# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=832 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 833 --- ## [Reducing heap size increases query speed](https://discuss.elastic.co/t/reducing-heap-size-increases-query-speed/311850)
**Author:** [@sbruinsje](https://discuss.elastic.co/u/sbruinsje)\ **Replies:** 6\ **Last updated:** [August 12, 2022, 8:43am UTC](https://discuss.elastic.co/t/reducing-heap-size-increases-query-speed/311850 "2022-08-12T08:43:30Z")
I have recently upgraded from ES 6.8 to ES 8.3. One of the queries with heavy aggregations take significantly longer now compared to before. After some searching I found that in the new version ES sets the heap size auto… --- ## [Implicit versus explicit definition of the fast vector highlighter](https://discuss.elastic.co/t/implicit-versus-explicit-definition-of-the-fast-vector-highlighter/311990)
**Author:** [@sbruinsje](https://discuss.elastic.co/u/sbruinsje)\ **Replies:** 0\ **Last updated:** [August 12, 2022, 8:40am UTC](https://discuss.elastic.co/t/implicit-versus-explicit-definition-of-the-fast-vector-highlighter/311990 "2022-08-12T08:40:31Z")
Hi there, I was under the impression that if the mappings of a field set the term\_vector to term\_vector: 'with\_positions\_offsets', that for that field the fast vector highlighter will be used automatically. I thought so… --- ## [Issue Making TSVB in kibana](https://discuss.elastic.co/t/issue-making-tsvb-in-kibana/311825)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 2\ **Last updated:** [August 12, 2022, 8:25am UTC](https://discuss.elastic.co/t/issue-making-tsvb-in-kibana/311825 "2022-08-12T08:25:25Z")
Hello All, How can TSVB visual can be made for below image? , want to dispaly the values for processes,alive,dead wrt to monitor time.As it can be seen the value fluctuate wrt to monitor time. How can this be achieved … --- ## [Kibana table sum of count and timeseries count for given host](https://discuss.elastic.co/t/kibana-table-sum-of-count-and-timeseries-count-for-given-host/310629)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 8:03am UTC](https://discuss.elastic.co/t/kibana-table-sum-of-count-and-timeseries-count-for-given-host/310629 "2022-08-12T08:03:48Z")
Hello All, I want to display above two visuals based on below table.As for now above two visuals are wrong,but desired in same style. Whenever there is an error it should display the translator name and total count of … --- ## [Control visualization apply filter for two or multiple index](https://discuss.elastic.co/t/control-visualization-apply-filter-for-two-or-multiple-index/310821)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 7:41am UTC](https://discuss.elastic.co/t/control-visualization-apply-filter-for-two-or-multiple-index/310821 "2022-08-12T07:41:42Z")
Hello, can I use the control type to filter 2/multiple index at the same time? both index has the same field name. --- ## [Error in visualisation; \[esaggs\] \> when trying to load a dashboard](https://discuss.elastic.co/t/error-in-visualisation-esaggs-when-trying-to-load-a-dashboard/310594)
**Author:** [@BalajeP](https://discuss.elastic.co/u/BalajeP)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 7:30am UTC](https://discuss.elastic.co/t/error-in-visualisation-esaggs-when-trying-to-load-a-dashboard/310594 "2022-08-12T07:30:51Z")
I'm using kibana version 7.10.2. Getting error \[essaggs\]-502 bad gateway ,when trying to load a dashboard for more than 7 days, Thanks. --- ## [Error when exporting Visualize in Kibana](https://discuss.elastic.co/t/error-when-exporting-visualize-in-kibana/311593)
**Author:** [@istef](https://discuss.elastic.co/u/istef)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 7:25am UTC](https://discuss.elastic.co/t/error-when-exporting-visualize-in-kibana/311593 "2022-08-12T07:25:55Z")
I have an error when I tried exporting a Visualize in another ES. The VisState type is invalid. May I know if I missed something? Where should this VisState type be defined? Both (source and destination) have the sam… --- ## [I would like to generate multiple narrowing criteria in Kibana's Lens](https://discuss.elastic.co/t/i-would-like-to-generate-multiple-narrowing-criteria-in-kibanas-lens/310622)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 7:23am UTC](https://discuss.elastic.co/t/i-would-like-to-generate-multiple-narrowing-criteria-in-kibanas-lens/310622 "2022-08-12T07:23:00Z")
