# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=834 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 835 --- ## [Nested search works not as expected](https://discuss.elastic.co/t/nested-search-works-not-as-expected/311841)
**Author:** [@wegad61878](https://discuss.elastic.co/u/wegad61878)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 2:17pm UTC](https://discuss.elastic.co/t/nested-search-works-not-as-expected/311841 "2022-08-10T14:17:57Z")
Hello, I have the following documents \[ { "id": "Car#1", "accessories": \[ { "type": "Turbo", "price": 20 }, { "type": "Supercharger", "price": 30 } … --- ## [Security on index level](https://discuss.elastic.co/t/security-on-index-level/311831)
**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 2:16pm UTC](https://discuss.elastic.co/t/security-on-index-level/311831 "2022-08-10T14:16:33Z")
Hi Is it possible to create security on index level, so access to an index is role based controlled, instead of setting security on all documents in an index? /Casper --- ## [Lots of open ports and traffic towards elasticsearch](https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 2:09pm UTC](https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835 "2022-08-10T14:09:08Z")
I have logstash, kibana on one server and another one runs elasticsearch. I have three open pipelines collecting logfile data. I noticed a lot of open ports (277 established TCP connections in the range 45000 - 55000). … --- ## [Elastic Search Queries](https://discuss.elastic.co/t/elastic-search-queries/311764)
**Author:** [@Aravind1](https://discuss.elastic.co/u/Aravind1)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 1:51pm UTC](https://discuss.elastic.co/t/elastic-search-queries/311764 "2022-08-10T13:51:29Z")
Hi, We are having a few queries on Elasticsearch logs optimization, We want to see the breakup of logs in each running resource also we have quires on how to analyze the logs based on the storage utilization and how man… --- ## [Can dynamic mapping templates block a particular field from being mapped?](https://discuss.elastic.co/t/can-dynamic-mapping-templates-block-a-particular-field-from-being-mapped/311837)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 1:45pm UTC](https://discuss.elastic.co/t/can-dynamic-mapping-templates-block-a-particular-field-from-being-mapped/311837 "2022-08-10T13:45:41Z")
I have an index template set to "dynamic": "enable", which causes all fields to be added into the mapping. But what if there are fields that I explicitely do not want to be mapped? I know that dynamic templates can chan… --- ## [Elastic cluster nodes in different subnet](https://discuss.elastic.co/t/elastic-cluster-nodes-in-different-subnet/311771)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 1:40pm UTC](https://discuss.elastic.co/t/elastic-cluster-nodes-in-different-subnet/311771 "2022-08-10T13:40:38Z")
If I setup data node in X network subnet and master in Y subnet will it give me grief? all systems will have 10x2 = 20gig bonded network. They are not in different zone. Same datacenter just different subnet. --- ## [Shard allocation filtering for replications](https://discuss.elastic.co/t/shard-allocation-filtering-for-replications/311813)
**Author:** [@Pieter\_Agenbag](https://discuss.elastic.co/u/Pieter_Agenbag)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 1:37pm UTC](https://discuss.elastic.co/t/shard-allocation-filtering-for-replications/311813 "2022-08-10T13:37:36Z")
Hi i was wondering if there was a way to route replicas to specific nodes in a cluster in the same way you can do shards with the allocation filtering. ?? My scenario is : I have a server with two blades in - each blad… --- ## [I want tooltip results on click not on hover](https://discuss.elastic.co/t/i-want-tooltip-results-on-click-not-on-hover/311800)
**Author:** [@Ritikapawar](https://discuss.elastic.co/u/Ritikapawar)\ **Replies:** 5\ **Last updated:** [August 10, 2022, 1:30pm UTC](https://discuss.elastic.co/t/i-want-tooltip-results-on-click-not-on-hover/311800 "2022-08-10T13:30:13Z")
I'm visualizing Maps on kibana dashboard. in which I get particular results for pointer on mouse hover. I want to get the results on click how I can do that? --- ## [Unable to Vizualize Documents with Dates](https://discuss.elastic.co/t/unable-to-vizualize-documents-with-dates/311762)
