# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=878 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 879 --- ## [Run aggregation on collapsed result](https://discuss.elastic.co/t/run-aggregation-on-collapsed-result/308171)
**Author:** [@Nowrin\_Hossain](https://discuss.elastic.co/u/Nowrin_Hossain)\ **Replies:** 8\ **Last updated:** [July 4, 2022, 8:08am UTC](https://discuss.elastic.co/t/run-aggregation-on-collapsed-result/308171 "2022-07-04T08:08:42Z")
Hello, I have an issue that, first I need to collapse data by a field after sorting by another field then I need to perform some complex aggregation on that output. How to do that ? can anyone help ? --- ## [Elasticsearch recovery tools](https://discuss.elastic.co/t/elasticsearch-recovery-tools/308739)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 8:05am UTC](https://discuss.elastic.co/t/elasticsearch-recovery-tools/308739 "2022-07-04T08:05:16Z")
One issue that seem to be problematic (and reoccurring) is that there isn't much information in the error messages when things like "NODE\_LEFT" / "no\_valid\_shard\_copy" populate error messages when performing things like … --- ## [ES rolling upgrade from 6.3.2 to 6.8.22, ES plug-in version should be upgraded to 6.8.22?](https://discuss.elastic.co/t/es-rolling-upgrade-from-6-3-2-to-6-8-22-es-plug-in-version-should-be-upgraded-to-6-8-22/308325)
**Author:** [@qiuxb](https://discuss.elastic.co/u/qiuxb)\ **Replies:** 7\ **Last updated:** [July 4, 2022, 7:51am UTC](https://discuss.elastic.co/t/es-rolling-upgrade-from-6-3-2-to-6-8-22-es-plug-in-version-should-be-upgraded-to-6-8-22/308325 "2022-07-04T07:51:11Z")
In order to fix the log4j2 vulnerability, we plan to upgrade the ES version from 6.3.2 to 6.8.22, and 7.x to 7.16.2. When reading the rolling upgrade document, the rolling upgrade document for 7.16.2 mentioned that the p… --- ## [Metricbeat fails to parse field](https://discuss.elastic.co/t/metricbeat-fails-to-parse-field/308446)
**Author:** [@cracanut](https://discuss.elastic.co/u/cracanut)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 7:41am UTC](https://discuss.elastic.co/t/metricbeat-fails-to-parse-field/308446 "2022-07-04T07:41:11Z")
I'm trying to setup monitoring of our ES cluster via MetricBeat. The cluster consists of: 1 master & 1 data node (more to be added later) running on AWS Ubuntu ARM instances I'm getting the following error in MetricB… --- ## [Metric monitoring for multi cpu systems](https://discuss.elastic.co/t/metric-monitoring-for-multi-cpu-systems/306839)
**Author:** [@Siddhant\_Gupta](https://discuss.elastic.co/u/Siddhant_Gupta)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 7:27am UTC](https://discuss.elastic.co/t/metric-monitoring-for-multi-cpu-systems/306839 "2022-07-04T07:27:29Z")
I want to monitor a multi cpu system and set up the systems metricbeat to get the values. The problem is the systems metric beat reports a cumulative metric for all the CPUs. I want to report the values of all the CPUs s… --- ## [Metricbeat does not send documents to indices other than .monitoring-es-\*-mb, even when output.elasticsearch.index specified](https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516)
**Author:** [@Olivia\_Anderson](https://discuss.elastic.co/u/Olivia_Anderson)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 7:23am UTC](https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516 "2022-07-04T07:23:44Z")
I have 2 elasticsearch clusters deployed with ECK, and want to send stack monitoring data from the main cluster to the monitoring cluster. Metricbeat is setup with the following configs: elasticsearch.yml: - module: el… --- ## [Metricbeat 8.2.2 / kibana 8.2.2 All nodes marked as master on kibana's monitoring section](https://discuss.elastic.co/t/metricbeat-8-2-2-kibana-8-2-2-all-nodes-marked-as-master-on-kibanas-monitoring-section/307043)
**Author:** [@Roberto\_D\_Arco](https://discuss.elastic.co/u/Roberto_D_Arco)\ **Replies:** 4\ **Last updated:** [July 4, 2022, 7:02am UTC](https://discuss.elastic.co/t/metricbeat-8-2-2-kibana-8-2-2-all-nodes-marked-as-master-on-kibanas-monitoring-section/307043 "2022-07-04T07:02:55Z")
It took me a while to make monitoring with metricbeat working again after the upgrade from 7.17.4 to 8.2.2 (I had to manually delete old .monitoring\* indices). Anyway, as soon as monitoring started working in Kibana, al… --- ## [Elasticsearch NEST FunctionScoreQuery](https://discuss.elastic.co/t/elasticsearch-nest-functionscorequery/308602)
