# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=783 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 784 --- ## [Using a must\_not filter on 'drone' returns a document containing 'drone'](https://discuss.elastic.co/t/using-a-must-not-filter-on-drone-returns-a-document-containing-drone/315150)
**Author:** [@cracanut](https://discuss.elastic.co/u/cracanut)\ **Replies:** 6\ **Last updated:** [September 26, 2022, 3:03pm UTC](https://discuss.elastic.co/t/using-a-must-not-filter-on-drone-returns-a-document-containing-drone/315150 "2022-09-26T15:03:26Z")
Using a must\_not filter on 'drone' returns a document containing 'drone': Cluster analyzer settings: "analysis": { "filter": { "english\_stemmer": { "type": "stemmer", "language": "engl… --- ## [Maintain confidentiality of agents and user in kibana](https://discuss.elastic.co/t/maintain-confidentiality-of-agents-and-user-in-kibana/315143)
**Author:** [@yahire](https://discuss.elastic.co/u/yahire)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 2:02pm UTC](https://discuss.elastic.co/t/maintain-confidentiality-of-agents-and-user-in-kibana/315143 "2022-09-26T14:02:25Z")
Hi team, Please have a look at below screenshots. I wanted to implement Elasticsearch in such a way that we can have seperate users for seperate projects so that one user can not see the agent and traces of another … --- ## [Elastic reindex documents with new fields](https://discuss.elastic.co/t/elastic-reindex-documents-with-new-fields/315177)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 2:00pm UTC](https://discuss.elastic.co/t/elastic-reindex-documents-with-new-fields/315177 "2022-09-26T14:00:57Z")
Hi - What's the best way to update an existing index with new field added to it? For eg: Current index has fields, firstName,lastName,streetNo,City,Zipcode. I would like to add one more field called FullAddress - which… --- ## [Data table with time shift](https://discuss.elastic.co/t/data-table-with-time-shift/315172)
**Author:** [@Samuele\_Mosci](https://discuss.elastic.co/u/Samuele_Mosci)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 1:53pm UTC](https://discuss.elastic.co/t/data-table-with-time-shift/315172 "2022-09-26T13:53:52Z")
Hi, I'm using Kibana 8.4. I am trying to make a visualization (in particular a data table) where I can view documents that I do not have in a timestamp but which are present in the timestamp of the previous day. I tried … --- ## [\[Kibana 7.17.1\] Index patterns disappear after restoring VM snaphots of ES cluster machines](https://discuss.elastic.co/t/kibana-7-17-1-index-patterns-disappear-after-restoring-vm-snaphots-of-es-cluster-machines/313457)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 1:52pm UTC](https://discuss.elastic.co/t/kibana-7-17-1-index-patterns-disappear-after-restoring-vm-snaphots-of-es-cluster-machines/313457 "2022-09-26T13:52:19Z")
We're running an ES test cluster of 3 machines with the following nodes: master, coordinating only, data master, coordinating only, data master, ingest, data We have three index types in this cluster: shop-\ **Author:** [@gadelkareem](https://discuss.elastic.co/u/gadelkareem)\ **Replies:** 4\ **Last updated:** [September 26, 2022, 1:52pm UTC](https://discuss.elastic.co/t/terms-query-by-index-in-dashboards/313717 "2022-09-26T13:52:00Z") I am currently using Terms Query by index to filter a query: { "query": { "bool": { "must": \[ { "terms": { "test.type.name": { … --- ## [Ordering results based on derivate aggregation](https://discuss.elastic.co/t/ordering-results-based-on-derivate-aggregation/313954)
**Author:** [@Toni\_Heinonen](https://discuss.elastic.co/u/Toni_Heinonen)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 1:32pm UTC](https://discuss.elastic.co/t/ordering-results-based-on-derivate-aggregation/313954 "2022-09-26T13:32:39Z")
I'm working with a audit trail data and trying to make a graph (or even a table) that would list users that have a greatest drop on usage since last month. So far I have tried the following. TSVB: I can get a percenta… --- ## [Creating a line chart in kibana without aggregation](https://discuss.elastic.co/t/creating-a-line-chart-in-kibana-without-aggregation/314383)
