# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=776 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 777 --- ## [Custom visualizations with Vega, Source Control, and Upper Environments](https://discuss.elastic.co/t/custom-visualizations-with-vega-source-control-and-upper-environments/315505)
**Author:** [@qd-danh](https://discuss.elastic.co/u/qd-danh)\ **Replies:** 2\ **Last updated:** [October 3, 2022, 4:02pm UTC](https://discuss.elastic.co/t/custom-visualizations-with-vega-source-control-and-upper-environments/315505 "2022-10-03T16:02:11Z")
I have been searching these forums and the web for guidance and haven't found much. We plan to use at least one, likely more, custom visualizations via Vega in our Kibana dashboards. When thinking through productionali… --- ## [Parent/Child vs Nested. The real Performance difference](https://discuss.elastic.co/t/parent-child-vs-nested-the-real-performance-difference/315698)
**Author:** [@amirm](https://discuss.elastic.co/u/amirm)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 3:11pm UTC](https://discuss.elastic.co/t/parent-child-vs-nested-the-real-performance-difference/315698 "2022-10-03T15:11:01Z")
Greeting. We all know that Elasticsearch is basically a NoSQL database. it means there is no relation between data and documents that need to be denormalized and flattened to index properly. In spite of all these thing… --- ## [Question regarding index stats - warmer](https://discuss.elastic.co/t/question-regarding-index-stats-warmer/315696)
**Author:** [@robbe482](https://discuss.elastic.co/u/robbe482)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 3:03pm UTC](https://discuss.elastic.co/t/question-regarding-index-stats-warmer/315696 "2022-10-03T15:03:20Z")
Hello, we are running Elasticsearch 6.8.23. For one of our indices we are having performance problems. When checking the stats on that index one thing stands out, very high total\_time under the warmer section. Reading … --- ## [LDAP doubt](https://discuss.elastic.co/t/ldap-doubt/315671)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 1:23pm UTC](https://discuss.elastic.co/t/ldap-doubt/315671 "2022-10-03T13:23:51Z")
Hello! im integrating elk with ldap. when i enable ldap at config im not able to login kibana with my old users. Can't be both enable ? im going to be able to log in only with ldap users ? --- ## [Example of a 3 node production ready docker-compose for Elasticsearch?](https://discuss.elastic.co/t/example-of-a-3-node-production-ready-docker-compose-for-elasticsearch/315647)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 2\ **Last updated:** [October 3, 2022, 4:26am UTC](https://discuss.elastic.co/t/example-of-a-3-node-production-ready-docker-compose-for-elasticsearch/315647 "2022-10-03T04:26:56Z")
Hello, I was wondering if anyone had or can point to an example of a multi-node production ready docker-compose yaml file for Elasticsearch. I've started with the docker-compose example from the elastic documentation … --- ## [How to suggest queries to user](https://discuss.elastic.co/t/how-to-suggest-queries-to-user/315685)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 12:27pm UTC](https://discuss.elastic.co/t/how-to-suggest-queries-to-user/315685 "2022-10-03T12:27:16Z")
Hi, is there a way to suggest queries to the user based on terms? This feature is common in searches to suggest other queries to the user. I saw that there is appsearch, is that the only way to make it work? --- ## [Runtime field script String to Integer](https://discuss.elastic.co/t/runtime-field-script-string-to-integer/315678)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 12:21pm UTC](https://discuss.elastic.co/t/runtime-field-script-string-to-integer/315678 "2022-10-03T12:21:15Z")
Hi. I want to create a runtime field using this script: if (doc.containsKey('price') ) { return Integer.parseInt(doc\['price.keyword'\].value) } but I'm getting this error: Cannot cast from \[int\] to \[void\]. What does i… --- ## [Struggling with sonicwall module](https://discuss.elastic.co/t/struggling-with-sonicwall-module/315595)