I want to display aggregated metrics on a Kibana dashboard. I can easily create a graph of totals for specific fields, but can I put conditions on these? For example, if I am collecting access logs and want to create a… --- ## [Ship Cloudwatch logs to Self hosted elastic stack](https://discuss.elastic.co/t/ship-cloudwatch-logs-to-self-hosted-elastic-stack/311982)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 0\ **Last updated:** [August 12, 2022, 6:46am UTC](https://discuss.elastic.co/t/ship-cloudwatch-logs-to-self-hosted-elastic-stack/311982 "2022-08-12T06:46:29Z")
Want to ship AWS cloudwatch logs to our self-hosted Elastic Stack. How can i achieve this? --- ## [How to move data from cold to warm tier](https://discuss.elastic.co/t/how-to-move-data-from-cold-to-warm-tier/311767)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 7\ **Last updated:** [August 12, 2022, 6:35am UTC](https://discuss.elastic.co/t/how-to-move-data-from-cold-to-warm-tier/311767 "2022-08-12T06:35:22Z")
Hi I need to remove cold data tiers, then in this action I thought about shifting data tier from cold to warm? How I can handle such case? --- ## [Kibana Watcher actions html body if list exists condition](https://discuss.elastic.co/t/kibana-watcher-actions-html-body-if-list-exists-condition/311934)
**Author:** [@mirokrastev](https://discuss.elastic.co/u/mirokrastev)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 6:10am UTC](https://discuss.elastic.co/t/kibana-watcher-actions-html-body-if-list-exists-condition/311934 "2022-08-12T06:10:22Z")
I have the following ES response: { "took" : 0, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 10, … --- ## [Cluster Level Replica settings](https://discuss.elastic.co/t/cluster-level-replica-settings/311976)
**Author:** [@benedictDTony](https://discuss.elastic.co/u/benedictDTony)\ **Replies:** 0\ **Last updated:** [August 12, 2022, 5:12am UTC](https://discuss.elastic.co/t/cluster-level-replica-settings/311976 "2022-08-12T05:12:48Z")
Hi, I would like to set replica settings at the cluster level instead of index level. Despite the template settings I would like my indices to be created with 0 replicas. Could someone help me how to achieve this, h… --- ## [Geo\_bounds aggregation returns empty data for Multi-Polygon Country Geometries](https://discuss.elastic.co/t/geo-bounds-aggregation-returns-empty-data-for-multi-polygon-country-geometries/311886)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 5:04am UTC](https://discuss.elastic.co/t/geo-bounds-aggregation-returns-empty-data-for-multi-polygon-country-geometries/311886 "2022-08-12T05:04:03Z")
geo\_bounds aggregation fails to generate geo\_bounds for SOME countries (large countries?) in my dataset, how can I fix this\>? My example query against a country "New Zealand" GET countries/\_search { "query": { … --- ## [Issue after migration from geo\_shape pre-fix based to geo\_shape based bkd tree mapping](https://discuss.elastic.co/t/issue-after-migration-from-geo-shape-pre-fix-based-to-geo-shape-based-bkd-tree-mapping/311406)
**Author:** [@Abhilash\_Venkatesh](https://discuss.elastic.co/u/Abhilash_Venkatesh)\ **Replies:** 9\ **Last updated:** [August 12, 2022, 3:54am UTC](https://discuss.elastic.co/t/issue-after-migration-from-geo-shape-pre-fix-based-to-geo-shape-based-bkd-tree-mapping/311406 "2022-08-12T03:54:46Z")
Hi Problem Description We want to migrate from elastic 7.x to 8. Migrated to 7.17.5 and resolved issues. One of it was was location field with geo\_shape mapping, we used strategy : recursive . To resolve took backup … --- ## [Export results from query that is more than the default maxClauseCount](https://discuss.elastic.co/t/export-results-from-query-that-is-more-than-the-default-maxclausecount/311925)
**Author:** [@xynobob](https://discuss.elastic.co/u/xynobob)\ **Replies:** 0\ **Last updated:** [August 11, 2022, 12:21pm UTC](https://discuss.elastic.co/t/export-results-from-query-that-is-more-than-the-default-maxclausecount/311925 "2022-08-11T12:21:05Z")
Hi, I have this issue where for my needs, I am required to export all the rules from Elastic Security and keep it locally which I use this command to achieve it - POST api/detection\_engine/rules/\_export. However the mai… --- ## [Analyze the logs in Storage utilization](https://discuss.elastic.co/t/analyze-the-logs-in-storage-utilization/311848)
