# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=845 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 846 --- ## [Unique count after aggregation "painless](https://discuss.elastic.co/t/unique-count-after-aggregation-painless/311088)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 0\ **Last updated:** [August 1, 2022, 7:26am UTC](https://discuss.elastic.co/t/unique-count-after-aggregation-painless/311088 "2022-08-01T07:26:14Z")
Hello everybody, Could someone please give me an example of a unique count after an aggregation of one field using the painless scripting ? Thanks in advance Best regards --- ## [Logstash 8 @timestamp field format was changed to microseconds percision](https://discuss.elastic.co/t/logstash-8-timestamp-field-format-was-changed-to-microseconds-percision/310852)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\ **Replies:** 7\ **Last updated:** [August 1, 2022, 7:23am UTC](https://discuss.elastic.co/t/logstash-8-timestamp-field-format-was-changed-to-microseconds-percision/310852 "2022-08-01T07:23:38Z")
Hi, I have been using Logstash for a while now and when upgrading to version 8 I can see the @timestamp field format was changed from milliseconds percision to microseconds percision (meaning instead of 2022-07-28T09:46… --- ## [Kibana visualization Interval change automatic issue](https://discuss.elastic.co/t/kibana-visualization-interval-change-automatic-issue/310882)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 4\ **Last updated:** [August 1, 2022, 6:36am UTC](https://discuss.elastic.co/t/kibana-visualization-interval-change-automatic-issue/310882 "2022-08-01T06:36:19Z")
Hello All, I've selected timerange as 90 days(quick select),then applied visualization interval as \>=15m but in visualization the interval is showing per "12 hours" automatically,Note:Everytime the quick select option … --- ## [Random exits every few weeks - Native controller process has stopped - no new native processes can be started](https://discuss.elastic.co/t/random-exits-every-few-weeks-native-controller-process-has-stopped-no-new-native-processes-can-be-started/311076)
**Author:** [@wintercounter](https://discuss.elastic.co/u/wintercounter)\ **Replies:** 0\ **Last updated:** [August 1, 2022, 5:54am UTC](https://discuss.elastic.co/t/random-exits-every-few-weeks-native-controller-process-has-stopped-no-new-native-processes-can-be-started/311076 "2022-08-01T05:54:37Z")
Hi all, I'm having a single node Docker instance which stops for some reason every few weeks. I'd like to find out the root cause and how to fix it. Last few logs: 2022-07-31T01:38:00.006473091Z {"@timestamp":"2022-07… --- ## [Finding the hostname inside the javascript processor script](https://discuss.elastic.co/t/finding-the-hostname-inside-the-javascript-processor-script/311054)
**Author:** [@Saeed\_Ektesabi2](https://discuss.elastic.co/u/Saeed_Ektesabi2)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 2:36am UTC](https://discuss.elastic.co/t/finding-the-hostname-inside-the-javascript-processor-script/311054 "2022-08-01T02:36:54Z")
Hi all, I am trying to find the hostname inside the javascript script code. I tried to get it using the "os" module, but it seems that it is not available. Are there any other options to achieve this? Also, where can … --- ## [\[error\]\[savedobjects-service\] \[.kibana\_task\_manager\] Action failed with 'Request timed out'. \[savedobjects-service\] \[.kibana\_task\_manager\] REINDEX\_SOURCE\_TO\_TEMP\_INDEX\_BULK -\> REINDEX\_SOURCE\_TO\_TEMP\_INDEX\_BULK](https://discuss.elastic.co/t/error-savedobjects-service-kibana-task-manager-action-failed-with-request-timed-out-savedobjects-service-kibana-task-manager-reindex-source-to-temp-index-bulk-reindex-source-to-temp-index-bulk/311039)
