# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=790 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 791 --- ## [How to find or query duplicate offsets?](https://discuss.elastic.co/t/how-to-find-or-query-duplicate-offsets/314456)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 6\ **Last updated:** [September 19, 2022, 1:04pm UTC](https://discuss.elastic.co/t/how-to-find-or-query-duplicate-offsets/314456 "2022-09-19T13:04:33Z")
I’m having duplicate records in my indexes. How can I find list of duplicate records ? Duplicate records have same offset, can you suggest the query to find list of offset with more than one count ? Or any other way to… --- ## [Sorting by Fields After Text Score](https://discuss.elastic.co/t/sorting-by-fields-after-text-score/314673)
**Author:** [@AymanHamdoun](https://discuss.elastic.co/u/AymanHamdoun)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 12:37pm UTC](https://discuss.elastic.co/t/sorting-by-fields-after-text-score/314673 "2022-09-19T12:37:35Z")
Hello, I was wondering if elastic has the ability to sort by certain indexed fields in a document but not prioritize them over the textual match... For instance, lets say i have an index of products that has the follow… --- ## [KV filter on ugly json log](https://discuss.elastic.co/t/kv-filter-on-ugly-json-log/314575)
**Author:** [@stanley783](https://discuss.elastic.co/u/stanley783)\ **Replies:** 4\ **Last updated:** [September 19, 2022, 10:43am UTC](https://discuss.elastic.co/t/kv-filter-on-ugly-json-log/314575 "2022-09-19T10:43:07Z")
Hi, received log in json format, json filter parsed correctly but one field, "details", is in a unfinished/incorrect format lets say and json cant handle it, therefore i applied kv but cant get desired outcome - correct… --- ## [How to store documents (word/ppt/excel/pdf) and search its content using elastic search](https://discuss.elastic.co/t/how-to-store-documents-word-ppt-excel-pdf-and-search-its-content-using-elastic-search/314674)
**Author:** [@avinash.parameswaran](https://discuss.elastic.co/u/avinash.parameswaran)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 10:26am UTC](https://discuss.elastic.co/t/how-to-store-documents-word-ppt-excel-pdf-and-search-its-content-using-elastic-search/314674 "2022-09-19T10:26:15Z")
How to store document as blob to create indexes and search document content as full text search?Any suggestion on above approach to proceed would be helpful Thanks. --- ## [High CPU usage caused by Lucene merge thread](https://discuss.elastic.co/t/high-cpu-usage-caused-by-lucene-merge-thread/314664)
**Author:** [@kent010341](https://discuss.elastic.co/u/kent010341)\ **Replies:** 5\ **Last updated:** [September 19, 2022, 9:07am UTC](https://discuss.elastic.co/t/high-cpu-usage-caused-by-lucene-merge-thread/314664 "2022-09-19T09:07:20Z")
I run ELK stack, APM server, and Metricbeat (Docker and System module) with Docker. The Logstash is used for reading log files, and both the APM server and Metricbeat are for monitoring with a period of 10 seconds. Som… --- ## [Show number as percentile in elasticsearch DSL](https://discuss.elastic.co/t/show-number-as-percentile-in-elasticsearch-dsl/314506)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 5\ **Last updated:** [September 19, 2022, 9:01am UTC](https://discuss.elastic.co/t/show-number-as-percentile-in-elasticsearch-dsl/314506 "2022-09-19T09:01:38Z")
Sample data Name response\_code abc 6780 abc2 9999 abc3 1000 abc4 3456 . . . abc20 9700 I want two perform following task Show those response\_code whoes value is greater than 3000 Sh… --- ## [Filebeat 8.3](https://discuss.elastic.co/t/filebeat-8-3/314630)
**Author:** [@abaltan](https://discuss.elastic.co/u/abaltan)\ **Replies:** 8\ **Last updated:** [September 19, 2022, 8:40am UTC](https://discuss.elastic.co/t/filebeat-8-3/314630 "2022-09-19T08:40:52Z")
Hello, Hope you doing well. we are upgrading Filebeat from 7.12 to 8.3 and we are using the config file below. But for some reason filebeat is not working. Could you please check if there is anything we need to modify … --- ## [Post\_filter on aggregated results](https://discuss.elastic.co/t/post-filter-on-aggregated-results/314671)
**Author:** [@Emna\_Jaoua](https://discuss.elastic.co/u/Emna_Jaoua)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 7:58am UTC](https://discuss.elastic.co/t/post-filter-on-aggregated-results/314671 "2022-09-19T07:58:18Z")
Hello everyone, I have some trouble filtering on aggregated results although the post\_filter is applied on the nested path. To give some context, I m aggregating on nested path aggregationTr.subField.countryId using thi… --- ## [Saved object not found & cannot delete it](https://discuss.elastic.co/t/saved-object-not-found-cannot-delete-it/314164)
