# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=778 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 779 --- ## [Advanced Configuration Machine Learning](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 8\ **Last updated:** [September 30, 2022, 7:58am UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446 "2022-09-30T07:58:43Z")
I want to use high count function for a field , for this i select Advanced Confiugration wizard Machine Learning \> Anomaly Detection \> Create Job \> Advanced configuration Here i am using high\_count detector for test… --- ## [Help! How to aggs data by two or more fields, and get the max value of 'count' field?](https://discuss.elastic.co/t/help-how-to-aggs-data-by-two-or-more-fields-and-get-the-max-value-of-count-field/315345)
**Author:** [@Dosia96](https://discuss.elastic.co/u/Dosia96)\ **Replies:** 2\ **Last updated:** [September 30, 2022, 6:52am UTC](https://discuss.elastic.co/t/help-how-to-aggs-data-by-two-or-more-fields-and-get-the-max-value-of-count-field/315345 "2022-09-30T06:52:59Z")
How to aggs data by two or more fields, and get the max value of 'count' field? I have already config the kibana Y-Axis: Metrics sum('count'), X-Axis: Data Histogram @timestamp , interval : sec terms field(a) order b… --- ## [How to Remove old value and replace it with new value in Kibana](https://discuss.elastic.co/t/how-to-remove-old-value-and-replace-it-with-new-value-in-kibana/315522)
**Author:** [@SayliKibana](https://discuss.elastic.co/u/SayliKibana)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 6:29am UTC](https://discuss.elastic.co/t/how-to-remove-old-value-and-replace-it-with-new-value-in-kibana/315522 "2022-09-30T06:29:51Z")
We have an Automation process wherein we process Transaction Input as "ECO Number" and as it get processed ,the output of the ECO Number with Status is displayed on the Kibana Dashboard. According to our process we upda… --- ## [Find average aggregation of the top N buckets](https://discuss.elastic.co/t/find-average-aggregation-of-the-top-n-buckets/315515)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 5:43am UTC](https://discuss.elastic.co/t/find-average-aggregation-of-the-top-n-buckets/315515 "2022-09-30T05:43:39Z")
I'm trying to determine the average value of the "count" column for the top 5 documents ordered by "timestamp" (in descending order). Sample Index data: {"index":{}} {"title": "foo", "count": 1, "timestamp":"2022-09-15… --- ## [I tried to upload a log file and a CSV file through the Kibana UI upload file option. But in both cases getting "File structure cannot be determined" error](https://discuss.elastic.co/t/i-tried-to-upload-a-log-file-and-a-csv-file-through-the-kibana-ui-upload-file-option-but-in-both-cases-getting-file-structure-cannot-be-determined-error/314878)
**Author:** [@cadrija](https://discuss.elastic.co/u/cadrija)\ **Replies:** 11\ **Last updated:** [September 30, 2022, 5:23am UTC](https://discuss.elastic.co/t/i-tried-to-upload-a-log-file-and-a-csv-file-through-the-kibana-ui-upload-file-option-but-in-both-cases-getting-file-structure-cannot-be-determined-error/314878 "2022-09-30T05:23:52Z")
I am new to Elastic. I have setup ELK in Ubuntu machine. I tried to upload a log file and a CSV file through the Kibana UI upload file option. But in both cases getting "File structure cannot be determined" error. I h… --- ## [Elasticsearch \[6.8\] small index query response time in seconds](https://discuss.elastic.co/t/elasticsearch-6-8-small-index-query-response-time-in-seconds/315512)
**Author:** [@srivatsa](https://discuss.elastic.co/u/srivatsa)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 4:34am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-small-index-query-response-time-in-seconds/315512 "2022-09-30T04:34:27Z")
Hi folks, Facing an issue involving a small index of the size 378kb taking around 10s for a read query. We had tried increasing the number of replicas assuming it would help with reads but did not see any noticeable dif… --- ## [Ingest Pipeline threads](https://discuss.elastic.co/t/ingest-pipeline-threads/315182)
**Author:** [@alah64](https://discuss.elastic.co/u/alah64)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:57am UTC](https://discuss.elastic.co/t/ingest-pipeline-threads/315182 "2022-09-30T03:57:38Z")
In logstash, the pipeline.workers setting determines how many threads to run to process the filter and output. Do we have similar settings for elasticsearch ingest pipeline? It seems to work single-threaded and the more… --- ## [Does IndexRequest trigger ingest phase for a document already in the index?](https://discuss.elastic.co/t/does-indexrequest-trigger-ingest-phase-for-a-document-already-in-the-index/315215)