**Author:** [@jhop](https://discuss.elastic.co/u/jhop)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 1:23pm UTC](https://discuss.elastic.co/t/unable-to-vizualize-documents-with-dates/311762 "2022-08-10T13:23:09Z")
I am having trouble visualizing indices with dates in Kibana. It appears I am entering data correctly since I see the data when I do a GET request. However, I cannot visualize it after I create a data view. Kibana see… --- ## [Cannot cast def \[java.lang.String\] to boolean](https://discuss.elastic.co/t/cannot-cast-def-java-lang-string-to-boolean/311824)
**Author:** [@Sourabh\_Korde](https://discuss.elastic.co/u/Sourabh_Korde)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 1:12pm UTC](https://discuss.elastic.co/t/cannot-cast-def-java-lang-string-to-boolean/311824 "2022-08-10T13:12:18Z")
Dear All, I am simply trying to update documents using ingest pipeline with below script. But facing subjected error. Please suggest.... { "script": { "lang": "painless", "source": """ if(ctx.customer\_gender = "MAL… --- ## [Logstash conf file will not work after filter section is added](https://discuss.elastic.co/t/logstash-conf-file-will-not-work-after-filter-section-is-added/311770)
**Author:** [@Lori\_Wallace](https://discuss.elastic.co/u/Lori_Wallace)\ **Replies:** 6\ **Last updated:** [August 10, 2022, 1:02pm UTC](https://discuss.elastic.co/t/logstash-conf-file-will-not-work-after-filter-section-is-added/311770 "2022-08-10T13:02:28Z")
I am trying to ingest logs from a checkpoint firewall. My logstash config file checks out and works as long as I don't have the filter section in it. However, I need the data filtered so can you guys help me figure out w… --- ## [Logstash 6.8.23 Cannot put data into elastic index, mapping issue](https://discuss.elastic.co/t/logstash-6-8-23-cannot-put-data-into-elastic-index-mapping-issue/310940)
**Author:** [@Akhil\_Chandran](https://discuss.elastic.co/u/Akhil_Chandran)\ **Replies:** 8\ **Last updated:** [August 10, 2022, 12:59pm UTC](https://discuss.elastic.co/t/logstash-6-8-23-cannot-put-data-into-elastic-index-mapping-issue/310940 "2022-08-10T12:59:26Z")
HI, I am trying to pass data from logstash to ES index, but it throws error as shown below 2022-07-28T10:28:17,909\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\[… --- ## [Setup container doesnt print All done and shut down like it is suppose to on Website](https://discuss.elastic.co/t/setup-container-doesnt-print-all-done-and-shut-down-like-it-is-suppose-to-on-website/311772)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 12:50pm UTC](https://discuss.elastic.co/t/setup-container-doesnt-print-all-done-and-shut-down-like-it-is-suppose-to-on-website/311772 "2022-08-10T12:50:03Z")
I was looking at the YAML file for setting up a 3 node cluster on this website: Install Elasticsearch with Docker | Elasticsearch Guide \[8.3\] | Elastic For posterity, I will add my .env and the actual docker-compose bel… --- ## [Substract two time fields in index pattern](https://discuss.elastic.co/t/substract-two-time-fields-in-index-pattern/311580)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 12:15pm UTC](https://discuss.elastic.co/t/substract-two-time-fields-in-index-pattern/311580 "2022-08-10T12:15:38Z")
Hello dears I have an instance of heartbeat that check all of certificates of my websites. every log looks like this: { "\_index": "heartbeat-7.16.2-2022.08.01-000001", "\_type": "\_doc", "\_score": 1, "\_source": {… --- ## [Can Kibana do this?](https://discuss.elastic.co/t/can-kibana-do-this/311337)
**Author:** [@Va1-ha11a](https://discuss.elastic.co/u/Va1-ha11a)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 12:14pm UTC](https://discuss.elastic.co/t/can-kibana-do-this/311337 "2022-08-10T12:14:26Z")
I'm new to Elastic and Kibana. I've been tasked with investigating Kibana as a solution for our system uptime reporting. Our Elastic 7 logs state codes for our system, where up =1, down =2 etc. every two minutes. For rep… --- ## [Unsupported Media Type when calling import API](https://discuss.elastic.co/t/unsupported-media-type-when-calling-import-api/311742)