**Author:** [@Philip\_Thomson1](https://discuss.elastic.co/u/Philip_Thomson1)\ **Replies:** 3\ **Last updated:** [October 3, 2022, 11:32am UTC](https://discuss.elastic.co/t/struggling-with-sonicwall-module/315595 "2022-10-03T11:32:07Z")
I am sure this is something silly, but I have been banging my head on this, I am trying to use the sonicwall module on filebeat 8.4 This is the sonicwall.yml: # Module: sonicwall # Docs: https://www.elastic.co/guide/en… --- ## [Prevent logs data loss using Cloudflare integration powered by Elastic Agent](https://discuss.elastic.co/t/prevent-logs-data-loss-using-cloudflare-integration-powered-by-elastic-agent/313562)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 7\ **Last updated:** [October 3, 2022, 10:58am UTC](https://discuss.elastic.co/t/prevent-logs-data-loss-using-cloudflare-integration-powered-by-elastic-agent/313562 "2022-10-03T10:58:52Z")
Using the CludFlare integration, in case of Elastic failure, will the logs that have been sent to elastic be lost? Or there will be queues (or something similar) from which Elastic will restart once it is reset. Or alt… --- ## [Kibana rollup / aggregation not working](https://discuss.elastic.co/t/kibana-rollup-aggregation-not-working/315663)
**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 9:31am UTC](https://discuss.elastic.co/t/kibana-rollup-aggregation-not-working/315663 "2022-10-03T09:31:46Z")
Hi, does anyone use Rollup? When you are using AVG metric, is it working for you? On my side it is not as originally described in this post by me. Insted of AVG values i am getting MAX. I can't belive the problem is … --- ## [Need to add Anomaly Score as Label in Swimlane view of Anomaly Detection Job when added in Dashboard](https://discuss.elastic.co/t/need-to-add-anomaly-score-as-label-in-swimlane-view-of-anomaly-detection-job-when-added-in-dashboard/315542)
**Author:** [@Sreeja\_Bose](https://discuss.elastic.co/u/Sreeja_Bose)\ **Replies:** 3\ **Last updated:** [October 3, 2022, 9:27am UTC](https://discuss.elastic.co/t/need-to-add-anomaly-score-as-label-in-swimlane-view-of-anomaly-detection-job-when-added-in-dashboard/315542 "2022-10-03T09:27:17Z")
Hi Team, I have created a multi metric anomaly detection job and added the swimlane view of anomaly detection in a dashboard. Can I to add the anomaly score as label in the swimlane view in the dashboard? ELK version … --- ## [Elasticsearch Restore Problem](https://discuss.elastic.co/t/elasticsearch-restore-problem/315669)
**Author:** [@rkazak07](https://discuss.elastic.co/u/rkazak07)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 9:17am UTC](https://discuss.elastic.co/t/elasticsearch-restore-problem/315669 "2022-10-03T09:17:46Z")
Hello, I have a Cluster running in Elasticsearch 7.10.2 version. I have added a new server to this Cluster. I use it with Graylog. I get the following Log while restoring the index without a replica. and it falls into t… --- ## [How to read logs contineously from azure evnet hub](https://discuss.elastic.co/t/how-to-read-logs-contineously-from-azure-evnet-hub/315660)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 7:27am UTC](https://discuss.elastic.co/t/how-to-read-logs-contineously-from-azure-evnet-hub/315660 "2022-10-03T07:27:40Z")
Hie Everyone, I have an integration where I have to read logs that are generated/store in azure event hub. Will the below configuration will read logs as an when new log is generated in the hub ? If now what I'm loo… --- ## [Filebeat sends encrypted logs from snort to elastic](https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625)
**Author:** [@mahmoudmaani](https://discuss.elastic.co/u/mahmoudmaani)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 7:21am UTC](https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625 "2022-10-03T07:21:05Z")
Hello, Snort logs on Kibana are encrypted as you can see below. Even when I try to run cat /var/log/snort/snort.log.166425312 on snort itself I will get the same output. The only way to show the output is by running… --- ## [Storing personal and inventory data in ES or DB for custom plugin](https://discuss.elastic.co/t/storing-personal-and-inventory-data-in-es-or-db-for-custom-plugin/315656)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 6:24am UTC](https://discuss.elastic.co/t/storing-personal-and-inventory-data-in-es-or-db-for-custom-plugin/315656 "2022-10-03T06:24:18Z")