**Author:** [@fifthist](https://discuss.elastic.co/u/fifthist)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:53am UTC](https://discuss.elastic.co/t/does-indexrequest-trigger-ingest-phase-for-a-document-already-in-the-index/315215 "2022-09-30T03:53:02Z")
When using index mode, does IndexRequest trigger the ingest phase for a document already stored in an index? I'd like to use an ingest pipeline on an index, and I want to use the set processor even for documents that al… --- ## [Is this ES config valid & how to address cluster](https://discuss.elastic.co/t/is-this-es-config-valid-how-to-address-cluster/315262)
**Author:** [@Bitdoctor](https://discuss.elastic.co/u/Bitdoctor)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:52am UTC](https://discuss.elastic.co/t/is-this-es-config-valid-how-to-address-cluster/315262 "2022-09-30T03:52:21Z")
Even though there are amazing communities like this, it's still difficult to find good answers on some things. We have 1 x Kibana, 1 x LogStash, 3 x ES Cluster nodes. Is this a valid architecture; or do we have to have 1… --- ## [Banzai Cloud Fluentd filter is not working](https://discuss.elastic.co/t/banzai-cloud-fluentd-filter-is-not-working/315444)
**Author:** [@buulq90](https://discuss.elastic.co/u/buulq90)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:41am UTC](https://discuss.elastic.co/t/banzai-cloud-fluentd-filter-is-not-working/315444 "2022-09-30T03:41:07Z")
Hi all, I'm trying to remove some field on Fluentd by using plugin record\_transformer but it does not works. I'm trying to delete 2 fields: "\_id" & "\_index". Below is my configuration file: apiVersion: logging.banzaic… --- ## [How to force mapper\_parsing\_exception? from ElasticSearch to prevent accepting different types for a specific field](https://discuss.elastic.co/t/how-to-force-mapper-parsing-exception-from-elasticsearch-to-prevent-accepting-different-types-for-a-specific-field/315485)
**Author:** [@Saeedeh\_Moghimi](https://discuss.elastic.co/u/Saeedeh_Moghimi)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:38am UTC](https://discuss.elastic.co/t/how-to-force-mapper-parsing-exception-from-elasticsearch-to-prevent-accepting-different-types-for-a-specific-field/315485 "2022-09-30T03:38:52Z")
I have a production index with a date type field, which causes the error of Field \[tagSet.items.value\] of type \[text\] does not support custom formats in Kibana. I've created another index for test and whenever I want t… --- ## [JSON Plugin - Ignore Field](https://discuss.elastic.co/t/json-plugin-ignore-field/315510)
**Author:** [@QuestBevan](https://discuss.elastic.co/u/QuestBevan)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:37am UTC](https://discuss.elastic.co/t/json-plugin-ignore-field/315510 "2022-09-30T03:37:20Z")
Hi All, Need some advise. I am currently using filebeat, to send logs to Elasticsearch via Logstash. Filebeat -\> Logstash -\> Elasticsearch Log files are in JSON, and these JSON documents are being expanded as expecte… --- ## [New Elasticsearch client - Search response cannot be serialized because of null value on sort fields](https://discuss.elastic.co/t/new-elasticsearch-client-search-response-cannot-be-serialized-because-of-null-value-on-sort-fields/315326)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 9\ **Last updated:** [September 30, 2022, 1:31am UTC](https://discuss.elastic.co/t/new-elasticsearch-client-search-response-cannot-be-serialized-because-of-null-value-on-sort-fields/315326 "2022-09-30T01:31:28Z")
I am migrating elasticsearch from old to new elasticsearch java client. I encounter this problem wherein I issue a request query, then the response has null values. The code below is how I request: SearchRequest r… --- ## [Seperate fleet management cluster - integrations, management,](https://discuss.elastic.co/t/seperate-fleet-management-cluster-integrations-management/315507)
**Author:** [@vbohata](https://discuss.elastic.co/u/vbohata)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 12:41am UTC](https://discuss.elastic.co/t/seperate-fleet-management-cluster-integrations-management/315507 "2022-09-30T00:41:10Z")
I checked the documentation and using the logstash outputs it is not possible to use separate fleet managed agents with logstash output to different clusters. But what about the integrations? Lets imagine for big deplo… --- ## [Filebeat not ingesting json based log files to elastic search](https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482)