**Author:** [@Martin\_Hartmann](https://discuss.elastic.co/u/Martin_Hartmann)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 11:19am UTC](https://discuss.elastic.co/t/unsupported-media-type-when-calling-import-api/311742 "2022-08-10T11:19:51Z")
Hi. We run Kibana in v 7.17.3 and when calling the /api/saved\_objects/\_imports API, we get a 415 - Unsupported Media Type error as response for some clients. Our go client doesn't work: REQUEST: POST /api/saved\_objects/… --- ## [Unable to update the index.mapping.total\_fields.limit value](https://discuss.elastic.co/t/unable-to-update-the-index-mapping-total-fields-limit-value/311795)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 10:22am UTC](https://discuss.elastic.co/t/unable-to-update-the-index-mapping-total-fields-limit-value/311795 "2022-08-10T10:22:37Z")
We are trying to poll the data from a device (PDU) through SNMP Input Plugin. The device MIB file has been imported to ELK logstash, as per SNMP input plugin | Logstash Reference \[8.3\] | Elastic. When executing the snmp… --- ## [Kibana search d](https://discuss.elastic.co/t/kibana-search-d/311809)
**Author:** [@cihady](https://discuss.elastic.co/u/cihady)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 9:06am UTC](https://discuss.elastic.co/t/kibana-search-d/311809 "2022-08-10T09:06:13Z")
I am searching for specific text in my logs text is $2a$10$Ltijvm9V in KQL search I wrote message.keyword : "$2a$10$Ltijvm9V2eA" it returns nothing and says expand your time rang but before search I can see the text. … --- ## [Out of mem on during moving data from warm to cold tier](https://discuss.elastic.co/t/out-of-mem-on-during-moving-data-from-warm-to-cold-tier/311769)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 6\ **Last updated:** [August 10, 2022, 9:27am UTC](https://discuss.elastic.co/t/out-of-mem-on-during-moving-data-from-warm-to-cold-tier/311769 "2022-08-10T09:27:54Z")
I'm facing a few times data nodes crash under moving data index from data warm tier to data cold tier. My memory config on data warm tier is 8GB which is implies 4GB of heap size due to Elasticsearch auto config but on… --- ## [Why does the must\_not query work if you place it before a nested query but not if you place it inside the nested query?](https://discuss.elastic.co/t/why-does-the-must-not-query-work-if-you-place-it-before-a-nested-query-but-not-if-you-place-it-inside-the-nested-query/311748)
**Author:** [@Vincent92](https://discuss.elastic.co/u/Vincent92)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 2:34pm UTC](https://discuss.elastic.co/t/why-does-the-must-not-query-work-if-you-place-it-before-a-nested-query-but-not-if-you-place-it-inside-the-nested-query/311748 "2022-08-09T14:34:32Z")
Hello, I'm writing an application to search for logs in the elastic of my organization and the user can search for nested queries of this form: pathName:{ field1: "value1" AND field2: "value2" OR field3: "value3" } I … --- ## [To control the log flows in kibana end through logstash config](https://discuss.elastic.co/t/to-control-the-log-flows-in-kibana-end-through-logstash-config/310499)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 16\ **Last updated:** [August 10, 2022, 8:57am UTC](https://discuss.elastic.co/t/to-control-the-log-flows-in-kibana-end-through-logstash-config/310499 "2022-08-10T08:57:32Z")
HI team, We have getting the huge logs when application team doing the Performance testing. At that time, Our cluster is not stable due to unable to handle the huge much of load. Could you please help us to control the… --- ## [Integrations don't send data](https://discuss.elastic.co/t/integrations-dont-send-data/311650)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 8:47am UTC](https://discuss.elastic.co/t/integrations-dont-send-data/311650 "2022-08-10T08:47:33Z")
Hi I'm using elk stack 8.3 I have a problem with Tomcat integrations ver 1.5.0. I collect logs from file and elastic agent don't send data from tomcat log. I don't use fleet. Logs from the same agent for /var/log/sys… --- ## [Field was not found](https://discuss.elastic.co/t/field-was-not-found/311487)