Hi, I am developing my own external custom plugin in React. My logging data for monitoring and all is stored is ES only, as expected. But I'm confused about where to store my personal information of customers and their… --- ## [Elastic cluster issue!](https://discuss.elastic.co/t/elastic-cluster-issue/314953)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 19\ **Last updated:** [October 2, 2022, 5:38pm UTC](https://discuss.elastic.co/t/elastic-cluster-issue/314953 "2022-10-02T17:38:41Z")
We are seeing CPU spikes for our Elastic cluster and in logs we see this error continuously. We also get a circuit breaker exception in kibana when CPU spikes up. What could be wrong with our cluster \[2022-09-22T13:40:3… --- ## [Kibana metric plot with dynamic text based on the data](https://discuss.elastic.co/t/kibana-metric-plot-with-dynamic-text-based-on-the-data/313565)
**Author:** [@eleven\_e](https://discuss.elastic.co/u/eleven_e)\ **Replies:** 13\ **Last updated:** [October 3, 2022, 5:48am UTC](https://discuss.elastic.co/t/kibana-metric-plot-with-dynamic-text-based-on-the-data/313565 "2022-10-03T05:48:21Z")
In the kibana dashboard visualization I need an metric plot to show the dynamic text based on the data. With the previous month gain. --- ## [\_delete\_by\_query documentation suggestion](https://discuss.elastic.co/t/delete-by-query-documentation-suggestion/315642)
**Author:** [@MarcBT](https://discuss.elastic.co/u/MarcBT)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 5:40am UTC](https://discuss.elastic.co/t/delete-by-query-documentation-suggestion/315642 "2022-10-03T05:40:48Z")
IMO, the \_delete\_by\_query page should mention that if an index is moved out of 'hot' phase by ILM, the delete will fail with "FORBIDDEN/8/index write (api)". --- ## [Custom Similarity for Percolate Query](https://discuss.elastic.co/t/custom-similarity-for-percolate-query/315654)
**Author:** [@aneeshkoya](https://discuss.elastic.co/u/aneeshkoya)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 5:37am UTC](https://discuss.elastic.co/t/custom-similarity-for-percolate-query/315654 "2022-10-03T05:37:12Z")
I created a percolation index with a custom similarity in its settings and a mapping to use this custom similarity: { "my-index": { "settings": { "index": { "similarity": { "idfless": { … --- ## [Manually configure security, divergence in the documentation](https://discuss.elastic.co/t/manually-configure-security-divergence-in-the-documentation/315601)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 2:38am UTC](https://discuss.elastic.co/t/manually-configure-security-divergence-in-the-documentation/315601 "2022-10-03T02:38:35Z")
Hello, I'm creating a new cluster using 8.4 and configuring the security features manually. I've created the certificates for the transport and http protocol and everything works as expected, the cluster starts up and … --- ## [Saved Objects / API](https://discuss.elastic.co/t/saved-objects-api/315639)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [October 2, 2022, 11:32pm UTC](https://discuss.elastic.co/t/saved-objects-api/315639 "2022-10-02T23:32:37Z")
Hi, is this possible to perform Kibana " Saved Objects" (export all objects) via curl etc? It whould be great for backup purposes. --- ## [What's the cause of this problem and what's the solution?](https://discuss.elastic.co/t/whats-the-cause-of-this-problem-and-whats-the-solution/315641)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 0\ **Last updated:** [October 2, 2022, 8:59pm UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-problem-and-whats-the-solution/315641 "2022-10-02T20:59:57Z")
i installed elastic and kibana 8.4.1 in ubuntu 22.04 and when i try to do sudo apt update or sudo apt install unzip i get this error E: Conflicting values set for option Signed-By regarding source https://artif… --- ## [Problems with installing/starting current Elasticsearch on ubuntu](https://discuss.elastic.co/t/problems-with-installing-starting-current-elasticsearch-on-ubuntu/315632)
