# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=794

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 795

---

## [Restrict Concurrent Users getting same results for same search creiteria](https://discuss.elastic.co/t/restrict-concurrent-users-getting-same-results-for-same-search-creiteria/314373)

<div class="topic-metadata">

**Author:** [@anish\_a\_nair](https://discuss.elastic.co/u/anish_a_nair)\
**Replies:** 5\
**Last updated:** [September 14, 2022, 12:18pm UTC](https://discuss.elastic.co/t/restrict-concurrent-users-getting-same-results-for-same-search-creiteria/314373 "2022-09-14T12:18:56Z")

</div>

Hi, I have requirement to restrict the concurrent users viewing same results if they use same search criteria. The example of my use case is listed below let's assume i have below numbers in a field called "Numbers" 8…

---

## [Get a private key from http\_ca.crt](https://discuss.elastic.co/t/get-a-private-key-from-http-ca-crt/314408)

<div class="topic-metadata">

**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\
**Replies:** 0\
**Last updated:** [September 14, 2022, 12:18pm UTC](https://discuss.elastic.co/t/get-a-private-key-from-http-ca-crt/314408 "2022-09-14T12:18:31Z")

</div>

Hi How i can get a private key from /etc/elasticsearch/certs/http\_ca.crt file ? I need that key to create cert for logstash ./bin/elasticsearch-certutil cert --name logstash --ca-cert /etc/elasticsearch/certs/http\_ca…

---

## [Elastic search response capped to 10k records](https://discuss.elastic.co/t/elastic-search-response-capped-to-10k-records/314192)

<div class="topic-metadata">

**Author:** [@Deepanshu\_Rai](https://discuss.elastic.co/u/Deepanshu_Rai)\
**Replies:** 4\
**Last updated:** [September 14, 2022, 12:07pm UTC](https://discuss.elastic.co/t/elastic-search-response-capped-to-10k-records/314192 "2022-09-14T12:07:16Z")

</div>

I am trying to query my index which has more then 500k records but i am only able to extract 10k records at a time. now i understand this has to do with performance of the application but how can i do bulk extract? with…

---

## [Help for my first open source contribution](https://discuss.elastic.co/t/help-for-my-first-open-source-contribution/314322)

<div class="topic-metadata">

**Author:** [@Akshay\_Bhadange](https://discuss.elastic.co/u/Akshay_Bhadange)\
**Replies:** 2\
**Last updated:** [September 14, 2022, 12:03pm UTC](https://discuss.elastic.co/t/help-for-my-first-open-source-contribution/314322 "2022-09-14T12:03:02Z")

</div>

I want to contribute to this project so i just want to know is my laptop specs sufficient enough for running this project and its a windows machine Specs: Os : windows 10 Ram : 8 gb Ssd : 120 Thanks in advance , lo…

---

## [Error in logstash output by using elasticsearch update by query](https://discuss.elastic.co/t/error-in-logstash-output-by-using-elasticsearch-update-by-query/314405)

<div class="topic-metadata">

**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\
**Replies:** 0\
**Last updated:** [September 14, 2022, 11:47am UTC](https://discuss.elastic.co/t/error-in-logstash-output-by-using-elasticsearch-update-by-query/314405 "2022-09-14T11:47:35Z")

</div>

Hi All, I am trying to update new field to the existing documents using update by query through logstash and below is the configuration I have tried, input { http\_poller { urls =\> { version =\> "https://d…

---

## [No geoip points in kibana map](https://discuss.elastic.co/t/no-geoip-points-in-kibana-map/314145)

<div class="topic-metadata">

**Author:** [@SirStephanikus](https://discuss.elastic.co/u/SirStephanikus)\
**Replies:** 8\
**Last updated:** [September 14, 2022, 11:38am UTC](https://discuss.elastic.co/t/no-geoip-points-in-kibana-map/314145 "2022-09-14T11:38:16Z")

</div>

Hello everyone and welcome to another rooky question :smiley: In a very simple logstash pipeline, I want to enter via stdin an ipv4 address and ship it to elasticsearch...than get the geoip location drawn on a map. How…