**Author:** [@Dreinale](https://discuss.elastic.co/u/Dreinale)\ **Replies:** 10\ **Last updated:** [August 10, 2022, 7:54am UTC](https://discuss.elastic.co/t/field-was-not-found/311487 "2022-08-10T07:54:48Z")
Hi, I try to install & configure elk 8.3.3 without security on the docker "host" and filebeat on another docker. All works, i have the live logs, i imported my dashboards, but i have this: and the problem is because… --- ## [How to use aggregation fields in Watcher action body (with foreach loop)?](https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758)
**Author:** [@111238](https://discuss.elastic.co/u/111238)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 8:20am UTC](https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758 "2022-08-10T08:20:17Z")
Hi there. I'm currently trying to create a watcher with foreach loop (per aggregation bucket). The actual loop works fine. Though, I have a problem accessing "ctx.payload.aggregations." to include a specific field from… --- ## [Elasticsearch returns two documents with same ID but different versions](https://discuss.elastic.co/t/elasticsearch-returns-two-documents-with-same-id-but-different-versions/311802)
**Author:** [@Andrey\_Tyutyunov](https://discuss.elastic.co/u/Andrey_Tyutyunov)\ **Replies:** 11\ **Last updated:** [August 10, 2022, 8:13am UTC](https://discuss.elastic.co/t/elasticsearch-returns-two-documents-with-same-id-but-different-versions/311802 "2022-08-10T08:13:59Z")
ES version: 5.3.1 Some documents returns twice, updated and previous version rq /purchases/payments/\_search?q=\_id:AYKCmqWVUjd1dFdxujwy&version=true Why it happens? How to fix it? --- ## [Migrate from beats to elastic-agent](https://discuss.elastic.co/t/migrate-from-beats-to-elastic-agent/311538)
**Author:** [@dounia](https://discuss.elastic.co/u/dounia)\ **Replies:** 15\ **Last updated:** [August 10, 2022, 8:00am UTC](https://discuss.elastic.co/t/migrate-from-beats-to-elastic-agent/311538 "2022-08-10T08:00:44Z")
Hello , can we replace Filebeat and Metricbeat in Elastic agent by beats (already exists filebeat and metricbeat) --- ## [Ndjson.expand\_keys doesn't seem to work](https://discuss.elastic.co/t/ndjson-expand-keys-doesnt-seem-to-work/311289)
**Author:** [@andreycha](https://discuss.elastic.co/u/andreycha)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 7:44am UTC](https://discuss.elastic.co/t/ndjson-expand-keys-doesnt-seem-to-work/311289 "2022-08-10T07:44:33Z")
Hi, My application produces logs in ECS format where loggers write log level as a flat field "log.level". I use Filebeat 7.17.5 to ship logs into Elasticsearch. As stated in the documentation I set ndjson.expand\_keys to… --- ## [System index responsible for \_cat/shards](https://discuss.elastic.co/t/system-index-responsible-for-cat-shards/311678)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 7\ **Last updated:** [August 10, 2022, 7:36am UTC](https://discuss.elastic.co/t/system-index-responsible-for-cat-shards/311678 "2022-08-10T07:36:36Z")
Can anyone tell me which indices are responsible for the data pulled in when using the \_cat/shards API? --- ## [Do i have to make user and role in kibana?](https://discuss.elastic.co/t/do-i-have-to-make-user-and-role-in-kibana/311801)
**Author:** [@hellocomputer](https://discuss.elastic.co/u/hellocomputer)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 7:23am UTC](https://discuss.elastic.co/t/do-i-have-to-make-user-and-role-in-kibana/311801 "2022-08-10T07:23:09Z")
Hello! I'm using ELK stack 8.3.2 version and ubuntu20.04 version. I want to know that I have to make user in kibana? First, I tried to https SSL security in elasticsearch, kibana. But I couldn't make trusted cert fil… --- ## [Elasticsearch - Could not index event to Elasticsearch status=\>400](https://discuss.elastic.co/t/elasticsearch-could-not-index-event-to-elasticsearch-status-400/311101)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 6:38am UTC](https://discuss.elastic.co/t/elasticsearch-could-not-index-event-to-elasticsearch-status-400/311101 "2022-08-10T06:38:35Z")
We are trying to poll the data from a device (PDU) through SNMP Input Plugin. The device MIB file has been imported to ELK logstash, as per SNMP input plugin | Logstash Reference \[8.3\] | Elastic. When executing the snmp… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=833) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=835)