**Author:** [@mujtabah](https://discuss.elastic.co/u/mujtabah)\ **Replies:** 8\ **Last updated:** [August 1, 2022, 12:25am UTC](https://discuss.elastic.co/t/error-savedobjects-service-kibana-task-manager-action-failed-with-request-timed-out-savedobjects-service-kibana-task-manager-reindex-source-to-temp-index-bulk-reindex-source-to-temp-index-bulk/311039 "2022-08-01T00:25:45Z")
Hi guys i have a running cluster with 5 nodes(3master and 2 data nodes). i have done rolling upgrade of elastic for all the 5 nodes from v7.10.0 to v7.16.2 and it was successfully upgraded and all the 5 nodes are in clu… --- ## [Logstash stuck after Restart/Stop command](https://discuss.elastic.co/t/logstash-stuck-after-restart-stop-command/310797)
**Author:** [@Oriya](https://discuss.elastic.co/u/Oriya)\ **Replies:** 2\ **Last updated:** [July 31, 2022, 9:48pm UTC](https://discuss.elastic.co/t/logstash-stuck-after-restart-stop-command/310797 "2022-07-31T21:48:30Z")
Hi, i have a logstash server (8.1.3 version) with 3 pipelines. each pipeline configure with jdbc to collect data from sql server. everything works ok until i try to execute the : "systemctl restart logstash" and it'… --- ## [Errno::EACCES: Permission denied - NUL not fixed with enableADS](https://discuss.elastic.co/t/errno-permission-denied-nul-not-fixed-with-enableads/310846)
**Author:** [@Bert\_Van\_der\_Heyden](https://discuss.elastic.co/u/Bert_Van_der_Heyden)\ **Replies:** 3\ **Last updated:** [July 31, 2022, 9:03pm UTC](https://discuss.elastic.co/t/errno-permission-denied-nul-not-fixed-with-enableads/310846 "2022-07-31T21:03:35Z")
Running logstash (latest version 8.3.2) on Windows gives me: Errno::EACCES: Permission denied - NUL sysopen at org/jruby/RubyIO.java:1237 Found out that this is a known issue and fixed with -Djdk.io.File.enableADS=tru… --- ## [Return (emit) @timestamp date value in runtime field](https://discuss.elastic.co/t/return-emit-timestamp-date-value-in-runtime-field/311001)
**Author:** [@nilei](https://discuss.elastic.co/u/nilei)\ **Replies:** 15\ **Last updated:** [July 31, 2022, 11:59am UTC](https://discuss.elastic.co/t/return-emit-timestamp-date-value-in-runtime-field/311001 "2022-07-31T11:59:12Z")
Dear all, I am trying to output the value of @timestamp in a runtime field (configured in Kibana 7.13.3). My goal is then to get only the month as display value with a modified format 'MMM'. Unfortunately, I have been u… --- ## [Composite aggregation query with bucket\_sort does not work properly](https://discuss.elastic.co/t/composite-aggregation-query-with-bucket-sort-does-not-work-properly/311055)
**Author:** [@fabiobozzo](https://discuss.elastic.co/u/fabiobozzo)\ **Replies:** 0\ **Last updated:** [July 31, 2022, 10:51am UTC](https://discuss.elastic.co/t/composite-aggregation-query-with-bucket-sort-does-not-work-properly/311055 "2022-07-31T10:51:07Z")
I have an index to store financial transactions: { "mappings": { "\_doc": { "properties": { "amount": { "type": "long" }, "currencyCode": { "type": "keyword" … --- ## [Kibana Dashboard](https://discuss.elastic.co/t/kibana-dashboard/311047)
**Author:** [@Sahil\_Bindra](https://discuss.elastic.co/u/Sahil_Bindra)\ **Replies:** 2\ **Last updated:** [July 31, 2022, 6:01am UTC](https://discuss.elastic.co/t/kibana-dashboard/311047 "2022-07-31T06:01:59Z")
Hi, I have a log like this: User content\_id ankur 879fdd7979 mohak 4345grg66 havel 1224asa34 ankur 98089rtf6 sonam 2134ssded245 tunnu 843juy566 ankur 225cc865 havel 09744qqw67 sonam 234mmk566 I want the visua… --- ## [Elasticsearch Linux User](https://discuss.elastic.co/t/elasticsearch-linux-user/311031)