**Author:** [@besucher80](https://discuss.elastic.co/u/besucher80)\ **Replies:** 3\ **Last updated:** [October 2, 2022, 3:22pm UTC](https://discuss.elastic.co/t/problems-with-installing-starting-current-elasticsearch-on-ubuntu/315632 "2022-10-02T15:22:10Z")
hi, i have installed elasticsearch like here: https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html Now i want to start it with: sudo systemctl start elasticsearch.service But this always fail. In t… --- ## [How match indexof in query?](https://discuss.elastic.co/t/how-match-indexof-in-query/315615)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [October 2, 2022, 12:20pm UTC](https://discuss.elastic.co/t/how-match-indexof-in-query/315615 "2022-10-02T12:20:30Z")
i've used this GET /myindex/\_search { "query": { "match\_phrase\_prefix": { "message": "my text\*" } } } but not have results i' ve always #! Elasticsearch built-in security features are not enabled. … --- ## [Pushing data through python to elastic search](https://discuss.elastic.co/t/pushing-data-through-python-to-elastic-search/315489)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 6\ **Last updated:** [October 2, 2022, 3:06am UTC](https://discuss.elastic.co/t/pushing-data-through-python-to-elastic-search/315489 "2022-10-02T03:06:33Z")
I'm trying to push some data that I've collected through Python into Elasticsearch but it's showing this error:- "ValueError: Can't specify the options 'http\_auth' via a dictionary in 'hosts', only 'host', 'path\_prefix',… --- ## [How to connect Google Colab to Elasticsearch](https://discuss.elastic.co/t/how-to-connect-google-colab-to-elasticsearch/315618)
**Author:** [@shivang.ahd](https://discuss.elastic.co/u/shivang.ahd)\ **Replies:** 2\ **Last updated:** [October 1, 2022, 6:21pm UTC](https://discuss.elastic.co/t/how-to-connect-google-colab-to-elasticsearch/315618 "2022-10-01T18:21:29Z")
Hi, How to connect Google Colab to Elasticsearch. I have followed few ways, but getting error for all the ways. One of the code is as below:- !pip install Elasticsearch -q # download elasticsearch !wget https://arti… --- ## [Filebeat cannot communicate with Kibana](https://discuss.elastic.co/t/filebeat-cannot-communicate-with-kibana/315508)
**Author:** [@mahmoudmaani](https://discuss.elastic.co/u/mahmoudmaani)\ **Replies:** 8\ **Last updated:** [October 1, 2022, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-cannot-communicate-with-kibana/315508 "2022-10-01T16:41:25Z")
Hello everyone, Filebeat is not working with my setup when I try to run ./filebeat setup -e I get the below error message. I have Elastic and Kibana installed on a single host and they are working well also, I have… --- ## [Adding Site Alternate Name (SAN) to the docker run command](https://discuss.elastic.co/t/adding-site-alternate-name-san-to-the-docker-run-command/315497)
**Author:** [@Mark\_Parrish](https://discuss.elastic.co/u/Mark_Parrish)\ **Replies:** 1\ **Last updated:** [October 1, 2022, 3:36pm UTC](https://discuss.elastic.co/t/adding-site-alternate-name-san-to-the-docker-run-command/315497 "2022-10-01T15:36:35Z")
I used the following command to bring up a elasticsearch node. It is straight out of the instructions (link). docker run -d / --name es01 / --net elastic / -p 9200:9200 -p 9300:9300 / -it / docker.elast… --- ## [Can Replica shards be used for Disaster Recovery](https://discuss.elastic.co/t/can-replica-shards-be-used-for-disaster-recovery/315620)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 1\ **Last updated:** [October 1, 2022, 3:14pm UTC](https://discuss.elastic.co/t/can-replica-shards-be-used-for-disaster-recovery/315620 "2022-10-01T15:14:48Z")
Hi, We don't have backup in our cluster. Can we you replicas for disaster recovery purpose..? Elasticsearch version: 8.12 Thank you...! --- ## [Additional java process in ES8.4](https://discuss.elastic.co/t/additional-java-process-in-es8-4/315619)
**Author:** [@frankshad](https://discuss.elastic.co/u/frankshad)\ **Replies:** 0\ **Last updated:** [October 1, 2022, 2:25pm UTC](https://discuss.elastic.co/t/additional-java-process-in-es8-4/315619 "2022-10-01T14:25:41Z")
I'm trying a fresh install of ES8.4 on Debian 11, starting using systemctl start elasticsearch. I notice that there are now two Java processes permanently running, where on all previous versions I have used (up to 8.2) t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=775) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=777)