---

## [Azure AD (modlue:o365) logs are not fetched consistently by filebeat](https://discuss.elastic.co/t/azure-ad-modlue-o365-logs-are-not-fetched-consistently-by-filebeat/314369)

<div class="topic-metadata">

**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\
**Replies:** 2\
**Last updated:** [September 14, 2022, 11:21am UTC](https://discuss.elastic.co/t/azure-ad-modlue-o365-logs-are-not-fetched-consistently-by-filebeat/314369 "2022-09-14T11:21:15Z")

</div>

Hi Team I am New to the filebeat usage. I am trying to fetch logs from azure tenant using o365 module. I am able to get the logs sometimes but sometimes the expected logs are missing. I expect the logs when there is som…

---

## [Difference b/w Normal DBs vs Elasticsearch](https://discuss.elastic.co/t/difference-b-w-normal-dbs-vs-elasticsearch/314207)

<div class="topic-metadata">

**Author:** [@Karan\_Koya](https://discuss.elastic.co/u/Karan_Koya)\
**Replies:** 8\
**Last updated:** [September 14, 2022, 10:27am UTC](https://discuss.elastic.co/t/difference-b-w-normal-dbs-vs-elasticsearch/314207 "2022-09-14T10:27:45Z")

</div>

I have recently started exploring Elastic Stack and came across your Beginner's series which has solved many doubts about Elasticsearch but I am still not sure why we not use Database and prefer Elasticsearch, and why/ho…

---

## [Preprocessing of alerts to be send using httppost](https://discuss.elastic.co/t/preprocessing-of-alerts-to-be-send-using-httppost/313627)

<div class="topic-metadata">

**Author:** [@Pratik1](https://discuss.elastic.co/u/Pratik1)\
**Replies:** 2\
**Last updated:** [September 14, 2022, 10:25am UTC](https://discuss.elastic.co/t/preprocessing-of-alerts-to-be-send-using-httppost/313627 "2022-09-14T10:25:30Z")

</div>

I am using a tool called Kapacitor to send alerts using httppost method to elasticsearch. However, in one list I am getting both time and value column with datatypes date and float respectively. This is causing exceptio…

---

## [Split single object in array to multiple?](https://discuss.elastic.co/t/split-single-object-in-array-to-multiple/314392)

<div class="topic-metadata">

**Author:** [@Hamza\_Khalid](https://discuss.elastic.co/u/Hamza_Khalid)\
**Replies:** 0\
**Last updated:** [September 14, 2022, 9:37am UTC](https://discuss.elastic.co/t/split-single-object-in-array-to-multiple/314392 "2022-09-14T09:37:36Z")

</div>

I'm using logstash to index data from mysql to elasticsearch. Is there a way to convert this output: "interests" : \[ { "interest\_id" : "1,2", "interest\_name" : "Business,Farming" } \] To this: "interests" : \[ { …

---

## [Minimal ES server version to work with elasticsearch-py](https://discuss.elastic.co/t/minimal-es-server-version-to-work-with-elasticsearch-py/314385)

<div class="topic-metadata">

**Author:** [@Naams](https://discuss.elastic.co/u/Naams)\
**Replies:** 0\
**Last updated:** [September 14, 2022, 8:30am UTC](https://discuss.elastic.co/t/minimal-es-server-version-to-work-with-elasticsearch-py/314385 "2022-09-14T08:30:53Z")

</div>

Hi, I know that UnsupportedProductError is raised by elasticsearch-py package since version 7.14 when ES server is "too old". The two solutions I have to keep using this package are : Downgrade my python package to \<7…

---

## [Hot/warm architecture](https://discuss.elastic.co/t/hot-warm-architecture/314382)

<div class="topic-metadata">

**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Replies:** 2\
**Last updated:** [September 14, 2022, 8:52am UTC](https://discuss.elastic.co/t/hot-warm-architecture/314382 "2022-09-14T08:52:47Z")

</div>

Hi there, I'd like to ask. if an index enters a warm state, can it still perform write operations? i read this blog but didn't found the information i need Thanks