**Author:** [@lucian1094](https://discuss.elastic.co/u/lucian1094)\ **Replies:** 5\ **Last updated:** [July 30, 2022, 6:04pm UTC](https://discuss.elastic.co/t/elasticsearch-linux-user/311031 "2022-07-30T18:04:33Z")
I installed an Elasticsearch on CentOS using rpm file. After install, elaticsearch user and group is created, user which can't be used to manage (start/stop/restart) elasticsearch (nologin, nonexistent). I don't want to … --- ## [Logstash not starting; error reason : Your settings are invalid](https://discuss.elastic.co/t/logstash-not-starting-error-reason-your-settings-are-invalid/310440)
**Author:** [@sanuboy](https://discuss.elastic.co/u/sanuboy)\ **Replies:** 7\ **Last updated:** [July 30, 2022, 5:36pm UTC](https://discuss.elastic.co/t/logstash-not-starting-error-reason-your-settings-are-invalid/310440 "2022-07-30T17:36:38Z")
Hi, This is the first time i am trying to setup ELK stack to read my application log files and i have been struggling to get through this issue for about two days and finally resorted to asking for help. I have illustrat… --- ## [Trying to make logstash work with multiline logs on a SIEM platform](https://discuss.elastic.co/t/trying-to-make-logstash-work-with-multiline-logs-on-a-siem-platform/310951)
**Author:** [@currybread](https://discuss.elastic.co/u/currybread)\ **Replies:** 1\ **Last updated:** [July 30, 2022, 12:49pm UTC](https://discuss.elastic.co/t/trying-to-make-logstash-work-with-multiline-logs-on-a-siem-platform/310951 "2022-07-30T12:49:23Z")
Situation: Multiline logs collected are sent to a SIEM event collector via Logstash but having issues test.log: \[5/8/22 7:31:23:546 SGT\] FFDC Exception:java.io.FileNotFoundException SourceId:com.ibm.ws.webcontaine… --- ## [How to count matched phrases with slop](https://discuss.elastic.co/t/how-to-count-matched-phrases-with-slop/311036)
**Author:** [@Daniil](https://discuss.elastic.co/u/Daniil)\ **Replies:** 0\ **Last updated:** [July 30, 2022, 9:56am UTC](https://discuss.elastic.co/t/how-to-count-matched-phrases-with-slop/311036 "2022-07-30T09:56:16Z")
Now I am using scripted similarity to count phrases in matched documents. "similarity": { "my\_scripted\_formula": { "type": "scripted", "script": {"source": "double tf = doc.freq; return query.boost \*… --- ## [Can elasticsearch-1.13.3 work with kibana-1.13.3](https://discuss.elastic.co/t/can-elasticsearch-1-13-3-work-with-kibana-1-13-3/311003)
**Author:** [@Rain\_Water](https://discuss.elastic.co/u/Rain_Water)\ **Replies:** 3\ **Last updated:** [July 30, 2022, 7:03am UTC](https://discuss.elastic.co/t/can-elasticsearch-1-13-3-work-with-kibana-1-13-3/311003 "2022-07-30T07:03:02Z")
Is kibana version 1.13.2 compatible with elasticsearch 1.13.3 can both work together with different version? --- ## [Docker Heap Dump](https://discuss.elastic.co/t/docker-heap-dump/309240)
**Author:** [@Stef\_Nestor](https://discuss.elastic.co/u/Stef_Nestor)\ **Replies:** 1\ **Last updated:** [July 30, 2022, 2:12am UTC](https://discuss.elastic.co/t/docker-heap-dump/309240 "2022-07-30T02:12:56Z")
:wave:, howdy! How do you grab an ES Docker heap dump? From basic setup: $ docker run -it -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:7.17.0 $ docker exec -it… --- ## [Filebeat not logging hints.enabled container logs](https://discuss.elastic.co/t/filebeat-not-logging-hints-enabled-container-logs/310574)
