# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=867 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 868 --- ## [Visualize (Count) Keywords in Kibana](https://discuss.elastic.co/t/visualize-count-keywords-in-kibana/309335)
**Author:** [@Cal](https://discuss.elastic.co/u/Cal)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 3:59pm UTC](https://discuss.elastic.co/t/visualize-count-keywords-in-kibana/309335 "2022-07-13T15:59:02Z")
Hello, I am trying to count the number of times a keyword occurs and graph it alongside other keywords. An example CSV file is: Store | Item | Item | Item A Apple Orange B … --- ## [To write a custom code for visualization](https://discuss.elastic.co/t/to-write-a-custom-code-for-visualization/309112)
**Author:** [@Ritikapawar](https://discuss.elastic.co/u/Ritikapawar)\ **Replies:** 10\ **Last updated:** [July 13, 2022, 3:43pm UTC](https://discuss.elastic.co/t/to-write-a-custom-code-for-visualization/309112 "2022-07-13T15:43:52Z")
I'm writing a custom code in kibana (vega). In which I want show the the total working hours of employe by calculating diffrence from two available fields like (out time - Intime). how can I get that in vega by writing … --- ## [Failed to find a X509ExtendedTrustManager in the trust manager factory for \[PKIX\] and truststore \[null\]](https://discuss.elastic.co/t/failed-to-find-a-x509extendedtrustmanager-in-the-trust-manager-factory-for-pkix-and-truststore-null/309547)
**Author:** [@blaked](https://discuss.elastic.co/u/blaked)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 3:14pm UTC](https://discuss.elastic.co/t/failed-to-find-a-x509extendedtrustmanager-in-the-trust-manager-factory-for-pkix-and-truststore-null/309547 "2022-07-13T15:14:38Z")
I'm using Sonarqube Development Edition on Windows 2019 (I've previously posted this to the SQ forums but only gotten light feedback). Things have worked fine for years with the current config - but when I upgraded to S… --- ## [Metricbeat credentials config help](https://discuss.elastic.co/t/metricbeat-credentials-config-help/307283)
**Author:** [@sadik](https://discuss.elastic.co/u/sadik)\ **Replies:** 5\ **Last updated:** [July 13, 2022, 2:37pm UTC](https://discuss.elastic.co/t/metricbeat-credentials-config-help/307283 "2022-07-13T14:37:46Z")
HI Team, In " metricbeat.yml" configuration file we are using the below values for estrablish the connection to AWS. metricbeat.modules: - module: aws period: 300s metricsets: - lambda access\_key\_id… --- ## [Add dynapmic alias field if target field exist](https://discuss.elastic.co/t/add-dynapmic-alias-field-if-target-field-exist/309543)
**Author:** [@Denergym](https://discuss.elastic.co/u/Denergym)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 2:15pm UTC](https://discuss.elastic.co/t/add-dynapmic-alias-field-if-target-field-exist/309543 "2022-07-13T14:15:59Z")
Hi ! I need add alias field if target field exist or string. I do this with dynamic templates and aliases field { "mappings": { "dynamic\_templates": \[ { "add\_alias\_for\_open": { "mat… --- ## [How to return exact match result first then other matches?](https://discuss.elastic.co/t/how-to-return-exact-match-result-first-then-other-matches/309452)
**Author:** [@Jake\_Wong](https://discuss.elastic.co/u/Jake_Wong)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 2:06pm UTC](https://discuss.elastic.co/t/how-to-return-exact-match-result-first-then-other-matches/309452 "2022-07-13T14:06:09Z")
I am newbie to elastic. I have data in elasticsearch, with field post\_title : Chocolate Hot Homemade I expect to get 'ho' (exact match) as first result when I search 'ho' like this: Homemade Hot chocolate I have t… --- ## [Elasticsearch Data nodes](https://discuss.elastic.co/t/elasticsearch-data-nodes/309517)
**Author:** [@Farah\_Bhr](https://discuss.elastic.co/u/Farah_Bhr)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 2:05pm UTC](https://discuss.elastic.co/t/elasticsearch-data-nodes/309517 "2022-07-13T14:05:27Z")
Hello I am a beginner in elastic, I want to create an elasticsearch cluster with 3 data nodes, I want to ask can I specify for each data node, the type of logs meaning if I can specify for each data node what is the ty… --- ## [Kibana Regex check if a field contains the value of another](https://discuss.elastic.co/t/kibana-regex-check-if-a-field-contains-the-value-of-another/309295)