**Author:** [@Manasa\_reddy09](https://discuss.elastic.co/u/Manasa_reddy09)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 12:48pm UTC](https://discuss.elastic.co/t/creating-a-line-chart-in-kibana-without-aggregation/314383 "2022-09-26T12:48:09Z")
Hello Folks, I am new to Kibana, although i have worked with other visualization tools before. Kibana is new to me. I know that Kibana is based on Buckets and we need an aggregation to create charts in Kibana.. But when… --- ## [General guidance on data replication - Google Cloud](https://discuss.elastic.co/t/general-guidance-on-data-replication-google-cloud/315161)
**Author:** [@Lucien\_Perouze](https://discuss.elastic.co/u/Lucien_Perouze)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 10:09am UTC](https://discuss.elastic.co/t/general-guidance-on-data-replication-google-cloud/315161 "2022-09-26T10:09:34Z")
I'm building a search engine for my app. For that i'm trying Elasticsearch for the first time. My app uses a Postgre SQL. As I understood I need to replicate datas from my Postgre to Elastic Search in order to perform RE… --- ## [Elasticsearch does not start](https://discuss.elastic.co/t/elasticsearch-does-not-start/315156)
**Author:** [@KermitSZ](https://discuss.elastic.co/u/KermitSZ)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start/315156 "2022-09-26T10:07:22Z")
Hello community, We installed elasticsearch following this tutorial Install Elasticsearch with Debian Package | Elasticsearch Guide \[6.8\] | Elastic but the service crashes immediately after running the start command. T… --- ## [Basic license expires today?](https://discuss.elastic.co/t/basic-license-expires-today/315148)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 10:04am UTC](https://discuss.elastic.co/t/basic-license-expires-today/315148 "2022-09-26T10:04:20Z")
Hi, I am running the latest 8.4.2 stack. stack monitoring (/app/monitoring#/home) reports that my basic license expires today. If I go to /app/monitoring#/license?\_g=(cluster\_uuid:xxxxxx) it says: Your Basic license … --- ## [Dashboards based on a subquery](https://discuss.elastic.co/t/dashboards-based-on-a-subquery/315153)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 9:40am UTC](https://discuss.elastic.co/t/dashboards-based-on-a-subquery/315153 "2022-09-26T09:40:06Z")
Hello, I would like to aggregate data into a pie chart based on the newest data for a specific type id. In other words something like category | type\_id | @timestamp category1 | abcd | 2022-08-26 category1 | abcd |… --- ## [Kibana is now available (was degraded), No ML saved objects in need of synchronization](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded-no-ml-saved-objects-in-need-of-synchronization/315121)
**Author:** [@Tushar\_Singh1](https://discuss.elastic.co/u/Tushar_Singh1)\ **Replies:** 5\ **Last updated:** [September 26, 2022, 9:26am UTC](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded-no-ml-saved-objects-in-need-of-synchronization/315121 "2022-09-26T09:26:53Z")
I am not able to open kibana GUI , It is continuously throwing error as \[2022-09-25T22:39:48.677+00:00\]\[INFO \]\[plugins.monitoring.monitoring\] config sourced from: production cluster \[2022-09-25T22:39:50.434+00:00\]\[INF… --- ## [Oauth and token master](https://discuss.elastic.co/t/oauth-and-token-master/315146)
**Author:** [@yasin\_mohammed](https://discuss.elastic.co/u/yasin_mohammed)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 9:12am UTC](https://discuss.elastic.co/t/oauth-and-token-master/315146 "2022-09-26T09:12:50Z")
Hi... We are using elastic stack basic license to begin with till we are able to prove the value of this software. for now we have enabled basic licensing and using local users and password. With the basic version can w… --- ## [Multiple Kibana on multiple cluster with same data](https://discuss.elastic.co/t/multiple-kibana-on-multiple-cluster-with-same-data/313550)
**Author:** [@baneinc](https://discuss.elastic.co/u/baneinc)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 9:10am UTC](https://discuss.elastic.co/t/multiple-kibana-on-multiple-cluster-with-same-data/313550 "2022-09-26T09:10:19Z")
Hi forum, I have multiple (two) elasticsearch clusters, with kafka in front, so both clusters have identical data. How to setup HA kibana (two kibana, one on eachcluster) with loadbalancer in front, so all kibana setti… --- ## [Logstash Pipeline details result in HTTP response code 404](https://discuss.elastic.co/t/logstash-pipeline-details-result-in-http-response-code-404/315151)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 9:09am UTC](https://discuss.elastic.co/t/logstash-pipeline-details-result-in-http-response-code-404/315151 "2022-09-26T09:09:29Z")