**Author:** [@paarbour](https://discuss.elastic.co/u/paarbour)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 10:34pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482 "2022-09-29T22:34:08Z")
I have Elasticsearch and Kibana working, that was the easy part. I can ingest files directly from Kibana, no problems they get parsed and handled without issue. I am now trying to configure filebeat to pull in files fr… --- ## [Min\_score doesnt apply to aggregates](https://discuss.elastic.co/t/min-score-doesnt-apply-to-aggregates/315503)
**Author:** [@reisner](https://discuss.elastic.co/u/reisner)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 9:37pm UTC](https://discuss.elastic.co/t/min-score-doesnt-apply-to-aggregates/315503 "2022-09-29T21:37:06Z")
Hi there, I'm seeing some weird behaviour trying to fix an issue with a query. I was originally running this query: GET /coe\_td\_council\_report\_files\_test/\_search { "size": 0, "min\_score": 2.9, "query": { "b… --- ## [Combine normal and nested fields with query\_string](https://discuss.elastic.co/t/combine-normal-and-nested-fields-with-query-string/315502)
**Author:** [@Antonio\_Antovski](https://discuss.elastic.co/u/Antonio_Antovski)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 8:54pm UTC](https://discuss.elastic.co/t/combine-normal-and-nested-fields-with-query-string/315502 "2022-09-29T20:54:18Z")
I have a document which contains both normal and nested fields. I'm trying to find all the documents that contain all the words from a regex query in any of the fields of interest. Since I'm using a regex query and tryin… --- ## [Kibana is not coming up](https://discuss.elastic.co/t/kibana-is-not-coming-up/315263)
**Author:** [@DineshGarimella](https://discuss.elastic.co/u/DineshGarimella)\ **Replies:** 9\ **Last updated:** [September 29, 2022, 8:28pm UTC](https://discuss.elastic.co/t/kibana-is-not-coming-up/315263 "2022-09-29T20:28:57Z")
{"type":"log","@timestamp":"2022-09-27T11:07:06Z","tags":\["status","plugin:kibana@6.4.0","info"\],"pid":153778,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","pr… --- ## [My Elasticsearch wont start after java update](https://discuss.elastic.co/t/my-elasticsearch-wont-start-after-java-update/315454)
**Author:** [@Joe\_Li](https://discuss.elastic.co/u/Joe_Li)\ **Replies:** 4\ **Last updated:** [September 29, 2022, 6:13pm UTC](https://discuss.elastic.co/t/my-elasticsearch-wont-start-after-java-update/315454 "2022-09-29T18:13:28Z")
getting the below error and not sure where to start... can anyone assist? \[root@bh3elklpv01 jli\]# sudo systemctl status elasticsearch.service ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/sy… --- ## [\[logstash.filters.xml Error parsing xml with XmlSimple {:source=\>"message" , :exception=\>#\ **Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 2:48pm UTC](https://discuss.elastic.co/t/logstash-filters-xml-error-parsing-xml-with-xmlsimple-source-message-exception-rexml-no-close-tag-for-log4j-event-log4j-message-and-truncated/315472 "2022-09-29T14:48:19Z") This log is giving me problems: Note: my log is much longer but you exceed the character limit that allows me to upload here. Just delete things from the log that are repeated as messages. The message exceeds 1000 lines… --- ## [Hide Exit Full Screen button](https://discuss.elastic.co/t/hide-exit-full-screen-button/315435)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 3:16pm UTC](https://discuss.elastic.co/t/hide-exit-full-screen-button/315435 "2022-09-29T15:16:48Z")
Hello! I want to put a dashboard on a room screen in fullscreen. i got this with: &\_a=(fullScreenMode:!t) But the exit button remains, I would like to know if this can be hidden somehow. Thanks in advance! --- ## [Filtered Log messages show up as empty fields in Kibana](https://discuss.elastic.co/t/filtered-log-messages-show-up-as-empty-fields-in-kibana/315400)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 7\ **Last updated:** [September 29, 2022, 5:01pm UTC](https://discuss.elastic.co/t/filtered-log-messages-show-up-as-empty-fields-in-kibana/315400 "2022-09-29T17:01:49Z")
I have filtered my log message using grok. But when I check Kibana, I find the new fields on the left side of the page, but they are empty. I am also getting the \_grokparsefailure tag. Here's an example of my log messag… --- ## [Cannot add more than 10 columns in kibana table](https://discuss.elastic.co/t/cannot-add-more-than-10-columns-in-kibana-table/315442)
