# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=858 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 859 --- ## [Top\_metric for Geo\_Point](https://discuss.elastic.co/t/top-metric-for-geo-point/310164)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 2:15pm UTC](https://discuss.elastic.co/t/top-metric-for-geo-point/310164 "2022-07-20T14:15:50Z")
Hi, In the Transform examples we can find the top\_metrics aggregation. Here is an example: POST \_transform/\_preview { "source": { "index": "kibana\_sample\_data\_ecommerce" }, "pivot": { "group\_by": { … --- ## [Average per day for a period](https://discuss.elastic.co/t/average-per-day-for-a-period/308942)
**Author:** [@Igor-lkm](https://discuss.elastic.co/u/Igor-lkm)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 12:53pm UTC](https://discuss.elastic.co/t/average-per-day-for-a-period/308942 "2022-07-20T12:53:20Z")
Hello, I have a quite simple aggregation to get sum and average total price for a period (1 day, 7 days, 30 days etc.) from my index. That works quite good. Aggregation for 30 days looks like this: { "size": 10000, … --- ## [Replace a value to another value logstash](https://discuss.elastic.co/t/replace-a-value-to-another-value-logstash/310129)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 12:47pm UTC](https://discuss.elastic.co/t/replace-a-value-to-another-value-logstash/310129 "2022-07-20T12:47:42Z")
Hello, i have a log with an id. In another file, i have list file of the id mapping. for example id 1 has a name, description, etc in the list file. I want to replace the id in that log to the data in the list file. Log… --- ## [Pipeline containsKey check fails when top-level object does not exist](https://discuss.elastic.co/t/pipeline-containskey-check-fails-when-top-level-object-does-not-exist/310130)
**Author:** [@SecretSquizza](https://discuss.elastic.co/u/SecretSquizza)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 12:34pm UTC](https://discuss.elastic.co/t/pipeline-containskey-check-fails-when-top-level-object-does-not-exist/310130 "2022-07-20T12:34:58Z")
Hi everyone! I'm struggling to find an answer to this issue and i keep receiving the error Cannot invoke "Object.getClass()" because "value" is null The problem occurs when I have an object - in this case error - th… --- ## [Include Fields in Watcher Email Alert](https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/309821)
**Author:** [@rshetty89](https://discuss.elastic.co/u/rshetty89)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 12:33pm UTC](https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/309821 "2022-07-20T12:33:45Z")
From the below API output of my watcher i can only include {{ctx.metadata.name}} in email subject and body . If i try to include any other feild such as {{ctx.payload.hits.total}},{{ctx.metadata.name.xpack.type}} , {{#c… --- ## [Format array object in watcher email body](https://discuss.elastic.co/t/format-array-object-in-watcher-email-body/310080)
**Author:** [@rshetty89](https://discuss.elastic.co/u/rshetty89)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 12:30pm UTC](https://discuss.elastic.co/t/format-array-object-in-watcher-email-body/310080 "2022-07-20T12:30:32Z")
HI, I have an array as output of watcher and i need to include this array in watcher body. the result sample of my wathcer is as follows. . . . . "payload": { "results": \[ { "value": 319… --- ## [Where can I find the docs on "question\_answering"?](https://discuss.elastic.co/t/where-can-i-find-the-docs-on-question-answering/310060)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 12:13pm UTC](https://discuss.elastic.co/t/where-can-i-find-the-docs-on-question-answering/310060 "2022-07-20T12:13:51Z")
Hi All, Elasticsearch added question\_answering in 8.3, but I can't seem to find any documentation on how to use/test it. I've looked here: Natural language processing | Machine Learning in the Elastic Stack \[8.3\] | Elas… --- ## [Set cluster name when creating connection | ES 8.2.3](https://discuss.elastic.co/t/set-cluster-name-when-creating-connection-es-8-2-3/310139)