**Author:** [@Aravind1](https://discuss.elastic.co/u/Aravind1)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 1:44am UTC](https://discuss.elastic.co/t/analyze-the-logs-in-storage-utilization/311848 "2022-08-12T01:44:16Z")
Hi, We are having a few queries on Elasticsearch logs optimization, we are doing the cost optimization and we want to know how to analyze the logs based on the storage utilization and also to know more about how many u… --- ## [Kibana Server not ready yet](https://discuss.elastic.co/t/kibana-server-not-ready-yet/311864)
**Author:** [@Naldo001](https://discuss.elastic.co/u/Naldo001)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 1:34am UTC](https://discuss.elastic.co/t/kibana-server-not-ready-yet/311864 "2022-08-12T01:34:00Z")
kibana.service - Kibana Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; vendor preset: disabled) Active: active (running) since Wed 2022-08-10 13:03:46 EDT; 20min ago Docs: https://www.elasti… --- ## [Create visualize -\> Success rate based on time](https://discuss.elastic.co/t/create-visualize-success-rate-based-on-time/311203)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 3\ **Last updated:** [August 12, 2022, 1:10am UTC](https://discuss.elastic.co/t/create-visualize-success-rate-based-on-time/311203 "2022-08-12T01:10:25Z")
Hi, I'm using 7.16.2, here are the fields I've in my index... it holding data on builds in Jenkins.. build number, status: pass or fail... I need to create a graph of success rate based on time.. for example: % of the … --- ## [Elasticsearch not starting with IOException error when using p12 files from outside CA](https://discuss.elastic.co/t/elasticsearch-not-starting-with-ioexception-error-when-using-p12-files-from-outside-ca/311855)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 2\ **Last updated:** [August 11, 2022, 8:46pm UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-with-ioexception-error-when-using-p12-files-from-outside-ca/311855 "2022-08-11T20:46:46Z")
Hello, I successfully set up xpack basic security when I used self-signed certificates using Elasticsearch tools. When I had an internal authority create the p12 files for me following information from the Elasticsearch… --- ## [To convert the Integers into a String](https://discuss.elastic.co/t/to-convert-the-integers-into-a-string/311936)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 2\ **Last updated:** [August 11, 2022, 7:14pm UTC](https://discuss.elastic.co/t/to-convert-the-integers-into-a-string/311936 "2022-08-11T19:14:42Z")
I have collected the metrics from a device through snmp input plugin and the field value is 0 & 1. How can I convert these values into strings (like 0 as Open, 1 as Close) in Kibana dashboards. --- ## [Issue/Error while reading data from Elastic index with Spark including Custom schema](https://discuss.elastic.co/t/issue-error-while-reading-data-from-elastic-index-with-spark-including-custom-schema/311930)
**Author:** [@ashit\_pupu](https://discuss.elastic.co/u/ashit_pupu)\ **Replies:** 1\ **Last updated:** [August 11, 2022, 7:00pm UTC](https://discuss.elastic.co/t/issue-error-while-reading-data-from-elastic-index-with-spark-including-custom-schema/311930 "2022-08-11T19:00:06Z")
I am trying the read data from a given Elasticsearch index including a custom schema while reading. The data is populated by another spark application in which the same schema is being used this has been done keeping in… --- ## [Rally: customize behaviour of each client](https://discuss.elastic.co/t/rally-customize-behaviour-of-each-client/311919)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 4\ **Last updated:** [August 11, 2022, 6:41pm UTC](https://discuss.elastic.co/t/rally-customize-behaviour-of-each-client/311919 "2022-08-11T18:41:23Z")
Hi! I have my track like this (snippet from challenges/operations) { "operation": "replay-listing-query", "clients": 4, "warmup-iterations": 10, "iterations": 100… --- ## [Adding Kibana, Fleet, Ingest node to cluster](https://discuss.elastic.co/t/adding-kibana-fleet-ingest-node-to-cluster/311958)
**Author:** [@BRosenberg](https://discuss.elastic.co/u/BRosenberg)\ **Replies:** 0\ **Last updated:** [August 11, 2022, 5:51pm UTC](https://discuss.elastic.co/t/adding-kibana-fleet-ingest-node-to-cluster/311958 "2022-08-11T17:51:39Z")
Hello. I'm attempting to add a 4th node to my cluster. Nodes: \[elastic-node-01\] \[elastic-79\] \[elastic-180\] Roles: master, data \[kibana-primary\] Roles: ingest, ml, remote\_cluster\_client, transform I'm trying to instal… --- ## [Create document with values from parent aggregation and sub aggregation](https://discuss.elastic.co/t/create-document-with-values-from-parent-aggregation-and-sub-aggregation/311954)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [August 11, 2022, 5:50pm UTC](https://discuss.elastic.co/t/create-document-with-values-from-parent-aggregation-and-sub-aggregation/311954 "2022-08-11T17:50:38Z")