**Author:** [@dev4elasticapm](https://discuss.elastic.co/u/dev4elasticapm)\ **Replies:** 3\ **Last updated:** [July 30, 2022, 1:19am UTC](https://discuss.elastic.co/t/filebeat-not-logging-hints-enabled-container-logs/310574 "2022-07-30T01:19:06Z")
Hi, I am using ECK, I have configured filebeat with two options hints.enabled: true, which looks for all the containers with co.elastic.logs/enabled: "true" Checks the container containing name ingress. #2 is workin… --- ## [Where is the elastic community team?](https://discuss.elastic.co/t/where-is-the-elastic-community-team/311022)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [July 29, 2022, 11:25pm UTC](https://discuss.elastic.co/t/where-is-the-elastic-community-team/311022 "2022-07-29T23:25:21Z")
where is the elastic comunity team ?I asked a question and any response .... --- ## [Using Scripted field to display a sub-string](https://discuss.elastic.co/t/using-scripted-field-to-display-a-sub-string/310798)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 6\ **Last updated:** [July 29, 2022, 8:18pm UTC](https://discuss.elastic.co/t/using-scripted-field-to-display-a-sub-string/310798 "2022-07-29T20:18:55Z")
Hello. We are using ELK 7.6.2 stack. I have a field named host.name which displays a value such as ad-c2ff-v2bg.taz.root.net I need to extract the second substring (taz) using Scripted field. When I try to define a n… --- ## [Change Elastic Agent GRPC port via Environment Variable?](https://discuss.elastic.co/t/change-elastic-agent-grpc-port-via-environment-variable/311014)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [July 29, 2022, 7:47pm UTC](https://discuss.elastic.co/t/change-elastic-agent-grpc-port-via-environment-variable/311014 "2022-07-29T19:47:56Z")
Hi All, I was wonder if there is a way to change the GRPC port the Elastic Agent uses via an environment variable. Use case: I have a Kubernetes cluster that runs with a complete underlying OS, because of this, I run … --- ## [Alert reconfiguration](https://discuss.elastic.co/t/alert-reconfiguration/310957)
**Author:** [@escanor\_sama](https://discuss.elastic.co/u/escanor_sama)\ **Replies:** 4\ **Last updated:** [July 29, 2022, 7:31pm UTC](https://discuss.elastic.co/t/alert-reconfiguration/310957 "2022-07-29T19:31:10Z")
Hi everyone, hope you’re doing well I have a small question kind of weird. When we upgrade our stack from 6.5.4 to 8.2. Do I need to do something for the alerts? to use them in the new version thank youuu --- ## [Force a synchronous refresh when updating documents](https://discuss.elastic.co/t/force-a-synchronous-refresh-when-updating-documents/311012)
**Author:** [@sz\_bb](https://discuss.elastic.co/u/sz_bb)\ **Replies:** 0\ **Last updated:** [July 29, 2022, 6:30pm UTC](https://discuss.elastic.co/t/force-a-synchronous-refresh-when-updating-documents/311012 "2022-07-29T18:30:02Z")
As is well-documented, Elastic provides "near real-time search capabilities". My data is typically ingested with through the Bulk API and we use a 30 second refresh interval as the data typically does not need to be avai… --- ## [Could not index event to Elasticsearch due to opType: \[-1\]](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-due-to-optype-1/311010)
**Author:** [@co88liwan](https://discuss.elastic.co/u/co88liwan)\ **Replies:** 0\ **Last updated:** [July 29, 2022, 5:41pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-due-to-optype-1/311010 "2022-07-29T17:41:48Z")
Hi all, We encountered a transient issue with the \[WARN\] said: Could not index event to Elasticsearch From the log, the response is like :response =\> {"create"=\>{"\_index"=\>"zzzzzzzzzz"}, "\_type"=\>"\_doc", "\_id"=\>"xxxx… --- ## [Speed of dense vector search with 512 or more dimensions](https://discuss.elastic.co/t/speed-of-dense-vector-search-with-512-or-more-dimensions/307121)