**Author:** [@uae\_user](https://discuss.elastic.co/u/uae_user)\ **Replies:** 4\ **Last updated:** [September 19, 2022, 5:50am UTC](https://discuss.elastic.co/t/saved-object-not-found-cannot-delete-it/314164 "2022-09-19T05:50:50Z")
Hello, I re-indexed my data and created a new data view after deleting the old one. There are some visualization objects linked to the old data view which I managed to create again and remove the old one however there a… --- ## [Adding new data nodes to busy ingesting cluster](https://discuss.elastic.co/t/adding-new-data-nodes-to-busy-ingesting-cluster/314614)
**Author:** [@Todd\_Lyons](https://discuss.elastic.co/u/Todd_Lyons)\ **Replies:** 2\ **Last updated:** [September 19, 2022, 12:26am UTC](https://discuss.elastic.co/t/adding-new-data-nodes-to-busy-ingesting-cluster/314614 "2022-09-19T00:26:10Z")
We have a 7.17.4 cluster with 10 data nodes. Our main index is 10 shards with 1 replica, and it rolls over at 500 GB. I added 2 data nodes, expecting the incoming shards to spread out over the 12 nodes, maybe 2 per new… --- ## [What's the cause of This Error and how to fix It?](https://discuss.elastic.co/t/whats-the-cause-of-this-error-and-how-to-fix-it/314507)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:15pm UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-error-and-how-to-fix-it/314507 "2022-09-18T23:15:36Z")
I installed Elasticsearch and Kibana 8.4.1 in VM ubuntu 22.04 ad I give this VM 2G RAM, 50 G disk, and 2 CPU, i try in the first time to browze kibana , it's work i can access kibana GUI and relate it to elasticsearch bu… --- ## [What's the cause of this Eroor and how to fix it?](https://discuss.elastic.co/t/whats-the-cause-of-this-eroor-and-how-to-fix-it/314505)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:15pm UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-eroor-and-how-to-fix-it/314505 "2022-09-18T23:15:12Z")
I installed elasticsearch and kibana 8.4.1 in VM ubuntu 22.04 ad i give to this VM 2G RAM , 50 G disk and 2 cpu Caused by: java.io.IOException: No space left on device elastic@elqstic:~$ sudo systemctl status elasticse… --- ## [Converting large fields during reindex ends with 429](https://discuss.elastic.co/t/converting-large-fields-during-reindex-ends-with-429/314568)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:12pm UTC](https://discuss.elastic.co/t/converting-large-fields-during-reindex-ends-with-429/314568 "2022-09-18T23:12:48Z")
I'm trying to reindex a complex document into a simple one and I have troubles with embedded fields. I have a document like this: POST from/\_doc/1 { "systemMetadata" : { "a:b:c:searchContentHTML" : { "textV… --- ## [ERROR: Aborting enrolling to cluster. Could not communicate with the node on any of the addresses from the enrollment token. All of \[ip:9200\] were attempted](https://discuss.elastic.co/t/error-aborting-enrolling-to-cluster-could-not-communicate-with-the-node-on-any-of-the-addresses-from-the-enrollment-token-all-of-ip-9200-were-attempted/314651)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 9:18pm UTC](https://discuss.elastic.co/t/error-aborting-enrolling-to-cluster-could-not-communicate-with-the-node-on-any-of-the-addresses-from-the-enrollment-token-all-of-ip-9200-were-attempted/314651 "2022-09-18T21:18:05Z")
Hi, I tried to join new node to existing Elastic cluster. I'm using Elasticsearch version 8.4.1 Tried steps for new node: sudo rpm --install elasticsearch-8.4.1-x86\_64.rpm /usr/share/elasticsearch/bin/elasticsearch-… --- ## [Elasticsearch: find closest/nearest docs in reference to one (calculated from known date)](https://discuss.elastic.co/t/elasticsearch-find-closest-nearest-docs-in-reference-to-one-calculated-from-known-date/314648)
**Author:** [@err](https://discuss.elastic.co/u/err)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 4:52pm UTC](https://discuss.elastic.co/t/elasticsearch-find-closest-nearest-docs-in-reference-to-one-calculated-from-known-date/314648 "2022-09-18T16:52:14Z")
Is there a standard seach possibility to find closest docs to one reference doc by date criteria (if I don not know range yet) Example dataset index “person” - doc : name=\>Alice birthday=\>01.01.1991 - doc : name=\>Bob… --- ## [Best practice for integrating automated created\_at & updated\_at fields in Elasticsearch 8.4](https://discuss.elastic.co/t/best-practice-for-integrating-automated-created-at-updated-at-fields-in-elasticsearch-8-4/314634)
