# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=866 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 867 --- ## [Alternate to multi-terms aggregation in transform](https://discuss.elastic.co/t/alternate-to-multi-terms-aggregation-in-transform/309344)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 5\ **Last updated:** [July 14, 2022, 8:10am UTC](https://discuss.elastic.co/t/alternate-to-multi-terms-aggregation-in-transform/309344 "2022-07-14T08:10:46Z")
Hello Team ES, We have a use case where this transform works well for us.- PUT \_transform/tradebystatus { "source": { "index": \[ "latest-transactions" \] }, "pivot": { "group\_by": { "tradeD… --- ## [Vector-Based search using cosineSimilarity](https://discuss.elastic.co/t/vector-based-search-using-cosinesimilarity/307672)
**Author:** [@Biplab](https://discuss.elastic.co/u/Biplab)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 8:08am UTC](https://discuss.elastic.co/t/vector-based-search-using-cosinesimilarity/307672 "2022-07-14T08:08:46Z")
Hi, I am indexing text and vector in Elasticsearch, working on an use case where I am using cosineSimilarity to get the result. The query search is returning the list of documents with decreasing Confidence Scores with t… --- ## [How can I change timezone](https://discuss.elastic.co/t/how-can-i-change-timezone/309615)
**Author:** [@msjhbhh](https://discuss.elastic.co/u/msjhbhh)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 8:02am UTC](https://discuss.elastic.co/t/how-can-i-change-timezone/309615 "2022-07-14T08:02:29Z")
how can I change timezone $ date -Is -d '2022-07-14 15:25:26.867' 2022-07-14T15:25:26.867+0200 --- ## [User Creation can do All users](https://discuss.elastic.co/t/user-creation-can-do-all-users/307840)
**Author:** [@Muhammed\_Ashique](https://discuss.elastic.co/u/Muhammed_Ashique)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 7:56am UTC](https://discuss.elastic.co/t/user-creation-can-do-all-users/307840 "2022-07-14T07:56:12Z")
I have created a user and this user is login via SSO . But the users who login via sso all users can manage user and Role session under stack management. How can i restrict/disable User creation functionalities for a use… --- ## [Elastic did not load properly. Check the server output for more information](https://discuss.elastic.co/t/elastic-did-not-load-properly-check-the-server-output-for-more-information/309111)
**Author:** [@aacorreia](https://discuss.elastic.co/u/aacorreia)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 7:53am UTC](https://discuss.elastic.co/t/elastic-did-not-load-properly-check-the-server-output-for-more-information/309111 "2022-07-14T07:53:19Z")
Hi, I'm new to the ELK stack. I was able to successfully deploy a functional ELK stack (version 8.2.3, Docker containerized) in my local virtual environment (VirtualBox - Vagrant VM). For development purposes, we have s… --- ## [How to access double nested data in Kibana/Vega](https://discuss.elastic.co/t/how-to-access-double-nested-data-in-kibana-vega/308806)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 5\ **Last updated:** [July 14, 2022, 7:40am UTC](https://discuss.elastic.co/t/how-to-access-double-nested-data-in-kibana-vega/308806 "2022-07-14T07:40:07Z")
Hi! I'm trying to display an stacked bar with information in a double nested array in Vega. I know that people struggle with this and I've read other questions/responses, but I still cannot get this right. This is the … --- ## [Script painless inline Method too large: method\_too\_large\_exception compile error on update](https://discuss.elastic.co/t/script-painless-inline-method-too-large-method-too-large-exception-compile-error-on-update/309611)
**Author:** [@Gaganpreet\_Xornor](https://discuss.elastic.co/u/Gaganpreet_Xornor)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 7:33am UTC](https://discuss.elastic.co/t/script-painless-inline-method-too-large-method-too-large-exception-compile-error-on-update/309611 "2022-07-14T07:33:23Z")
script painless inline Method too large: method\_too\_large\_exception compile error on update --- ## [How does pagination work with LTR plugin](https://discuss.elastic.co/t/how-does-pagination-work-with-ltr-plugin/309608)