Hi, I am running the latest 8.4.2 Elastic stack. If I go to stack monitoring (/app/monitoring#/logstash/pipelines?\_g=(cluster\_uuid:xxxxxx), I get an overview of my pipelines. If I click on the only pipeline that is li… --- ## [Field \[gcp.audit.response.status.conditions.lastHeartbeatTime\] of type \[flattened\] doesn't support formats](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028)
**Author:** [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 9:08am UTC](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028 "2022-09-26T09:08:46Z")
So, I have enabled GCP Audit logs collection using the GCP integration from Elastic Agent 8.3.3. I've had no problems so far running searches in this dataset, but as of today the next error keeps appearing, and now I ca… --- ## [Auditbeat monitor pod audit events](https://discuss.elastic.co/t/auditbeat-monitor-pod-audit-events/315147)
**Author:** [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 8:58am UTC](https://discuss.elastic.co/t/auditbeat-monitor-pod-audit-events/315147 "2022-09-26T08:58:50Z")
hell team, we are using auditbeat run as pod on our k8s work node to monitor the releated audit events happen in node level which is running good, however, is that any possible to monitor audit events which happen in… --- ## [Where do I find Custom Filestream Log integration?](https://discuss.elastic.co/t/where-do-i-find-custom-filestream-log-integration/315142)
**Author:** [@Geoff\_Rob](https://discuss.elastic.co/u/Geoff_Rob)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 8:18am UTC](https://discuss.elastic.co/t/where-do-i-find-custom-filestream-log-integration/315142 "2022-09-26T08:18:23Z")
Hi, I'm trying to find out where to get " Custom Filestream Log integration" ? I see it in the Github repo, in the main branch, merged in several month ago: integrations/packages/filestream at main · elastic/integratio… --- ## [Incremental snapshot after document update and segment](https://discuss.elastic.co/t/incremental-snapshot-after-document-update-and-segment/315139)
**Author:** [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 7:56am UTC](https://discuss.elastic.co/t/incremental-snapshot-after-document-update-and-segment/315139 "2022-09-26T07:56:29Z")
Hello, On a rather large architecture (about 32Tb of data x2 for the replica), we regularly update documents (need in terms of search engine so no regular ingestion, but rather updates of documents once a week). We mak… --- ## [Alphabetic to Basic Latin Unicode](https://discuss.elastic.co/t/alphabetic-to-basic-latin-unicode/315112)
**Author:** [@smkarnan](https://discuss.elastic.co/u/smkarnan)\ **Replies:** 5\ **Last updated:** [September 26, 2022, 7:36am UTC](https://discuss.elastic.co/t/alphabetic-to-basic-latin-unicode/315112 "2022-09-26T07:36:21Z")
How to Elasticsearch Basic Latin character using English Alphabetic Ex:- Francois to François - c also so to include ç Ex:- a also to included ā it's other way around of asciifolding --- ## [Confusing with bucket score and record score in advanced multi metric](https://discuss.elastic.co/t/confusing-with-bucket-score-and-record-score-in-advanced-multi-metric/315134)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 7:01am UTC](https://discuss.elastic.co/t/confusing-with-bucket-score-and-record-score-in-advanced-multi-metric/315134 "2022-09-26T07:01:10Z")
I am confusing about anomaly score now. I make advanced multi metric ml job using below two single metric. Would you explain why bucket score is 84 as record score is only 2 ?? \< advanced multi metric \> And also I… --- ## [How to acheive multiple filter in elastic search using API](https://discuss.elastic.co/t/how-to-acheive-multiple-filter-in-elastic-search-using-api/315131)