**Author:** [@Sabbir\_Talukdar](https://discuss.elastic.co/u/Sabbir_Talukdar)\ **Replies:** 5\ **Last updated:** [September 18, 2022, 4:47pm UTC](https://discuss.elastic.co/t/best-practice-for-integrating-automated-created-at-updated-at-fields-in-elasticsearch-8-4/314634 "2022-09-18T16:47:39Z")
Hello, this is my first transition from other DB (SQL / NOSQL based) to Elasticsearch. I am having troubles choosing the best practiced methods of integrating created\_at & updated\_at fields. I am familiar with ingest\_p… --- ## [Unable to access kibana dashboard](https://discuss.elastic.co/t/unable-to-access-kibana-dashboard/314637)
**Author:** [@Cipta\_Daffa](https://discuss.elastic.co/u/Cipta_Daffa)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 2:59pm UTC](https://discuss.elastic.co/t/unable-to-access-kibana-dashboard/314637 "2022-09-18T14:59:39Z")
With this configuration, i can't access kibana dashboard? there's anybody can help me? thank you --- ## [Error while running Functinbeat](https://discuss.elastic.co/t/error-while-running-functinbeat/314642)
**Author:** [@Shubham\_Shah](https://discuss.elastic.co/u/Shubham_Shah)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 12:02pm UTC](https://discuss.elastic.co/t/error-while-running-functinbeat/314642 "2022-09-18T12:02:27Z")
Hi Team, While running functionbeat for my testing instance, I got following error as Creation Failed for cloudformation. Error - "Specified ReservedConcurrentExecutions for function decreases account's UnreservedConc… --- ## [Aggregations on \_routing](https://discuss.elastic.co/t/aggregations-on-routing/314640)
**Author:** [@Alexandr\_Maximov](https://discuss.elastic.co/u/Alexandr_Maximov)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 11:24am UTC](https://discuss.elastic.co/t/aggregations-on-routing/314640 "2022-09-18T11:24:50Z")
Hey folks, is there any way how to aggregate on \_routing meta field? I'd like to do an aggregation on \_routing to make sure we don't have any stale data in our indices. --- ## [Very large index , delete and recreate replica](https://discuss.elastic.co/t/very-large-index-delete-and-recreate-replica/314608)
**Author:** [@Paul-Ayo](https://discuss.elastic.co/u/Paul-Ayo)\ **Replies:** 8\ **Last updated:** [September 18, 2022, 10:03am UTC](https://discuss.elastic.co/t/very-large-index-delete-and-recreate-replica/314608 "2022-09-18T10:03:26Z")
I have a huge index which i want to split or reindex , the index has one primary and one replica shard both 118gb . I need to create a new index from the current to be able to use ILM as the index name does not fulfill t… --- ## [Elastic security](https://discuss.elastic.co/t/elastic-security/314297)
**Author:** [@dockerdeploys](https://discuss.elastic.co/u/dockerdeploys)\ **Replies:** 2\ **Last updated:** [September 18, 2022, 3:39am UTC](https://discuss.elastic.co/t/elastic-security/314297 "2022-09-18T03:39:19Z")
Continuing the discussion from ERROR: Failed to set password for user \[apm\_system\] yet again: Hello good time I encountered the following security error in Elasticsearch Thank you for your guidance --- ## [ElasticSearch-6.8 - querying with hyphens in fields does not get results](https://discuss.elastic.co/t/elasticsearch-6-8-querying-with-hyphens-in-fields-does-not-get-results/314467)
**Author:** [@spp125](https://discuss.elastic.co/u/spp125)\ **Replies:** 7\ **Last updated:** [September 18, 2022, 2:08am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-querying-with-hyphens-in-fields-does-not-get-results/314467 "2022-09-18T02:08:17Z")
I have a users index in that there is a field called groupName that have value like "ad-users" when I query to match how many users belong to "ad-users" groupName. Upon querying to match on groupName I got no results. He… --- ## [Can't index new docs due to type error; sending to old indices still works](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628)
**Author:** [@emw](https://discuss.elastic.co/u/emw)\ **Replies:** 2\ **Last updated:** [September 18, 2022, 12:23am UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628 "2022-09-18T00:23:13Z")
In my ES 7.17 cluster, I'm using index templates to create a new weekly index where I send log data. The index names are generated by my application, not by ES; the template handles index patterns, field limits, and alia… --- ## [How to config OpenTelemetry Log](https://discuss.elastic.co/t/how-to-config-opentelemetry-log/314622)