**Author:** [@Mayank\_Tripathi](https://discuss.elastic.co/u/Mayank_Tripathi)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 6:31am UTC](https://discuss.elastic.co/t/how-does-pagination-work-with-ltr-plugin/309608 "2022-07-14T06:31:07Z")
How does pagination work with LTR plugins ? as per my understanding ranking plugin executes after document fetching takes place. If we have specified the from and to parameter. will LTR model still rank all of the docume… --- ## [Can't create Visualize Library using span.db.statement field](https://discuss.elastic.co/t/cant-create-visualize-library-using-span-db-statement-field/309471)
**Author:** [@Ahmad\_Arif](https://discuss.elastic.co/u/Ahmad_Arif)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 2:45am UTC](https://discuss.elastic.co/t/cant-create-visualize-library-using-span-db-statement-field/309471 "2022-07-14T02:45:59Z")
Why I can't add field span.db.statement in Visualize Library? I want to show what query with long duration process, btw I'm using APM nodejs Agent. Thanks --- ## [Can kibana compare logs from different area and find the missing one?](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509)
**Author:** [@josephLiu](https://discuss.elastic.co/u/josephLiu)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 2:31am UTC](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509 "2022-07-14T02:31:00Z")
I want to send some logs into elastic index continuous. When my program started logs will be sent into index1 . Finally some logs may lost and other logs will sent into index2 Can kibana compare 2 indexes and find the… --- ## [How to run curl with Basic Security ( TLS / HTTPS )](https://discuss.elastic.co/t/how-to-run-curl-with-basic-security-tls-https/309479)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 1:38am UTC](https://discuss.elastic.co/t/how-to-run-curl-with-basic-security-tls-https/309479 "2022-07-14T01:38:17Z")
I have configured elasticsearch 7.17 to use TLS and HTTPS and trying to run curl commands to get index stats. The response i get is curl: (52) Empty reply from server. I am debugging an issue wherein post TLS implementa… --- ## [JAVA API Runtime mappings bug?](https://discuss.elastic.co/t/java-api-runtime-mappings-bug/309588)
**Author:** [@nicole.oresme](https://discuss.elastic.co/u/nicole.oresme)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 12:29am UTC](https://discuss.elastic.co/t/java-api-runtime-mappings-bug/309588 "2022-07-14T00:29:48Z")
I'm trying to set runtime mappings using the java api. My setup is something like: new SearchRequest.Builder() .runtimeMappings("abc", java.util.Arrays.asList( new RuntimeField.Builder() … --- ## [Unenrolling multiple agents requires Gold License?!](https://discuss.elastic.co/t/unenrolling-multiple-agents-requires-gold-license/309518)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 11:04pm UTC](https://discuss.elastic.co/t/unenrolling-multiple-agents-requires-gold-license/309518 "2022-07-13T23:04:49Z")
Hey, when selecting multiple agents to bulk-unenroll them, I get a popup that this requires a gold license. I want to question this decision - bulk-actions on fleet agents are not a "value-add" feature but a necessity … --- ## [OpenSSL failed to parse encrypted private key](https://discuss.elastic.co/t/openssl-failed-to-parse-encrypted-private-key/309584)
**Author:** [@jocha](https://discuss.elastic.co/u/jocha)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 10:35pm UTC](https://discuss.elastic.co/t/openssl-failed-to-parse-encrypted-private-key/309584 "2022-07-13T22:35:13Z")
Hello, Is this issue from before still a problem with filebeats? Filebeat private key parse error - #6 by adrisr Also running on openssl version 1.x, when using encrypted pem key with key\_passphrase getting: Exiting: … --- ## [Using tcp plugin to parse logs from multiple sources](https://discuss.elastic.co/t/using-tcp-plugin-to-parse-logs-from-multiple-sources/309565)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 3\ **Last updated:** [July 13, 2022, 9:16pm UTC](https://discuss.elastic.co/t/using-tcp-plugin-to-parse-logs-from-multiple-sources/309565 "2022-07-13T21:16:21Z")
We are using ELK 7.6.2 stack. I am trying to configure Logstash to parse inputs based on tcp plugin. My config looks like this: input { tcp { port =\> 6789 codec =\> json\_lines tags =\>… --- ## [NMON to JSON Converted Files Will Not Import](https://discuss.elastic.co/t/nmon-to-json-converted-files-will-not-import/309566)