**Author:** [@Hristo\_Hristov](https://discuss.elastic.co/u/Hristo_Hristov)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 7:02am UTC](https://discuss.elastic.co/t/elasticsearch-nest-functionscorequery/308602 "2022-07-04T07:02:49Z")
Hi, I am using Elasticsearch NEST (7.17.4) with ElasticSearch 8.2.3 to build search request. After added FunctionScoreQuery with Functions param i received exception "Can not write function score json for FunctionScore… --- ## [Java Client Custom tokenizer Cannot map type](https://discuss.elastic.co/t/java-client-custom-tokenizer-cannot-map-type/308770)
**Author:** [@Huyueeer](https://discuss.elastic.co/u/Huyueeer)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 3:44am UTC](https://discuss.elastic.co/t/java-client-custom-tokenizer-cannot-map-type/308770 "2022-07-04T03:44:59Z")
I looked through the previous problem records, and my question should be: does the latest javaapi support custom tokenizer Excuse me, I have some questions about the Java client. I need to register setting in elastic th… --- ## [ERROR WHILE RELOADING THE LOCALHOST:9200 and says Unsecured and the CONNECTION GETS CLOSED AUTOMATICALLY](https://discuss.elastic.co/t/error-while-reloading-the-localhost-9200-and-says-unsecured-and-the-connection-gets-closed-automatically/308765)
**Author:** [@Tarun\_Kumar\_Yerra](https://discuss.elastic.co/u/Tarun_Kumar_Yerra)\ **Replies:** 7\ **Last updated:** [July 4, 2022, 1:19am UTC](https://discuss.elastic.co/t/error-while-reloading-the-localhost-9200-and-says-unsecured-and-the-connection-gets-closed-automatically/308765 "2022-07-04T01:19:11Z")
Hello Team, I have installed the kibana on windows by extracting the zip files. Everything seems to be running well but when I try to connect through the python script it says the error with SSL CERTIFICATE ERRO… --- ## [Snapshot and Restore Considerations](https://discuss.elastic.co/t/snapshot-and-restore-considerations/308741)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 3:25am UTC](https://discuss.elastic.co/t/snapshot-and-restore-considerations/308741 "2022-07-04T03:25:16Z")
Hi Everyone, just want to hear from you guys these scenarios if Elasticsearch Snapshot and Restore can consider the situation. Happy to hear your answer :slight\_smile: 1.) Is there an email notifications when snapshot i… --- ## [Filebeat ilm options don't work](https://discuss.elastic.co/t/filebeat-ilm-options-dont-work/308768)
**Author:** [@busishe](https://discuss.elastic.co/u/busishe)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 3:24am UTC](https://discuss.elastic.co/t/filebeat-ilm-options-dont-work/308768 "2022-07-04T03:24:33Z")
i edit filebeat.yml set "setup.ilm.policy\_name" to my own test policy created by kibana. filebeat log shows the option worked. {"log.level":"info","@timestamp":"2022-07-04T02:51:11.473Z","log.logger":"index-management.… --- ## [Help with "\_grokparsefailure" and "\_geoip\_lookup\_failure"](https://discuss.elastic.co/t/help-with-grokparsefailure-and-geoip-lookup-failure/308702)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 5\ **Last updated:** [July 4, 2022, 3:22am UTC](https://discuss.elastic.co/t/help-with-grokparsefailure-and-geoip-lookup-failure/308702 "2022-07-04T03:22:31Z")
I am getting those error tags. Here is my filter section from my logstash section (Note that I started to get the \_grokparsefailure after adding the second grok with the src match, it was working fine with just the top g… --- ## [How to add an alias to index by using filebeat?](https://discuss.elastic.co/t/how-to-add-an-alias-to-index-by-using-filebeat/308640)
**Author:** [@busishe](https://discuss.elastic.co/u/busishe)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 3:10am UTC](https://discuss.elastic.co/t/how-to-add-an-alias-to-index-by-using-filebeat/308640 "2022-07-04T03:10:15Z")
i want to use ilm to delete outdated logs.the ilm policy is configured for rollover ,means the index need an alias.filebeat will create an index automatically (if you configured in filebeat.yml and the index not existed)… --- ## [Searchable Snapshot vs Restore Snapshot](https://discuss.elastic.co/t/searchable-snapshot-vs-restore-snapshot/308726)