---

## [Runtime field Create Nested Object](https://discuss.elastic.co/t/runtime-field-create-nested-object/312316)

<div class="topic-metadata">

**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\
**Replies:** 4\
**Last updated:** [September 14, 2022, 8:47am UTC](https://discuss.elastic.co/t/runtime-field-create-nested-object/312316 "2022-09-14T08:47:19Z")

</div>

Hello, I'm trying to create a run-time field which creates an array. I've been doing simple things like creating strings based on a conditional field but I can't seem to get the right syntax for a multi-value string obj…

---

## [Vega: Fitting time range to Kibana filter](https://discuss.elastic.co/t/vega-fitting-time-range-to-kibana-filter/314259)

<div class="topic-metadata">

**Author:** [@Ernyz](https://discuss.elastic.co/u/Ernyz)\
**Replies:** 0\
**Last updated:** [September 13, 2022, 7:44am UTC](https://discuss.elastic.co/t/vega-fitting-time-range-to-kibana-filter/314259 "2022-09-13T07:44:10Z")

</div>

Hello, I've been struggling with this problem. I'm creating a visualization of events in a timeline wich resemble a Gantt graph. I've succesfully pulled data from elasticsearch and displayed it on the graph area using X…

---

## [Unable to Join New node to existing cluster](https://discuss.elastic.co/t/unable-to-join-new-node-to-existing-cluster/314353)

<div class="topic-metadata">

**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\
**Replies:** 5\
**Last updated:** [September 14, 2022, 7:15am UTC](https://discuss.elastic.co/t/unable-to-join-new-node-to-existing-cluster/314353 "2022-09-14T07:15:39Z")

</div>

Hi, I'm using Elasticsearch 8.4 version. I was able to install Elasticsearch and Kibana. Then I tried to install on 2nd node. I followed the steps in https://www.elastic.co/guide/en/elasticsearch/reference/current/rp…

---

## [PDF, jpeg/jpg and other file types ingests](https://discuss.elastic.co/t/pdf-jpeg-jpg-and-other-file-types-ingests/313860)

<div class="topic-metadata">

**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\
**Replies:** 15\
**Last updated:** [September 14, 2022, 7:08am UTC](https://discuss.elastic.co/t/pdf-jpeg-jpg-and-other-file-types-ingests/313860 "2022-09-14T07:08:19Z")

</div>

Hello There! I am looking for a tutorial how can I ingest/parse/analyze files like \*.pdf or .jpeg/.jpg and other types. I have found this article but I don't use docker/k8s. Could you be so kind and show me other tuto…

---

## [Unable to start Elastic.service 'setting \[cluster.initial\_master\_nodes\] is not allowed when \[discovery.type\] is set to \[single-node\]'](https://discuss.elastic.co/t/unable-to-start-elastic-service-setting-cluster-initial-master-nodes-is-not-allowed-when-discovery-type-is-set-to-single-node/314375)

<div class="topic-metadata">

**Author:** [@Neophyte](https://discuss.elastic.co/u/Neophyte)\
**Replies:** 2\
**Last updated:** [September 14, 2022, 6:59am UTC](https://discuss.elastic.co/t/unable-to-start-elastic-service-setting-cluster-initial-master-nodes-is-not-allowed-when-discovery-type-is-set-to-single-node/314375 "2022-09-14T06:59:35Z")

</div>

I am trying to set up a SIEM HOME LAB environment and install the latest Elastic and kibana on Ubuntu, but the service is not starting up, and am receiving the following errors: messi@fifa:~/Desktop$ sudo systemctl rest…

---

## [Transform Mapping Errors](https://discuss.elastic.co/t/transform-mapping-errors/313382)

<div class="topic-metadata">

**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\
**Replies:** 12\
**Last updated:** [September 14, 2022, 6:57am UTC](https://discuss.elastic.co/t/transform-mapping-errors/313382 "2022-09-14T06:57:51Z")

</div>

Hello, I've set up a transform to aggregate on process.name, however it continues to fail exactly on the same date with the following error - Failed to index documents into destination index due to permanent error: \[or…