**Author:** [@yoscar](https://discuss.elastic.co/u/yoscar)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 8:14pm UTC](https://discuss.elastic.co/t/nmon-to-json-converted-files-will-not-import/309566 "2022-07-13T20:14:45Z")
We're trying to ingest nmon data that's recorded over a 24 hour timespan into Logstash. We first convert it to json usin nmon2json (I understand that njmon is an option, but we are trying to use existing nmon files for n… --- ## [Need to extract doc\_count value from ctx.payload.aggregations.by\_store.buckets\_doc\_count](https://discuss.elastic.co/t/need-to-extract-doc-count-value-from-ctx-payload-aggregations-by-store-buckets-doc-count/309577)
**Author:** [@dkumar89](https://discuss.elastic.co/u/dkumar89)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 7:59pm UTC](https://discuss.elastic.co/t/need-to-extract-doc-count-value-from-ctx-payload-aggregations-by-store-buckets-doc-count/309577 "2022-07-13T19:59:38Z")
Need to extract doc\_count value from each key and do a watcher condition ctx.payload.aggregations.by\_store.buckets\_doc\_count \> 2. --- ## [How to imported file GEOJSON to kibana](https://discuss.elastic.co/t/how-to-imported-file-geojson-to-kibana/309456)
**Author:** [@Khadija\_BOUDINAR1](https://discuss.elastic.co/u/Khadija_BOUDINAR1)\ **Replies:** 10\ **Last updated:** [July 13, 2022, 7:11pm UTC](https://discuss.elastic.co/t/how-to-imported-file-geojson-to-kibana/309456 "2022-07-13T19:11:49Z")
hi all, i have created new layers in kibana maps and i upload my file geojson but I can't visualize the file have you any suggestion please --- ## [Elasticsearch symlink does not start the service if installed from archive](https://discuss.elastic.co/t/elasticsearch-symlink-does-not-start-the-service-if-installed-from-archive/309574)
**Author:** [@marius03](https://discuss.elastic.co/u/marius03)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 7:10pm UTC](https://discuss.elastic.co/t/elasticsearch-symlink-does-not-start-the-service-if-installed-from-archive/309574 "2022-07-13T19:10:56Z")
I installed Elasticsearch & Kibana in Linux Mint 20.3 localhost with archive option because installation from Debian Package does not work as expected: Install Elasticsearch from archive on Linux or MacOS | Elasticsearch… --- ## [Grok for data](https://discuss.elastic.co/t/grok-for-data/309093)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 17\ **Last updated:** [July 13, 2022, 11:57am UTC](https://discuss.elastic.co/t/grok-for-data/309093 "2022-07-13T11:57:35Z")
Can anyone try to build grok for below data it's important that timestamp should be took from the first line of document 20220704061503 and interesting columns number: 0000080 data1:abort 0 type: onlist yes input of … --- ## [Logstash Nested Fields - Cloudtrail logs - No root field](https://discuss.elastic.co/t/logstash-nested-fields-cloudtrail-logs-no-root-field/309568)
**Author:** [@Pedro\_Cabral](https://discuss.elastic.co/u/Pedro_Cabral)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 6:01pm UTC](https://discuss.elastic.co/t/logstash-nested-fields-cloudtrail-logs-no-root-field/309568 "2022-07-13T18:01:00Z")
Hello all, First of all I'm running version 7.10.2 on a docker. I have some cloudtrail logs stored as .gz that I'm reading and after parsing I'm renaming the Records fields and build the different nested fields. When I… --- ## [Authentication of \[kibana\_system\] was terminated by realm \[reserved\] - failed to authenticate user \[kibana\_system\]](https://discuss.elastic.co/t/authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/309395)
**Author:** [@grillo](https://discuss.elastic.co/u/grillo)\ **Replies:** 5\ **Last updated:** [July 13, 2022, 5:33pm UTC](https://discuss.elastic.co/t/authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/309395 "2022-07-13T17:33:42Z")
Hello everyone, I have my two node cluster (8.3.2.1) - working. I generated the certificates of each element (elastic-vm-1, elastic-vm2, kibana, logstash) including DNS and IP for each certificate. Kibana - that when I… --- ## [Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock](https://discuss.elastic.co/t/got-permission-denied-while-trying-to-connect-to-the-docker-daemon-socket-at-unix-var-run-docker-sock/307692)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 5:31pm UTC](https://discuss.elastic.co/t/got-permission-denied-while-trying-to-connect-to-the-docker-daemon-socket-at-unix-var-run-docker-sock/307692 "2022-07-13T17:31:03Z")