**Author:** [@Pierre\_Abi\_Chedid](https://discuss.elastic.co/u/Pierre_Abi_Chedid)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 3:04pm UTC](https://discuss.elastic.co/t/cannot-add-more-than-10-columns-in-kibana-table/315442 "2022-09-29T15:04:27Z")
Hello, I seem to have a problem when trying to add more than 10 columns in my kibana visualization I get the following error: Any idea on how to resolve the problem? --- ## [Document count by index name](https://discuss.elastic.co/t/document-count-by-index-name/315477)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 4:57pm UTC](https://discuss.elastic.co/t/document-count-by-index-name/315477 "2022-09-29T16:57:49Z")
Hello! Im trying to get the document count by index but I have only been able to get a total count or the count per index of a few. attempts: GET \*/\_search { "size": 0, "aggs": { "indices": { "terms": { … --- ## [Logstash logs](https://discuss.elastic.co/t/logstash-logs/314911)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 2\ **Last updated:** [September 29, 2022, 4:39pm UTC](https://discuss.elastic.co/t/logstash-logs/314911 "2022-09-29T16:39:23Z")
Hi, I have installed logstash 7.16.3 with default settings in logstash.yml and log4j2.properties. My understanding is that with this configuration each log type, for example, logstash-plain.log should not be able to ex… --- ## [Save a variable for use in processors or how to drop later events in a series?](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 3\ **Last updated:** [September 29, 2022, 4:30pm UTC](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406 "2022-09-29T16:30:17Z")
Is it possible to save state in a variable for use in a processor? I'd like to do something like: - save\_variable: name: id value: winlog.event\_data.ScriptBlockId when: regexp: winl… --- ## [How to view docs.deleted data](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459)
**Author:** [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\ **Replies:** 2\ **Last updated:** [September 29, 2022, 2:29pm UTC](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459 "2022-09-29T14:29:41Z")
Hi All, In my elastic cluster, I see there are some records in docs.deleted for some of the indices, and I am not sure how to find out who deleted the docs? My 3 node elastic cluster version is 7.16.1 and it is Not an … --- ## [How to set Max\_analyzed\_offset setting for all searches in Discover](https://discuss.elastic.co/t/how-to-set-max-analyzed-offset-setting-for-all-searches-in-discover/315466)
**Author:** [@Quentin\_vk](https://discuss.elastic.co/u/Quentin_vk)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 2:14pm UTC](https://discuss.elastic.co/t/how-to-set-max-analyzed-offset-setting-for-all-searches-in-discover/315466 "2022-09-29T14:14:51Z")
Hi, we're having this very well known error "the length of field\[...\] index has exceed maximum allowed to be analyzed for highlighting". We're trying to use the max\_analyzed\_offset setting as a global search setting in … --- ## [I have a problem elasticsearch](https://discuss.elastic.co/t/i-have-a-problem-elasticsearch/315366)
**Author:** [@Marcelo\_F\_Costa](https://discuss.elastic.co/u/Marcelo_F_Costa)\ **Replies:** 2\ **Last updated:** [September 29, 2022, 2:03pm UTC](https://discuss.elastic.co/t/i-have-a-problem-elasticsearch/315366 "2022-09-29T14:03:04Z")
I have this problem and I have no idea what it is. Can someone help me? Follow the log. \[2022-09-28T02:21:14,224\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[VM-Elasticsearch\] \[gc\]\[young\]\[365947\]\[70063\] duration \[1.5s\], coll… --- ## [Is java API Client 7.16 be used with Elasticsearch version 7.9.2?](https://discuss.elastic.co/t/is-java-api-client-7-16-be-used-with-elasticsearch-version-7-9-2/315465)
**Author:** [@Karthik\_Amar](https://discuss.elastic.co/u/Karthik_Amar)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 1:57pm UTC](https://discuss.elastic.co/t/is-java-api-client-7-16-be-used-with-elasticsearch-version-7-9-2/315465 "2022-09-29T13:57:26Z")
Hi all. Sorry if this very obvious question. As per documentation The Elasticsearch Java client is forward compatible; meaning that the client supports communicating with greater or equal minor versions of Elasticsearc… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=777) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=779)