**Author:** [@tomiko](https://discuss.elastic.co/u/tomiko)\ **Replies:** 1\ **Last updated:** [July 3, 2022, 11:24pm UTC](https://discuss.elastic.co/t/searchable-snapshot-vs-restore-snapshot/308726 "2022-07-03T23:24:11Z")
As written in the docs of searchable snapshot : "Mounting and relocating the shards of searchable snapshot indices involves copying the shard contents from the snapshot repository". So how it's different from restore th… --- ## [Index From Excel (Workplace?)](https://discuss.elastic.co/t/index-from-excel-workplace/308618)
**Author:** [@Cal](https://discuss.elastic.co/u/Cal)\ **Replies:** 3\ **Last updated:** [July 3, 2022, 11:18pm UTC](https://discuss.elastic.co/t/index-from-excel-workplace/308618 "2022-07-03T23:18:32Z")
My team and I have an Excel database that constantly has new entries we need to put in. We want to avoid removing and reuploading the CSV file (replacing the index) each day we make an update. We are wondering if there… --- ## [Removal of mapping types | Elasticsearch Guide \[7.17\] | Elastic](https://discuss.elastic.co/t/removal-of-mapping-types-elasticsearch-guide-7-17-elastic/308657)
**Author:** [@Max\_Pinto](https://discuss.elastic.co/u/Max_Pinto)\ **Replies:** 0\ **Last updated:** [July 1, 2022, 11:50am UTC](https://discuss.elastic.co/t/removal-of-mapping-types-elasticsearch-guide-7-17-elastic/308657 "2022-07-01T11:50:02Z")
POST \_reindex { "source": { "index": "twitter" }, "dest": { "index": "new\_twitter" }, "script": { "source": """ ctx.\_source.type = ctx.\_type; ctx.\_id = ctx.\_type + '-' + ctx.\_id; … --- ## [CVE's in Elasticsearch](https://discuss.elastic.co/t/cves-in-elasticsearch/308669)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [July 3, 2022, 11:12pm UTC](https://discuss.elastic.co/t/cves-in-elasticsearch/308669 "2022-07-03T23:12:04Z")
Are there any prebuilt data pipelines / APIs for getting CVE's into elasticsearch? I would like to have a watcher alert me when CVE's of a certain priority are released, and enrich the alert with data from my cluster. Is… --- ## [Alerts in kibana are not getting trigger](https://discuss.elastic.co/t/alerts-in-kibana-are-not-getting-trigger/308662)
**Author:** [@ritesh811](https://discuss.elastic.co/u/ritesh811)\ **Replies:** 2\ **Last updated:** [July 3, 2022, 11:10pm UTC](https://discuss.elastic.co/t/alerts-in-kibana-are-not-getting-trigger/308662 "2022-07-03T23:10:46Z")
Hi All, Alert in the kibana is not getting triggered, we are using opendistro alerting and security version 1.9.0 with kibana version 7.8.0 and elastic version 7.8.0, can someone pls help Thanks in advanced --- ## [Complete elasticsearch yml file is not downloaded](https://discuss.elastic.co/t/complete-elasticsearch-yml-file-is-not-downloaded/308706)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 1\ **Last updated:** [July 3, 2022, 11:08pm UTC](https://discuss.elastic.co/t/complete-elasticsearch-yml-file-is-not-downloaded/308706 "2022-07-03T23:08:47Z")
Hi , I have installed Elasticsearch (8.3) with rpm repo and it installed properly. While setting up the authentication I have faced some challenges and i have uninstalled Elasticsearch. command used to remove elasticsea… --- ## [Does auto reload cause Logstash to restart ingestion from beginning](https://discuss.elastic.co/t/does-auto-reload-cause-logstash-to-restart-ingestion-from-beginning/308756)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 1\ **Last updated:** [July 3, 2022, 6:19pm UTC](https://discuss.elastic.co/t/does-auto-reload-cause-logstash-to-restart-ingestion-from-beginning/308756 "2022-07-03T18:19:33Z")
I am using the Elasticsearch input plugin to move a very large number of logs from one cluster to another. Logstash has been running for about 72 hours now and is pretty sluggish. I was thinking of adding a 2nd Elasti… --- ## ["Your settings are invalid. Setting "" doesnt exist" error during setup](https://discuss.elastic.co/t/your-settings-are-invalid-setting-doesnt-exist-error-during-setup/308751)
**Author:** [@dsilvera](https://discuss.elastic.co/u/dsilvera)\ **Replies:** 2\ **Last updated:** [July 3, 2022, 6:04pm UTC](https://discuss.elastic.co/t/your-settings-are-invalid-setting-doesnt-exist-error-during-setup/308751 "2022-07-03T18:04:00Z")
Setting up ELK 8.3.1 on Windows 10 PC and got Elastic Search and Kabana up and running. Reached to setting up logstash, entered the following command: .\\bin\\logstash.bat -e "input { stdin { } } output { stdout {} }" f… --- ## [Cross cluster replication](https://discuss.elastic.co/t/cross-cluster-replication/308735)