Hello World! I'm trying to Run Filebeat on Docker | Filebeat Reference \[7.17\] | Elastic yet running into following issue: % docker-compose logs --tail 2 filebeat filebeat | 2022-06-20T19:05:12.965Z ERROR instance… --- ## [Creating Index Patterns and Dashboards Using API](https://discuss.elastic.co/t/creating-index-patterns-and-dashboards-using-api/309548)
**Author:** [@christng](https://discuss.elastic.co/u/christng)\ **Replies:** 3\ **Last updated:** [July 13, 2022, 4:54pm UTC](https://discuss.elastic.co/t/creating-index-patterns-and-dashboards-using-api/309548 "2022-07-13T16:54:40Z")
I'm using Kubernetes and trying to create index patterns and dashboards on Kibana 7.17 using the curl commands but they do not seem to be working. I've followed everything at these sources: Saved objects APIs | Kibana Gu… --- ## [Understanding the result for the query](https://discuss.elastic.co/t/understanding-the-result-for-the-query/307861)
**Author:** [@Seemant\_Bind](https://discuss.elastic.co/u/Seemant_Bind)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 4:47pm UTC](https://discuss.elastic.co/t/understanding-the-result-for-the-query/307861 "2022-07-13T16:47:26Z")
Continuing the discussion from Restrict specific time range: Hi, As per the issue, you have recommended that time:(from:now%2Fd-12h,to:now%2Fd-12h)) will give data from today's date - 12 hour i.e 12am to 12pm. In my c… --- ## [Monitoring Beats installed server](https://discuss.elastic.co/t/monitoring-beats-installed-server/309554)
**Author:** [@Muhammed\_Ashique](https://discuss.elastic.co/u/Muhammed_Ashique)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 4:34pm UTC](https://discuss.elastic.co/t/monitoring-beats-installed-server/309554 "2022-07-13T16:34:17Z")
I have installed filebeat and Winlogbeat around 700 servers. I want to monitor these servers if any servers failed to sent logs in Elasticsearch. How can i do this ? --- ## [When field \_index in elasticsearch is generated?](https://discuss.elastic.co/t/when-field-index-in-elasticsearch-is-generated/309519)
**Author:** [@maoxuguang](https://discuss.elastic.co/u/maoxuguang)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 4:19pm UTC](https://discuss.elastic.co/t/when-field-index-in-elasticsearch-is-generated/309519 "2022-07-13T16:19:12Z")
in elasticsearch, there is a field named \_index, is this field generated by logstash? In logstash we output same data to both elasticsearch and mongodb, while elasticsearch has a field named \_index, but mongodb has no s… --- ## [Elasticsearch Index mappings( version 6.5.4)](https://discuss.elastic.co/t/elasticsearch-index-mappings-version-6-5-4/309535)
**Author:** [@gyrao\_72](https://discuss.elastic.co/u/gyrao_72)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 4:14pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mappings-version-6-5-4/309535 "2022-07-13T16:14:36Z")
I am using filebeat to fetch logs, logstash to filter, and pushing them to elasticsearch. I have created an index on elasticsearch import-export-logger. This id mapping of import-export-logger. { "import-export-logg… --- ## [My ELK stack the /dev/mapper/centos-root directory is getting full (95%)](https://discuss.elastic.co/t/my-elk-stack-the-dev-mapper-centos-root-directory-is-getting-full-95/309544)
**Author:** [@zanoob](https://discuss.elastic.co/u/zanoob)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 2:57pm UTC](https://discuss.elastic.co/t/my-elk-stack-the-dev-mapper-centos-root-directory-is-getting-full-95/309544 "2022-07-13T14:57:16Z")
Hello All, Trying to figure out how, but still no luck. If someone can help me out here in this. My Elasticsearch node is getting full \[root@srvde432 nodes\]# df -h Filesystem Size Used Avail Use% Mount… --- ## [Error setting up Fleet Server to monitor .NET or JAVA code monitoring using APM feature](https://discuss.elastic.co/t/error-setting-up-fleet-server-to-monitor-net-or-java-code-monitoring-using-apm-feature/309352)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 3:55pm UTC](https://discuss.elastic.co/t/error-setting-up-fleet-server-to-monitor-net-or-java-code-monitoring-using-apm-feature/309352 "2022-07-13T15:55:47Z")
Hi, I want to use APM feature for my .NET or JAVA code monitoring. Going through APM Guide 8.1, it tells us in order to install APM, we must have below 4 components: APM Agents, Elastic APM Integration, Elasticsearch,… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=865) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=867)