**Author:** [@yingziisme](https://discuss.elastic.co/u/yingziisme)\ **Replies:** 1\ **Last updated:** [September 17, 2022, 2:56pm UTC](https://discuss.elastic.co/t/how-to-config-opentelemetry-log/314622 "2022-09-17T14:56:02Z")
In Observability Page, find the error "Expected ")", ":", "\<", "\<=", "\>", "\>=", AND, OR, whitespace but end of input found." like below picture. but I can find Log from Trace details By Trace logs --- ## [\[LogStash::Runner\] runner - Logstash shut down](https://discuss.elastic.co/t/logstash-runner-runner-logstash-shut-down/314612)
**Author:** [@Veera\_V](https://discuss.elastic.co/u/Veera_V)\ **Replies:** 2\ **Last updated:** [September 17, 2022, 1:16pm UTC](https://discuss.elastic.co/t/logstash-runner-runner-logstash-shut-down/314612 "2022-09-17T13:16:41Z")
Hi there, I'm trying to connect logstash and Opensearch, but I'm getting error "Logstash::Runner\] runner - Logstash shutdown. Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. … --- ## [\[Kubernetes Integration\] Custom ingest pipeline for subset of k8s cluster's container's logs](https://discuss.elastic.co/t/kubernetes-integration-custom-ingest-pipeline-for-subset-of-k8s-clusters-containers-logs/314601)
**Author:** [@woodywoodsta](https://discuss.elastic.co/u/woodywoodsta)\ **Replies:** 2\ **Last updated:** [September 17, 2022, 12:44pm UTC](https://discuss.elastic.co/t/kubernetes-integration-custom-ingest-pipeline-for-subset-of-k8s-clusters-containers-logs/314601 "2022-09-17T12:44:50Z")
I'm using the Kubernetes Integration managed via fleet to collect container logs from my k8s cluster. At the moment, logs from all containers are passed through the same pipeline by means of the integration. I have a ne… --- ## [Looking for some assistance with rsyslog-\>ES adding custom field, solvee will get 50$ 100%](https://discuss.elastic.co/t/looking-for-some-assistance-with-rsyslog-es-adding-custom-field-solvee-will-get-50-100/314422)
**Author:** [@PlospRawrs](https://discuss.elastic.co/u/PlospRawrs)\ **Replies:** 2\ **Last updated:** [September 17, 2022, 4:35am UTC](https://discuss.elastic.co/t/looking-for-some-assistance-with-rsyslog-es-adding-custom-field-solvee-will-get-50-100/314422 "2022-09-17T04:35:00Z")
Hi All, Looking for some guidance, per the subject, I will give the solvee 50$ to show my appreciation. I will share solution on thread I don't care, but I will compensate. Setup: Rsyslog version 8.20 ES version 7.10 … --- ## [Elasticsearch won’t start after upgrade to 8.4.1](https://discuss.elastic.co/t/elasticsearch-won-t-start-after-upgrade-to-8-4-1/314583)
**Author:** [@Ubuxa](https://discuss.elastic.co/u/Ubuxa)\ **Replies:** 4\ **Last updated:** [September 17, 2022, 2:12am UTC](https://discuss.elastic.co/t/elasticsearch-won-t-start-after-upgrade-to-8-4-1/314583 "2022-09-17T02:12:40Z")
Similar issue, but this ticket has since been closed: I upgraded Elasticsearch from 7.17.5 to 8.4.1, and unfortunately I did not check for any incompatibilities. I am now unable to start Elasticsearch, and downgrading … --- ## [Mapping question](https://discuss.elastic.co/t/mapping-question/314528)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [September 16, 2022, 9:35pm UTC](https://discuss.elastic.co/t/mapping-question/314528 "2022-09-16T21:35:30Z")
I have old index hundreds of them which has following in pattern. I have another index created on different test cluster. which had this place dynamically. What I want is to add this host.name.keyword in previous… --- ## [Elastic Agent Configured By Fleet - Integrations Using MetricBeat - this action is granted by the index privileges error](https://discuss.elastic.co/t/elastic-agent-configured-by-fleet-integrations-using-metricbeat-this-action-is-granted-by-the-index-privileges-error/314603)
**Author:** [@dnimon](https://discuss.elastic.co/u/dnimon)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 9:15pm UTC](https://discuss.elastic.co/t/elastic-agent-configured-by-fleet-integrations-using-metricbeat-this-action-is-granted-by-the-index-privileges-error/314603 "2022-09-16T21:15:20Z")
I am running into an issue when trying to use Elastic Fleet and the elastic agents. I am using 8.4.1 for all parts (kibana, elastic, elastic-agent). I was able to setup a elastic-agent on the elastic/kibana server to se… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=789) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=791)