Hi, Im queriyng elastic with logstash, exec input, and a bash script with curl. this is the response: "aggregations" : { "parent-agg" : { "buckets" : \[ { "key" : "one", "sub-aggs-t… --- ## [Fleet server keeps CrashLoopBackOff in Azure kubernetes](https://discuss.elastic.co/t/fleet-server-keeps-crashloopbackoff-in-azure-kubernetes/311938)
**Author:** [@levitoh123](https://discuss.elastic.co/u/levitoh123)\ **Replies:** 0\ **Last updated:** [August 11, 2022, 2:49pm UTC](https://discuss.elastic.co/t/fleet-server-keeps-crashloopbackoff-in-azure-kubernetes/311938 "2022-08-11T14:49:34Z")
I have installed ECK and elasticsearch, kibana and fleet (agents and server) via the recipe yaml files in my kubernetes cluster running in Azure (version 1.21) and the fleet server keeps crashing without staying up. The … --- ## [Endpoint for creating new user in python using Elasticsearch client](https://discuss.elastic.co/t/endpoint-for-creating-new-user-in-python-using-elasticsearch-client/311714)
**Author:** [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)\ **Replies:** 2\ **Last updated:** [August 11, 2022, 7:08am UTC](https://discuss.elastic.co/t/endpoint-for-creating-new-user-in-python-using-elasticsearch-client/311714 "2022-08-11T07:08:41Z")
I am trying to create a new user by API in flask @app.route('/create-new-user', methods=\['GET','POST'\]) def createUser(): if request.method == 'POST': username = request.form.get('username') password… --- ## [Install & configuration of live logs with logstash (docker)](https://discuss.elastic.co/t/install-configuration-of-live-logs-with-logstash-docker/311814)
**Author:** [@Dreinale](https://discuss.elastic.co/u/Dreinale)\ **Replies:** 2\ **Last updated:** [August 11, 2022, 1:43pm UTC](https://discuss.elastic.co/t/install-configuration-of-live-logs-with-logstash-docker/311814 "2022-08-11T13:43:06Z")
HI, I'm trying to install elk on the docker host and filebeat on another docker. So fo the first docker i followed that: Elasticsearch kibana & logstash with the ELK image. (i don't want security s i enabled it) I… --- ## [Need file location where can i edit elastic and logo "e" on top right corner side header bar](https://discuss.elastic.co/t/need-file-location-where-can-i-edit-elastic-and-logo-e-on-top-right-corner-side-header-bar/311918)
**Author:** [@Ayaan\_Shaik](https://discuss.elastic.co/u/Ayaan_Shaik)\ **Replies:** 3\ **Last updated:** [August 11, 2022, 1:39pm UTC](https://discuss.elastic.co/t/need-file-location-where-can-i-edit-elastic-and-logo-e-on-top-right-corner-side-header-bar/311918 "2022-08-11T13:39:23Z")
Hi Friends, Trying to find the location of a file for the header top right elastic symbol replace and "e" in /usr/share/kibana/src/......?????? where can i find this location in /usr/share/kibana ??? below is the im… --- ## [Logstash WARN: Could not index event to Elasticsearch .... Can't get text on a START\_OBJECT](https://discuss.elastic.co/t/logstash-warn-could-not-index-event-to-elasticsearch-cant-get-text-on-a-start-object/311910)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [August 11, 2022, 1:32pm UTC](https://discuss.elastic.co/t/logstash-warn-could-not-index-event-to-elasticsearch-cant-get-text-on-a-start-object/311910 "2022-08-11T13:32:46Z")
Dears, I have some problem with json. When I send json log to logstash there are many errors like this: Could not index event to Elasticsearch .... Can't get text on a START\_OBJECT at 1:670 My json log looks like: {… --- ## [Alert if index has 0 documents in last X minutes (Rules and connectors or Detection Rules)](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/311695)
**Author:** [@stoza](https://discuss.elastic.co/u/stoza)\ **Replies:** 5\ **Last updated:** [August 11, 2022, 1:30pm UTC](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/311695 "2022-08-11T13:30:06Z")
Hello everyone, I'm using kibana version 7.17.2 I work with rule and connector in order to receive an alert if I don't receive any new document in one of my index for the last X minutes. Select index: INDEX index\* WH… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=831) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=833)