**Author:** [@Nicole-Ann\_Menezes](https://discuss.elastic.co/u/Nicole-Ann_Menezes)\ **Replies:** 6\ **Last updated:** [July 3, 2022, 4:23pm UTC](https://discuss.elastic.co/t/cross-cluster-replication/308735 "2022-07-03T16:23:36Z")
Exploring CCR. Flow - fluentd----\>Load balancer--'--\>elasticsearch ccr\<---kibana. Cluster A and Cluster B are set up with CCR. As per the documentation-An index has many shards, the follower replicas are in another cl… --- ## [Kibana - Per-date function](https://discuss.elastic.co/t/kibana-per-date-function/308598)
**Author:** [@RonGros](https://discuss.elastic.co/u/RonGros)\ **Replies:** 5\ **Last updated:** [July 3, 2022, 3:15pm UTC](https://discuss.elastic.co/t/kibana-per-date-function/308598 "2022-07-03T15:15:47Z")
Hi, I have an interesting situation and I would like to know if there is anything I can do about it. We are trying to build a dashboard that will visualize our open issues in our issue-handling system (JIRA etc...) Now… --- ## [Elasticsearch exception \[type=search\_phase\_execution\_exception, reason=all shards failed\]](https://discuss.elastic.co/t/elasticsearch-exception-type-search-phase-execution-exception-reason-all-shards-failed/308737)
**Author:** [@Pamal\_Jayawickrama](https://discuss.elastic.co/u/Pamal_Jayawickrama)\ **Replies:** 1\ **Last updated:** [July 3, 2022, 2:36pm UTC](https://discuss.elastic.co/t/elasticsearch-exception-type-search-phase-execution-exception-reason-all-shards-failed/308737 "2022-07-03T14:36:16Z")
when I searching this query using simpleQueryStringQuery, GET books/\_search { "query":{ "bool":{ "must":\[ {"bool":{ "should":\[{ "wildcard":{"vault-bpa-ui-url":{"wildcard":"http\*… --- ## [How can I use aggregation value in trigger condition](https://discuss.elastic.co/t/how-can-i-use-aggregation-value-in-trigger-condition/308743)
**Author:** [@puks\_apple](https://discuss.elastic.co/u/puks_apple)\ **Replies:** 0\ **Last updated:** [July 3, 2022, 10:43am UTC](https://discuss.elastic.co/t/how-can-i-use-aggregation-value-in-trigger-condition/308743 "2022-07-03T10:43:09Z")
{ "\_shards": { "total": 1, "failed": 0, "successful": 1, "skipped": 0 }, "hits": { "hits": \[\], "total": { "value": 7, "relation": "eq… --- ## [Logstash XML xpath function like PHP $father-\>children()](https://discuss.elastic.co/t/logstash-xml-xpath-function-like-php-father-children/308719)
**Author:** [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)\ **Replies:** 3\ **Last updated:** [July 3, 2022, 7:28am UTC](https://discuss.elastic.co/t/logstash-xml-xpath-function-like-php-father-children/308719 "2022-07-03T07:28:08Z")
I'm searching if in logstash exist a xpath function like the one in PHP to get the child of a node without knowing the name. Thanks to everyone --- ## [Get dashboard relationships kibana via API](https://discuss.elastic.co/t/get-dashboard-relationships-kibana-via-api/308482)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 5\ **Last updated:** [July 3, 2022, 6:04am UTC](https://discuss.elastic.co/t/get-dashboard-relationships-kibana-via-api/308482 "2022-07-03T06:04:31Z")
Hello! is there any option to keep dashboard relationships via api ?? i know how to do it via this button... but not how to doi it via api. Thanks in advanced! --- ## [Packetbeat not sending logs to Logstash](https://discuss.elastic.co/t/packetbeat-not-sending-logs-to-logstash/308607)
**Author:** [@Nightshade](https://discuss.elastic.co/u/Nightshade)\ **Replies:** 16\ **Last updated:** [July 3, 2022, 1:32am UTC](https://discuss.elastic.co/t/packetbeat-not-sending-logs-to-logstash/308607 "2022-07-03T01:32:39Z")
Alright, the most basic potential problem. I have packetbeat on an Arch Linux system, the beats package for Arch is currently 8.1.3. my ELK stack server is running 8.2x I don't believe this is the problem because the … --- ## [Cant create enrollment token with own certificates](https://discuss.elastic.co/t/cant-create-enrollment-token-with-own-certificates/308629)
**Author:** [@d\_raulf](https://discuss.elastic.co/u/d_raulf)\ **Replies:** 1\ **Last updated:** [July 2, 2022, 9:10pm UTC](https://discuss.elastic.co/t/cant-create-enrollment-token-with-own-certificates/308629 "2022-07-02T21:10:27Z")
Hey, I'm trying to run Elasticsearch with our own CA. Key and Cert are provide by our PKI-Team. Changes in elasticsearch.yml: network.host: 0.0.0.0 xpack.security.http.ssl: enabled: true keystore.path: certs/\