**Author:** [@Akshat\_Gupta](https://discuss.elastic.co/u/Akshat_Gupta)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 12:10pm UTC](https://discuss.elastic.co/t/set-cluster-name-when-creating-connection-es-8-2-3/310139 "2022-07-20T12:10:07Z")
How to set cluster name in new ES 8.2.3 java API ? Earlier I was using: private Client client = new PreBuiltTransportClient(Settings.builder().put("cluster.name", esClusterName).build()).addTransportAddress(new Transpo… --- ## [Ilm policy error](https://discuss.elastic.co/t/ilm-policy-error/310135)
**Author:** [@HeTvaM](https://discuss.elastic.co/u/HeTvaM)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 11:36am UTC](https://discuss.elastic.co/t/ilm-policy-error/310135 "2022-07-20T11:36:58Z")
I have been trying to set up ilm policy for my indexes for several weeks now. I use filebeat in conjunction with logstash and my indexes end up being created every day. An example of my index name: 'filebeat-7.7.1-2022… --- ## [How to add suggestion inside term query in DSL](https://discuss.elastic.co/t/how-to-add-suggestion-inside-term-query-in-dsl/309893)
**Author:** [@sim\_elastic](https://discuss.elastic.co/u/sim_elastic)\ **Replies:** 6\ **Last updated:** [July 20, 2022, 8:51am UTC](https://discuss.elastic.co/t/how-to-add-suggestion-inside-term-query-in-dsl/309893 "2022-07-20T08:51:06Z")
My DOc is below \[ {'id':1, 'name': 'sachin messi', 'description': 'football@football.com', 'type': 'football', 'var':'sports'}, {'id':2, 'name': 'lionel messi', 'description': 'messi@fifa.com','type': 'soccer','var':'sp… --- ## [IO processing speed requirements for Elastic product line](https://discuss.elastic.co/t/io-processing-speed-requirements-for-elastic-product-line/310108)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 5\ **Last updated:** [July 20, 2022, 9:47am UTC](https://discuss.elastic.co/t/io-processing-speed-requirements-for-elastic-product-line/310108 "2022-07-20T09:47:41Z")
We are considering moving Elasticsearch from vsan to fnas or synology nas. We are thinking that the IO processing speed will be reduced, but how much is the impact? Or are there any hardware requirements for IO process… --- ## [How to set node.roles for a coordinating only node via environment variable?](https://discuss.elastic.co/t/how-to-set-node-roles-for-a-coordinating-only-node-via-environment-variable/307860)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 9:30am UTC](https://discuss.elastic.co/t/how-to-set-node-roles-for-a-coordinating-only-node-via-environment-variable/307860 "2022-07-20T09:30:57Z")
Same as in: (unanswered and closed) question here: Problem with node.roles on latest Elasticsearch docker (7.11.0) question (with an unsatisfying answer) on SO: How to set default value while using env in elasticsearc… --- ## [Set alert based on Visualization](https://discuss.elastic.co/t/set-alert-based-on-visualization/307494)
**Author:** [@mmartinez](https://discuss.elastic.co/u/mmartinez)\ **Replies:** 19\ **Last updated:** [July 20, 2022, 8:37am UTC](https://discuss.elastic.co/t/set-alert-based-on-visualization/307494 "2022-07-20T08:37:31Z")
Hi, We have created a lens visualization for showing the apdex score of APM traces and we would like to create an alert based on that score. Our knowledge in alerting and monitoring is still limited and we haven't found… --- ## [Beats connection to elasticsearch](https://discuss.elastic.co/t/beats-connection-to-elasticsearch/309701)
**Author:** [@Amiya\_Pani](https://discuss.elastic.co/u/Amiya_Pani)\ **Replies:** 8\ **Last updated:** [July 20, 2022, 8:30am UTC](https://discuss.elastic.co/t/beats-connection-to-elasticsearch/309701 "2022-07-20T08:30:07Z")
I am trying to start a filebeat on docker to point the output to elasticsearch which is on same docker. While giving the command docker run docker.elastic.co/beats/filebeat:8.3.2 setup -E setup.kibana.host=192.168.0.109… --- ## [Stats endpoints response slow](https://discuss.elastic.co/t/stats-endpoints-response-slow/310062)
**Author:** [@scroodj](https://discuss.elastic.co/u/scroodj)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 8:27am UTC](https://discuss.elastic.co/t/stats-endpoints-response-slow/310062 "2022-07-20T08:27:12Z")
Elasticsearch: 7.5.1 Infrastructure: Azure AKS Storage: Standard SSD \_cat/nodes name m role ip ramMax ramPercent ramCurrent heapMax heapPercent heapCurrent diskTotal diskUsed cpu uptime iic… --- ## [Type join,Why do you get no data over 80, but you can get data over 100](https://discuss.elastic.co/t/type-join-why-do-you-get-no-data-over-80-but-you-can-get-data-over-100/310109)