**Author:** [@telunyang](https://discuss.elastic.co/u/telunyang)\ **Replies:** 7\ **Last updated:** [July 29, 2022, 5:43pm UTC](https://discuss.elastic.co/t/speed-of-dense-vector-search-with-512-or-more-dimensions/307121 "2022-07-29T17:43:37Z")
Hi Team, Reading the article Introducing approximate nearest neighbor search in Elasticsearch 8.0 is very useful to our lab for building an Elasticsearch service, so I would like to consult you on how to speed up our qu… --- ## [Illegal\_argument\_exception when searching with scroll in new elasticserach java client](https://discuss.elastic.co/t/illegal-argument-exception-when-searching-with-scroll-in-new-elasticserach-java-client/310970)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 2\ **Last updated:** [July 29, 2022, 5:02pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-when-searching-with-scroll-in-new-elasticserach-java-client/310970 "2022-07-29T17:02:54Z")
What is the correct syntax when building a search request with scroll. I did this but I get an exception final co.elastic.clients.elasticsearch.core.SearchRequest req = rbuilder .index(indexPref… --- ## [LEEF Input Plugin](https://discuss.elastic.co/t/leef-input-plugin/311008)
**Author:** [@sta02](https://discuss.elastic.co/u/sta02)\ **Replies:** 0\ **Last updated:** [July 29, 2022, 4:44pm UTC](https://discuss.elastic.co/t/leef-input-plugin/311008 "2022-07-29T16:44:32Z")
Hello, I am looking for LEEF Input plugin for Logstash. How can I configure Logstash to consume events in LEEF format sent over syslog. Please advise. -- Thanks, Siddarth --- ## [How to create Custom Endpoints with an API?](https://discuss.elastic.co/t/how-to-create-custom-endpoints-with-an-api/311004)
**Author:** [@rcorfield](https://discuss.elastic.co/u/rcorfield)\ **Replies:** 0\ **Last updated:** [July 29, 2022, 4:36pm UTC](https://discuss.elastic.co/t/how-to-create-custom-endpoints-with-an-api/311004 "2022-07-29T16:36:50Z")
Hi I've created custom endpoints for my ECE cluster via the Cloud UI using the guidance here: However in future I'd like to use an API call, or some other programmatic method (writing config files directly?). Can some… --- ## [Filebeat won't create custom indices](https://discuss.elastic.co/t/filebeat-wont-create-custom-indices/310988)
**Author:** [@issy](https://discuss.elastic.co/u/issy)\ **Replies:** 1\ **Last updated:** [July 29, 2022, 4:18pm UTC](https://discuss.elastic.co/t/filebeat-wont-create-custom-indices/310988 "2022-07-29T16:18:42Z")
I'm trying to have custom indices for different filebeat modules. In this example i want to have a custom indices for the apache module, but it doesn't seem to work. indices: - index: "filebeat-%{\[agent.version\]}-apac… --- ## [Elasticsearch v8 Java API client adding index settings](https://discuss.elastic.co/t/elasticsearch-v8-java-api-client-adding-index-settings/310888)
**Author:** [@ijaxahmed](https://discuss.elastic.co/u/ijaxahmed)\ **Replies:** 4\ **Last updated:** [July 29, 2022, 3:42pm UTC](https://discuss.elastic.co/t/elasticsearch-v8-java-api-client-adding-index-settings/310888 "2022-07-29T15:42:32Z")
How to set index setting while creation using Elasticsearch v8 Java API client. I can able to set numberOfShards and numberOfReplicas using below syntax but could not able to set analysis due to confusing builder syntax. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=844) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=846)