---

## [Elastic unable to start after turning it off](https://discuss.elastic.co/t/elastic-unable-to-start-after-turning-it-off/313532)

<div class="topic-metadata">

**Author:** [@pabloochoa](https://discuss.elastic.co/u/pabloochoa)\
**Replies:** 5\
**Last updated:** [September 14, 2022, 6:37am UTC](https://discuss.elastic.co/t/elastic-unable-to-start-after-turning-it-off/313532 "2022-09-14T06:37:43Z")

</div>

Hello, I have a cluster of 3 ES nodes that use 7.16.3. All of them are both masters and data (as I am trying to deploy a minimal ES cluster that is resistant to the failure of one of the nodes). Maybe this is not a good…

---

## [Upgrading Elastic Stack from 7.7.0 to 7.17.6](https://discuss.elastic.co/t/upgrading-elastic-stack-from-7-7-0-to-7-17-6/314224)

<div class="topic-metadata">

**Author:** [@ozonshak](https://discuss.elastic.co/u/ozonshak)\
**Replies:** 3\
**Last updated:** [September 14, 2022, 6:27am UTC](https://discuss.elastic.co/t/upgrading-elastic-stack-from-7-7-0-to-7-17-6/314224 "2022-09-14T06:27:24Z")

</div>

Hello. It has been over 2 years since I last installed the Elastic stack locally in our environment (Kibana, Elasticsearch, Logstash, FileBeat). The version we are on right now is 7.7.0 for all products. I'm not sure …

---

## [How to avoid double indexing when using rollover indice](https://discuss.elastic.co/t/how-to-avoid-double-indexing-when-using-rollover-indice/314366)

<div class="topic-metadata">

**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Replies:** 7\
**Last updated:** [September 14, 2022, 6:18am UTC](https://discuss.elastic.co/t/how-to-avoid-double-indexing-when-using-rollover-indice/314366 "2022-09-14T06:18:52Z")

</div>

Hello All, I'm using the rollover feature for my indices on daily basis along with doc\_as\_upsert,to maintain unique documents only.The rollover Index gets deleted after 30 days. I can see the issue of double indexing,E…

---

## [Filter http - delete by query doesn't work](https://discuss.elastic.co/t/filter-http-delete-by-query-doesnt-work/314371)

<div class="topic-metadata">

**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\
**Replies:** 0\
**Last updated:** [September 14, 2022, 6:18am UTC](https://discuss.elastic.co/t/filter-http-delete-by-query-doesnt-work/314371 "2022-09-14T06:18:22Z")

</div>

Hi guys, in my pipeline, filter section I use the http plugin in order to remove old data: http { url =\> "http://localhost:9200/test-main/\_delete\_by\_query" verb =\> "POST" body\_format =\> …

---

## [Selective deletion of indices](https://discuss.elastic.co/t/selective-deletion-of-indices/314370)

<div class="topic-metadata">

**Author:** [@newbie2022](https://discuss.elastic.co/u/newbie2022)\
**Replies:** 1\
**Last updated:** [September 14, 2022, 6:13am UTC](https://discuss.elastic.co/t/selective-deletion-of-indices/314370 "2022-09-14T06:13:42Z")

</div>

I have a ruby web app with a search function that is enabled by Elasticsearch. There are 2 types of content Content A which should be searchable indefinitely Content B which is time-sensitive and no longer relevant af…

---

## [How to convert dates to months format](https://discuss.elastic.co/t/how-to-convert-dates-to-months-format/314252)

<div class="topic-metadata">

**Author:** [@Ritikapawar](https://discuss.elastic.co/u/Ritikapawar)\
**Replies:** 2\
**Last updated:** [September 14, 2022, 6:07am UTC](https://discuss.elastic.co/t/how-to-convert-dates-to-months-format/314252 "2022-09-14T06:07:09Z")

</div>

Hi I've data in this format "Admission \_date" : "2020-01-28", "id" : 78 when I visualize the data in this format I get results like this X axis : admission date Y axis : count of records I want the mon…

---

## [Can filebeat 8.4 send to older elasticsearch 7.15](https://discuss.elastic.co/t/can-filebeat-8-4-send-to-older-elasticsearch-7-15/314310)

<div class="topic-metadata">

**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\
**Replies:** 1\
**Last updated:** [September 14, 2022, 5:26am UTC](https://discuss.elastic.co/t/can-filebeat-8-4-send-to-older-elasticsearch-7-15/314310 "2022-09-14T05:26:17Z")

</div>

Hello, Is it possible for filebeat 8.4 to send to an older cluster such as elasticsearch 7.15?