**Author:** [@yangyu](https://discuss.elastic.co/u/yangyu)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 8:18am UTC](https://discuss.elastic.co/t/type-join-why-do-you-get-no-data-over-80-but-you-can-get-data-over-100/310109 "2022-07-20T08:18:38Z")
Elasticsearch Version 7.17.4 Installed Plugins analysis-ik,analysis-pinyin,analysis-stconvert Java Version 1.8.0\_331-b09 OS Version MacBook-Pro.local 21.5.0 Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:37 PDT 2022; … --- ## [After upgrading kibana to 8.2.3 i can only see audit logs on stack monitoring](https://discuss.elastic.co/t/after-upgrading-kibana-to-8-2-3-i-can-only-see-audit-logs-on-stack-monitoring/309860)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 8:10am UTC](https://discuss.elastic.co/t/after-upgrading-kibana-to-8-2-3-i-can-only-see-audit-logs-on-stack-monitoring/309860 "2022-07-20T08:10:51Z")
Hello guys, Previously i had my elastic stack working on 7.16.3 version and recently i have upgraded to 8.2.3. I had my stack monitoring working well on the previous version, i could see "info", "warn" and "error" log l… --- ## [Elasticsearch - filter index on aggregated field](https://discuss.elastic.co/t/elasticsearch-filter-index-on-aggregated-field/310105)
**Author:** [@Julynell](https://discuss.elastic.co/u/Julynell)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 8:00am UTC](https://discuss.elastic.co/t/elasticsearch-filter-index-on-aggregated-field/310105 "2022-07-20T08:00:48Z")
Hi, We could use your help. We have Elasticsearch with logstash. It is inserting data in elastic index from a jdbc source. In logstash we use an aggregate filter. The config looks like this: input { jdbc { … --- ## [Problems using multiline configurations](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991)
**Author:** [@Hkh9966](https://discuss.elastic.co/u/Hkh9966)\ **Replies:** 4\ **Last updated:** [July 20, 2022, 8:06am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991 "2022-07-20T08:06:33Z")
hello guys! I would like to ask a question about multi-line merging. I tried to test using the example provided by the official, but it didn't work.This is the link : Manage multiline messages | Filebeat Reference \[8.3\]… --- ## [Adding fields based on match](https://discuss.elastic.co/t/adding-fields-based-on-match/310094)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 6:53am UTC](https://discuss.elastic.co/t/adding-fields-based-on-match/310094 "2022-07-20T06:53:04Z")
Hi All, I have the following scenario: 1 index containing json fields. I need to match Event1\_fieldA to Event2\_fieldB. If there is a match, add additional existing field from Event2 to Event1. How would I achieve t… --- ## [Metricbeat restart with server](https://discuss.elastic.co/t/metricbeat-restart-with-server/309910)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 7:50am UTC](https://discuss.elastic.co/t/metricbeat-restart-with-server/309910 "2022-07-20T07:50:36Z")
Hello Experts, I am a beginner in Elasticsearch. I want to register Metricbeat as service (not sure if it should be called as a service ) on Linux. I have instlled Metricbeat and ran it in background using "./Metricbe… --- ## [Kibana not installing on Ubuntu Server](https://discuss.elastic.co/t/kibana-not-installing-on-ubuntu-server/309988)
**Author:** [@Ronald\_Chinomona](https://discuss.elastic.co/u/Ronald_Chinomona)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 7:50am UTC](https://discuss.elastic.co/t/kibana-not-installing-on-ubuntu-server/309988 "2022-07-20T07:50:27Z")
I have been trying to install Kibana on Ubuntu Server for the last two days. The package unpacking progress just gets stuck on 20%. I have tried on different VM's with different specs. I have made sure there is enough me… --- ## [Logstash to Logstash enable security SSL](https://discuss.elastic.co/t/logstash-to-logstash-enable-security-ssl/310103)
