-elastic/315506 "2022-10-04T22:56:08Z")
Hello Team, Greeting, I have a situation when the data is being pushing into my elastic twice, a duplicate data. now both of them have different id and other than that everything is same. How do I get over this. My f… --- ## [Hot Nodes + Shards/Node assignment + Routing](https://discuss.elastic.co/t/hot-nodes-shards-node-assignment-routing/315721)
**Author:** [@jc\_es](https://discuss.elastic.co/u/jc_es)\ **Replies:** 6\ **Last updated:** [October 4, 2022, 10:39pm UTC](https://discuss.elastic.co/t/hot-nodes-shards-node-assignment-routing/315721 "2022-10-04T22:39:15Z")
I have a log ingestion use-case and I'm dealing with high JVM heap on 3 out of 24 data nodes in a cluster. Indices are Monthly, with new indices created through the month as indices hit a size threshold, e.g. logs-YYYY-… --- ## [Skipped records with Search/SearchAfter query](https://discuss.elastic.co/t/skipped-records-with-search-searchafter-query/314205)
**Author:** [@kuhu.88](https://discuss.elastic.co/u/kuhu.88)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 9:54pm UTC](https://discuss.elastic.co/t/skipped-records-with-search-searchafter-query/314205 "2022-10-04T21:54:41Z")
Hello folks, Using a non-unique key for sort (in this example - timestamp) can skip over records in a subsequent request when the 10,000 is reached on a previous run and timestamps carry on beyond that cutoff. Take the… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=772) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=774)