**Author:** [@Druffle](https://discuss.elastic.co/u/Druffle)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 1:54pm UTC](https://discuss.elastic.co/t/kibana-regex-check-if-a-field-contains-the-value-of-another/309295 "2022-07-13T13:54:29Z")
Hello, I'm trying to search for documents in which a description field contains the value of a name field (from another document). I tried to do a Regex query as following : GET inventory-full-index/\_search { "query"… --- ## [Why do we need logstash](https://discuss.elastic.co/t/why-do-we-need-logstash/309379)
**Author:** [@yugeeklab](https://discuss.elastic.co/u/yugeeklab)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 1:43pm UTC](https://discuss.elastic.co/t/why-do-we-need-logstash/309379 "2022-07-13T13:43:12Z")
I found out my Logstash has no logic except for forwarding log to Elasticsearch. Filebeat has many logic instead of Logstash(filtering etc.) In my case, Still do i need Logstash?? Why?? --- ## [Query for values not present for the last 90 days](https://discuss.elastic.co/t/query-for-values-not-present-for-the-last-90-days/309308)
**Author:** [@ChristianOelsner](https://discuss.elastic.co/u/ChristianOelsner)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 1:37pm UTC](https://discuss.elastic.co/t/query-for-values-not-present-for-the-last-90-days/309308 "2022-07-13T13:37:05Z")
Hello forum, I am trying to wrap my head around a query. In order to weed out some users i need to search for values in field "data.authenticationInfo.metadata.identifier.keyword" not present in the last 90 days. Coul… --- ## [Kibana outputs integer values with commas](https://discuss.elastic.co/t/kibana-outputs-integer-values-with-commas/309522)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 1:27pm UTC](https://discuss.elastic.co/t/kibana-outputs-integer-values-with-commas/309522 "2022-07-13T13:27:21Z")
Hi. I don’t remember with which version of elastic, but they began to notice in kibana on graphs or tables the output of integer values with commas. This is data from the database. Why does kibana do this? Has anyone … --- ## [Avoid reinventing a reindexing toolbox](https://discuss.elastic.co/t/avoid-reinventing-a-reindexing-toolbox/309273)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 0\ **Last updated:** [July 10, 2022, 8:43pm UTC](https://discuss.elastic.co/t/avoid-reinventing-a-reindexing-toolbox/309273 "2022-07-10T20:43:05Z")
Anyone know of a good CLI toolbox for doing reindexing to save #shards? Or should I create my own set of REST API scripts for this from scratch, surely someone else should have had the same issue before :slight\_smile: E… --- ## [Optimizing storage with fleet integrations](https://discuss.elastic.co/t/optimizing-storage-with-fleet-integrations/309532)
**Author:** [@tsbayne](https://discuss.elastic.co/u/tsbayne)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 1:02pm UTC](https://discuss.elastic.co/t/optimizing-storage-with-fleet-integrations/309532 "2022-07-13T13:02:20Z")
Our log storage is through the roof with the new elasticstack with fleet set up. How/where can I configure compression options for this? --- ## [Watcher transform bytes to mb](https://discuss.elastic.co/t/watcher-transform-bytes-to-mb/309430)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 12:58pm UTC](https://discuss.elastic.co/t/watcher-transform-bytes-to-mb/309430 "2022-07-13T12:58:27Z")
how i transform bytes to mb ? { "trigger": { "schedule": { "interval": "5m" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ … --- ## [How to Replace agent.\* and ecs.version with older Fields(filebeat.version,beat.hostname)](https://discuss.elastic.co/t/how-to-replace-agent-and-ecs-version-with-older-fields-filebeat-version-beat-hostname/309526)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 11:34am UTC](https://discuss.elastic.co/t/how-to-replace-agent-and-ecs-version-with-older-fields-filebeat-version-beat-hostname/309526 "2022-07-13T11:34:43Z")
Hi Team, I recently upgraded my filebeat from 5.6.5 to 7.17.3 and found in 7.x fields are different from 5.6.5. I want all the processor metadata should replaced with older keys but I still can't get rid of agent.ephem… --- ## [Install Fleet server 8.2.2 fails: Error - could not start the HTTP server for the API: failed to listen on the named pipe](https://discuss.elastic.co/t/install-fleet-server-8-2-2-fails-error-could-not-start-the-http-server-for-the-api-failed-to-listen-on-the-named-pipe/307964)