**Author:** [@thahgr](https://discuss.elastic.co/u/thahgr)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 7:49am UTC](https://discuss.elastic.co/t/logstash-to-logstash-enable-security-ssl/310103 "2022-07-20T07:49:28Z")
Logstash to logstash, how can we enable SSL communication with http out -\> http in plugins ? for the moment , unsecured, the two instances as below work fine output { http { url =\> "the url" http\_m… --- ## [How to see Snapshot storage?](https://discuss.elastic.co/t/how-to-see-snapshot-storage/310083)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 7:19am UTC](https://discuss.elastic.co/t/how-to-see-snapshot-storage/310083 "2022-07-20T07:19:07Z")
Hi Team, is there a way to see my snapshot(full cluster) storage? So that I can know how many memory it consumed every time I take snapshot. --- ## [Logstash pipeline grok issue with regex](https://discuss.elastic.co/t/logstash-pipeline-grok-issue-with-regex/308252)
**Author:** [@Sharon\_Hacham](https://discuss.elastic.co/u/Sharon_Hacham)\ **Replies:** 24\ **Last updated:** [July 20, 2022, 6:49am UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-issue-with-regex/308252 "2022-07-20T06:49:18Z")
Hi , we have a Logstash pipeline , for Kafka on-premise Confluent Platform logs - shipped using Filebeat Kafka module , We are using a grok pattern to extract some of the entries in the data in order to use that data i… --- ## [How logstash extracts specific characters from a path?](https://discuss.elastic.co/t/how-logstash-extracts-specific-characters-from-a-path/310090)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 6:45am UTC](https://discuss.elastic.co/t/how-logstash-extracts-specific-characters-from-a-path/310090 "2022-07-20T06:45:21Z")
I want to extract "acpro" as the service name from the path below, can anyone offer some advice? /api/acpro/filter/dowork/ayc /api/acpro/filter/toko /api/acpro/filter/toko/user/passwd /api/acpro/account/getsales/b77dd0b… --- ## [Some elasticsearch index deleted after elasticsearch cluster restart](https://discuss.elastic.co/t/some-elasticsearch-index-deleted-after-elasticsearch-cluster-restart/310088)
**Author:** [@deepakdinkar311](https://discuss.elastic.co/u/deepakdinkar311)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 6:36am UTC](https://discuss.elastic.co/t/some-elasticsearch-index-deleted-after-elasticsearch-cluster-restart/310088 "2022-07-20T06:36:16Z")
After restarting elasticsearch cluster some index are deleted automatically. --- ## [\[8.3.2\] bin/elasticsearch-users throws StringIndexOutOfBoundsException](https://discuss.elastic.co/t/8-3-2-bin-elasticsearch-users-throws-stringindexoutofboundsexception/309794)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 6:21am UTC](https://discuss.elastic.co/t/8-3-2-bin-elasticsearch-users-throws-stringindexoutofboundsexception/309794 "2022-07-20T06:21:24Z")
elasticsearch@esmaster:~/bin$ . elasticsearch-users useradd su -p password -r superuser Exception in thread "main" java.lang.StringIndexOutOfBoundsException: Range \[13, 4) out of bounds for length 4 at java.base/… --- ## [Logstash Dissect against \\e control character](https://discuss.elastic.co/t/logstash-dissect-against-e-control-character/309993)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 6:01am UTC](https://discuss.elastic.co/t/logstash-dissect-against-e-control-character/309993 "2022-07-20T06:01:38Z")
My line to dissect begins with \\e\[92mContent , I need extract Content avoiding \\e\[92 I have already try: dissect { mapping =\> { "message" =\> "\\e\[92m%{content}"}} But not works --- ## [Have configured Heartbeat and logstash and influxdb but measurements are not getting created in database](https://discuss.elastic.co/t/have-configured-heartbeat-and-logstash-and-influxdb-but-measurements-are-not-getting-created-in-database/310085)
**Author:** [@sagarpathak](https://discuss.elastic.co/u/sagarpathak)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 5:48am UTC](https://discuss.elastic.co/t/have-configured-heartbeat-and-logstash-and-influxdb-but-measurements-are-not-getting-created-in-database/310085 "2022-07-20T05:48:05Z")
have configured Heartbeat and logstash and influxdb but measurements are not getting created in database(telegraf) [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=857) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=859)