**Author:** [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 6:45am UTC](https://discuss.elastic.co/t/how-to-acheive-multiple-filter-in-elastic-search-using-api/315131 "2022-09-26T06:45:29Z")
How could I be able to add multiple filters on my index like in an image I have filtered that result by first\_name and then by category using elasticsearch client @app.route('/get-data') @login\_required def get\_permiss… --- ## [How to set Offset value using java api client for datHistogramAggregation](https://discuss.elastic.co/t/how-to-set-offset-value-using-java-api-client-for-dathistogramaggregation/315124)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 6:07am UTC](https://discuss.elastic.co/t/how-to-set-offset-value-using-java-api-client-for-dathistogramaggregation/315124 "2022-09-26T06:07:18Z")
How to set Offset value using java api client for datHistogramAggregation along with calendarintervals --- ## [Ingest pipeline unable to create new field from message data](https://discuss.elastic.co/t/ingest-pipeline-unable-to-create-new-field-from-message-data/315123)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 5:57am UTC](https://discuss.elastic.co/t/ingest-pipeline-unable-to-create-new-field-from-message-data/315123 "2022-09-26T05:57:40Z")
Hello Team, We are trying to create an ingest pipeline using filebeat for below log pattern to create new field "elasticsearch.slowlog.took\_millis="16"" from below slowlog message, but unable to find proper documentatio… --- ## [ELK Log Push from Device - Proactive Monitoring](https://discuss.elastic.co/t/elk-log-push-from-device-proactive-monitoring/314880)
**Author:** [@Arunachalam\_Jayarama](https://discuss.elastic.co/u/Arunachalam_Jayarama)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 3:51am UTC](https://discuss.elastic.co/t/elk-log-push-from-device-proactive-monitoring/314880 "2022-09-26T03:51:46Z")
Dear All, I am looking for a way, by which we can proactively monitor the log push from 100s of devices to ELK. Recently I came across a problem, devices were connected/configured to push the data to ELK stack, but du… --- ## [\[ERROR\]\[logstash.javapipeline](https://discuss.elastic.co/t/error-logstash-javapipeline/314746)
**Author:** [@wxhgwh](https://discuss.elastic.co/u/wxhgwh)\ **Replies:** 18\ **Last updated:** [September 26, 2022, 3:44am UTC](https://discuss.elastic.co/t/error-logstash-javapipeline/314746 "2022-09-26T03:44:05Z")
\`\`\` \[ERROR\]\[logstash.licensechecker.licensereader\] Unable to retrieve license information fromlicense server {:message=\>"Unsupported or unrecognized SSL message"}Preformatted text \[ERROR\]\[logstash.javapipeline \]\[mai… --- ## [Unhealthy Deployment](https://discuss.elastic.co/t/unhealthy-deployment/315114)
**Author:** [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 2:41am UTC](https://discuss.elastic.co/t/unhealthy-deployment/315114 "2022-09-26T02:41:53Z")
Hi everyone, I have cloud deployment which today went unhealthy. But when I checked the cluster all is healthy. I have 1 Master, 2 Hot and 1 Warm. I checked the status of the index and it going through rollover … --- ## [Action \[indices:data/write/bulk\[s\]\] is unauthorized for API key id of user \[ \]](https://discuss.elastic.co/t/action-indices-data-write-bulk-s-is-unauthorized-for-api-key-id-of-user/313605)
**Author:** [@kgeographer](https://discuss.elastic.co/u/kgeographer)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 1:59am UTC](https://discuss.elastic.co/t/action-indices-data-write-bulk-s-is-unauthorized-for-api-key-id-of-user/313605 "2022-09-26T01:59:32Z")
I have a 7.17 index I access routinely for reads and writes from a Django app with elasticsearch-py, performing snapshots to GCS, etc. This works fine with both the ES 7.17 on a Mac dev laptop against a copy of the prod … --- ## [How does Elasticsearch Splitting an Index Work?](https://discuss.elastic.co/t/how-does-elasticsearch-splitting-an-index-work/313319)
**Author:** [@Hao\_Yellow](https://discuss.elastic.co/u/Hao_Yellow)\ **Replies:** 17\ **Last updated:** [September 26, 2022, 1:37am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-splitting-an-index-work/313319 "2022-09-26T01:37:54Z")
Hello, recently I've been working on splitting some indices with too large shards (not too many), so that the cluster's free disk space is more balanced among the multiple nodes. I read a discussion (see the discussion … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=782) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=784)