**Author:** [@tidenhub](https://discuss.elastic.co/u/tidenhub)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 12:02pm UTC](https://discuss.elastic.co/t/install-fleet-server-8-2-2-fails-error-could-not-start-the-http-server-for-the-api-failed-to-listen-on-the-named-pipe/307964 "2022-07-13T12:02:19Z")
Hi, I set up Elasticsearch and Kibana via Docker Compose using elasticsearch/docker-compose.yml at 8.2 · elastic/elasticsearch (github.com). I created the agent policy to host Fleet Server. I choose "Quick start" as de… --- ## [Is it possible to create custom visualization (without Vega)?](https://discuss.elastic.co/t/is-it-possible-to-create-custom-visualization-without-vega/308644)
**Author:** [@Kushal\_Roy](https://discuss.elastic.co/u/Kushal_Roy)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 11:45am UTC](https://discuss.elastic.co/t/is-it-possible-to-create-custom-visualization-without-vega/308644 "2022-07-13T11:45:23Z")
I want to create a visualization, like a plugin and add it to the dashboard. Is it possible to do so?? --- ## [Java SearchResponse\ serialization](https://discuss.elastic.co/t/java-searchresponse-objectnode-serialization/309523)
**Author:** [@3xil3](https://discuss.elastic.co/u/3xil3)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 11:12am UTC](https://discuss.elastic.co/t/java-searchresponse-objectnode-serialization/309523 "2022-07-13T11:12:36Z")
it's a simple question, but I can't seem to serialize the SearchResponse back to a json string. What I've tried: final SearchResponse\ search1 = client.search( e -\> e.index("myindex") … --- ## [Full warm blocks transition to delete](https://discuss.elastic.co/t/full-warm-blocks-transition-to-delete/309521)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 10:49am UTC](https://discuss.elastic.co/t/full-warm-blocks-transition-to-delete/309521 "2022-07-13T10:49:11Z")
HI, I have ElasticSearch v"7.17.0" 1st day HOT 2nd day Warm 9nd day Delete the problem is when WARM is full , DELETE phase is not working. Shards are waiting for nodes to move to WARM and age above 9th day despite … --- ## [Foreach Ingest processor + condition](https://discuss.elastic.co/t/foreach-ingest-processor-condition/309435)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 9:55am UTC](https://discuss.elastic.co/t/foreach-ingest-processor-condition/309435 "2022-07-13T09:55:04Z")
Hello! Please advice. I have documents with fields looks like this { "something": "some value", ... "outdated\_products": \[ { "product": "Google Chrome earlier than 101.0.1034.124" } \], "softw… --- ## [Restore Status](https://discuss.elastic.co/t/restore-status/309070)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 5\ **Last updated:** [July 13, 2022, 9:28am UTC](https://discuss.elastic.co/t/restore-status/309070 "2022-07-13T09:28:55Z")
Hello Elastic Team, I have a question regarding on Restoring an index. I perform restore and it ask me to close the indices, so I closed the indices mentioned. Then performed Restore, I checked the Status and its says "… --- ## [Azure App Service Web Job won't start after update: Exiting: The system cannot find the file specified](https://discuss.elastic.co/t/azure-app-service-web-job-wont-start-after-update-exiting-the-system-cannot-find-the-file-specified/309449)
**Author:** [@daymansiege](https://discuss.elastic.co/u/daymansiege)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 5:56pm UTC](https://discuss.elastic.co/t/azure-app-service-web-job-wont-start-after-update-exiting-the-system-cannot-find-the-file-specified/309449 "2022-07-12T17:56:51Z")
Hi! I was using 7.9.2 filebeat successfully as Azure Web Job with IIS module enabled. Was running it as this: run.cmd: set JOB\_DIR=%~dp0 %JOB\_DIR%filebeat.exe --environment=windows\_service -c %JOB\_DIR%filebeat.yml --… --- ## [Mass Custom SVG Icons for Map](https://discuss.elastic.co/t/mass-custom-svg-icons-for-map/309455)
**Author:** [@WMask](https://discuss.elastic.co/u/WMask)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 9:05am UTC](https://discuss.elastic.co/t/mass-custom-svg-icons-for-map/309455 "2022-07-13T09:05:30Z")
My company is trying to add a very large number of SVG Icons (10,000+ individual icons) to our world map visualized on Kibana and link it to data keywords we have in one of our data streams. Does anyone know an easy way… --- ## [Count emails that have more than 10 documents (buckets count)](https://discuss.elastic.co/t/count-emails-that-have-more-than-10-documents-buckets-count/307477)