---

## [Logstash unable to start and collect logs](https://discuss.elastic.co/t/logstash-unable-to-start-and-collect-logs/314296)

<div class="topic-metadata">

**Author:** [@khanchand](https://discuss.elastic.co/u/khanchand)\
**Replies:** 10\
**Last updated:** [September 14, 2022, 5:24am UTC](https://discuss.elastic.co/t/logstash-unable-to-start-and-collect-logs/314296 "2022-09-14T05:24:15Z")

</div>

Hi I have configure Elasticsearch, kibana & logstash on same machine. Want to receive firewall logs in logstash but facing below error. For now want to show these event on console only once received will forward in elast…

---

## [How to handle more than 32 filter in elasticseacrh UI](https://discuss.elastic.co/t/how-to-handle-more-than-32-filter-in-elasticseacrh-ui/314362)

<div class="topic-metadata">

**Author:** [@manojxumulus](https://discuss.elastic.co/u/manojxumulus)\
**Replies:** 2\
**Last updated:** [September 14, 2022, 5:21am UTC](https://discuss.elastic.co/t/how-to-handle-more-than-32-filter-in-elasticseacrh-ui/314362 "2022-09-14T05:21:28Z")

</div>

Hello, I have one issue related to the limit on filters applied to results in Elasticsearch UI, I would like to know how I can handle more than 32 filters or add any error boundary in the app for handling the error. Lo…

---

## [Unassigned shards on data-streams indices following upgrade to 7.17.5](https://discuss.elastic.co/t/unassigned-shards-on-data-streams-indices-following-upgrade-to-7-17-5/314130)

<div class="topic-metadata">

**Author:** [@nadler](https://discuss.elastic.co/u/nadler)\
**Replies:** 5\
**Last updated:** [September 14, 2022, 5:08am UTC](https://discuss.elastic.co/t/unassigned-shards-on-data-streams-indices-following-upgrade-to-7-17-5/314130 "2022-09-14T05:08:42Z")

</div>

Hey, Recently i have upgraded a few of our clusters from 7.12.0 to 7.17.5. After the upgrade two indices were created: .ds-.logs-deprecation.elasticsearch-default-2022.09.07-000001 and .ds-ilm-history-5-2022.09.07-000…

---

## [Can I display search box and search results in separate React components](https://discuss.elastic.co/t/can-i-display-search-box-and-search-results-in-separate-react-components/314364)

<div class="topic-metadata">

**Author:** [@Sheng111](https://discuss.elastic.co/u/Sheng111)\
**Replies:** 0\
**Last updated:** [September 14, 2022, 5:04am UTC](https://discuss.elastic.co/t/can-i-display-search-box-and-search-results-in-separate-react-components/314364 "2022-09-14T05:04:32Z")

</div>

I am thinking to create a search box with Elastic search UI library, my requirements are display search box in header of all the website, but search results will display in a different React components as a part of the p…

---

## [Kibana cannot connect to the Elastic Package Registry, which provides Elastic Agent integrations](https://discuss.elastic.co/t/kibana-cannot-connect-to-the-elastic-package-registry-which-provides-elastic-agent-integrations/314107)

<div class="topic-metadata">

**Author:** [@Sher\_Khan](https://discuss.elastic.co/u/Sher_Khan)\
**Replies:** 8\
**Last updated:** [September 14, 2022, 4:37am UTC](https://discuss.elastic.co/t/kibana-cannot-connect-to-the-elastic-package-registry-which-provides-elastic-agent-integrations/314107 "2022-09-14T04:37:54Z")

</div>

How to resolve this issue?

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=793)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=795)