**Author:** [@jack\_daniels00](https://discuss.elastic.co/u/jack_daniels00)\ **Replies:** 3\ **Last updated:** [July 13, 2022, 8:58am UTC](https://discuss.elastic.co/t/count-emails-that-have-more-than-10-documents-buckets-count/307477 "2022-07-13T08:58:07Z")
Hi! I have documents in elastic like: { "email": "user@example.com", "subject": "Email subject", "body": "Email body" } And I'm trying to count all unique emails that have more than 10 documents. I can re… --- ## [Failed to start Elasticsearch(/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)](https://discuss.elastic.co/t/failed-to-start-elasticsearch-usr-lib-systemd-system-elasticsearch-service-disabled-vendor-preset-disabled/309514)
**Author:** [@sagar\_hukre](https://discuss.elastic.co/u/sagar_hukre)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 8:43am UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-usr-lib-systemd-system-elasticsearch-service-disabled-vendor-preset-disabled/309514 "2022-07-13T08:43:08Z")
● elasticsearch.service - Elasticsearch Loaded: loaded \`(/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)\` Active: failed (Result: exit-code) since Wed 2022-07-13 14:05:42 IST; 1min… --- ## [Is combined\_script required or not in scripted\_metric?](https://discuss.elastic.co/t/is-combined-script-required-or-not-in-scripted-metric/309502)
**Author:** [@angelo\_c](https://discuss.elastic.co/u/angelo_c)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 7:54am UTC](https://discuss.elastic.co/t/is-combined-script-required-or-not-in-scripted-metric/309502 "2022-07-13T07:54:54Z")
Hi there, I was reading the documentation for scripted\_metric aggregation here, but I feel it is a bit confusing. I report what written there: map\_script Executed once per document collected. This is a required scrip… --- ## [Writing to wrong data stream's backing index after rollover](https://discuss.elastic.co/t/writing-to-wrong-data-streams-backing-index-after-rollover/309505)
**Author:** [@NejcK](https://discuss.elastic.co/u/NejcK)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 8:11am UTC](https://discuss.elastic.co/t/writing-to-wrong-data-streams-backing-index-after-rollover/309505 "2022-07-13T08:11:32Z")
Hi. I have a strange problem with data stream and filebeat. I've updated a mapping table and wanted to see if the new mappings work so I ran a manual rollup on the (test) data stream with POST robobeat-ds-sim-01-7.17/\_… --- ## [Failed to process cluster event (index-aliases) within 30s](https://discuss.elastic.co/t/failed-to-process-cluster-event-index-aliases-within-30s/309504)
**Author:** [@Anca\_Muresan](https://discuss.elastic.co/u/Anca_Muresan)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 8:09am UTC](https://discuss.elastic.co/t/failed-to-process-cluster-event-index-aliases-within-30s/309504 "2022-07-13T08:09:54Z")
Hello everyone , I get this error very frequently Elasticsearch\\Common\\Exceptions\\ServerErrorResponseException: {"error":{"root\_cause":\[{"type":"process\_cluster\_event\_timeout\_exception","reason":"failed to process clus… --- ## [Logstash monitoring with metricbeat](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat/308474)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 5\ **Last updated:** [July 13, 2022, 7:53am UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat/308474 "2022-07-13T07:53:51Z")
Hi, I have an Elastic Cloud cluster running (7.17.3). I'm plugging in a local logstash monitoring with metricbeat (7.17.4). I can see an index .monitoring-logstash-7-mb-2022.06.29 filling in over time. But I can't fin… --- ## [Invalid Index Error in Elastic Search - querying against multiple indexes](https://discuss.elastic.co/t/invalid-index-error-in-elastic-search-querying-against-multiple-indexes/309462)
**Author:** [@bigalbunayan](https://discuss.elastic.co/u/bigalbunayan)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 10:49pm UTC](https://discuss.elastic.co/t/invalid-index-error-in-elastic-search-querying-against-multiple-indexes/309462 "2022-07-12T22:49:36Z")
When I run the below code I'm running the following in error in Elasticsearch: Invalid alias name \[...\] must not contain the following characters \[ , \\", \*, \\\\, \<, |, ,, \>, /, ?\] It doesn't like that I'm using index1,i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=866) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=868)