# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=897 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 898 --- ## [Date with the max count grouped by a term](https://discuss.elastic.co/t/date-with-the-max-count-grouped-by-a-term/307377)
**Author:** [@crimson589](https://discuss.elastic.co/u/crimson589)\ **Replies:** 2\ **Last updated:** [June 20, 2022, 8:43am UTC](https://discuss.elastic.co/t/date-with-the-max-count-grouped-by-a-term/307377 "2022-06-20T08:43:06Z")
I'm currently getting this results message1 | 2022-06-09 | 250 message1 | 2022-06-08 | 300 message2 | 2022-06-09 | 400 message2 | 2022-06-08 | 200 And my current setting is like this What do I need to add here t… --- ## [Split filter in Logstash gives NilClass error](https://discuss.elastic.co/t/split-filter-in-logstash-gives-nilclass-error/307498)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 2\ **Last updated:** [June 20, 2022, 7:41am UTC](https://discuss.elastic.co/t/split-filter-in-logstash-gives-nilclass-error/307498 "2022-06-20T07:41:25Z")
Hello, I'm trying to split JSON using the split filter in Logstash, but with no success. This data is coming straight from an API and then forwarded to the filter in Logstash. The structure of the JSON is the followi… --- ## [Error could not read configuration file /var/lib/elastic-agent/elastic-agent.yml](https://discuss.elastic.co/t/error-could-not-read-configuration-file-var-lib-elastic-agent-elastic-agent-yml/307612)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 0\ **Last updated:** [June 20, 2022, 7:06am UTC](https://discuss.elastic.co/t/error-could-not-read-configuration-file-var-lib-elastic-agent-elastic-agent-yml/307612 "2022-06-20T07:06:28Z")
how to install elastic-agent properly in centos? i just installed using rpm in my host is fine. and when i want to enroll in other agent has an error could not read configuration file /var/lib/elastic-agent/elastic-agent… --- ## [Issue with using Role that has Document level security enabled in indexing operation](https://discuss.elastic.co/t/issue-with-using-role-that-has-document-level-security-enabled-in-indexing-operation/307609)
**Author:** [@swapnil\_vaidya](https://discuss.elastic.co/u/swapnil_vaidya)\ **Replies:** 2\ **Last updated:** [June 20, 2022, 6:48am UTC](https://discuss.elastic.co/t/issue-with-using-role-that-has-document-level-security-enabled-in-indexing-operation/307609 "2022-06-20T06:48:59Z")
Hi, I have scenario where multiple tenants are writing data into same index. I want to achieve data isolation for tenant using document level security. I have created role by adding query for document level security. … --- ## [Send different event to multiple output plugins in same config](https://discuss.elastic.co/t/send-different-event-to-multiple-output-plugins-in-same-config/307390)
**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\ **Replies:** 2\ **Last updated:** [June 20, 2022, 6:45am UTC](https://discuss.elastic.co/t/send-different-event-to-multiple-output-plugins-in-same-config/307390 "2022-06-20T06:45:33Z")
Hi Team, I have one pipeline with multiple output, elasticsearch and kafka. Now, the requirement is to sent a field to elasticsearch, but while sending to kafka that field needs to drop. Here my config says input is f… --- ## [Pls Help me I'm stuck over here](https://discuss.elastic.co/t/pls-help-me-im-stuck-over-here/307601)
**Author:** [@Draco\_King](https://discuss.elastic.co/u/Draco_King)\ **Replies:** 1\ **Last updated:** [June 20, 2022, 5:53am UTC](https://discuss.elastic.co/t/pls-help-me-im-stuck-over-here/307601 "2022-06-20T05:53:04Z")
{"error":{"root\_cause":\[{"type":"not\_x\_content\_exception","reason":"Compressor detection can only be called on some xcontent bytes or compressed xcontent bytes"}\],"type":"not\_x\_content\_exception","reason":"Compressor det… --- ## [Rally error when bulk-size=1](https://discuss.elastic.co/t/rally-error-when-bulk-size-1/306880)
**Author:** [@Gsqsf](https://discuss.elastic.co/u/Gsqsf)\ **Replies:** 3\ **Last updated:** [June 20, 2022, 5:46am UTC](https://discuss.elastic.co/t/rally-error-when-bulk-size-1/306880 "2022-06-20T05:46:37Z")
I'm using Rally to simulate an Elasticsearch single node receiving logs on by one. The following parameter of track.json: "bulk-size": 1, "ingest-percentage": {{ingest\_percentage | default(100.0)}} Sho… --- ## [Import all table from sqlserver to elasticsearch](https://discuss.elastic.co/t/import-all-table-from-sqlserver-to-elasticsearch/307516)
**Author:** [@Khadija\_BOUDINAR](https://discuss.elastic.co/u/Khadija_BOUDINAR)\ **Replies:** 1\ **Last updated:** [June 20, 2022, 5:41am UTC](https://discuss.elastic.co/t/import-all-table-from-sqlserver-to-elasticsearch/307516 "2022-06-20T05:41:54Z")
Can i imported my database with all tables sqlserver to Elasticsearch ? --- ## [Help with installing Filebeat ubuntu 20.04](https://discuss.elastic.co/t/help-with-installing-filebeat-ubuntu-20-04/307599)
**Author:** [@Badr\_Atouhlaten](https://discuss.elastic.co/u/Badr_Atouhlaten)\ **Replies:** 3\ **Last updated:** [June 20, 2022, 5:06am UTC](https://discuss.elastic.co/t/help-with-installing-filebeat-ubuntu-20-04/307599 "2022-06-20T05:06:19Z")
Please help to understand how \[Filebeat\] works, i have elk stack installed with fleet server , system & fleet server integration installed in the stack i have an ubuntu 18.04 added as client and i wanted to monitor /ro… --- ## [Ingest Pipeline location](https://discuss.elastic.co/t/ingest-pipeline-location/307588)
**Author:** [@sera123k](https://discuss.elastic.co/u/sera123k)\ **Replies:** 2\ **Last updated:** [June 20, 2022, 4:10am UTC](https://discuss.elastic.co/t/ingest-pipeline-location/307588 "2022-06-20T04:10:50Z")
Sorry if this should be in Kibana but I am looking to restore an earlier version of an ingest pipeline to compare it to the current but I cannot seem to figure out where it would have been stored. Are they kept in an ind… --- ## [Kibana not working](https://discuss.elastic.co/t/kibana-not-working/307595)
**Author:** [@chandramouli\_ravi](https://discuss.elastic.co/u/chandramouli_ravi)\ **Replies:** 0\ **Last updated:** [June 20, 2022, 2:25am UTC](https://discuss.elastic.co/t/kibana-not-working/307595 "2022-06-20T02:25:00Z")
Hi, My Elasticsearch is working at URL # https://172.20.192.1:9201 I am able to see Elasticsearch reply in CURL and browser. version # 8.2.3 Now, i have run Kibana, these are different errors i see ng\\chromium\\chrom… --- ## [Hunspell russian language. Problem with some grammar cases](https://discuss.elastic.co/t/hunspell-russian-language-problem-with-some-grammar-cases/307575)
**Author:** [@GrigoriyKrasovskiy](https://discuss.elastic.co/u/GrigoriyKrasovskiy)\ **Replies:** 1\ **Last updated:** [June 20, 2022, 2:13am UTC](https://discuss.elastic.co/t/hunspell-russian-language-problem-with-some-grammar-cases/307575 "2022-06-20T02:13:36Z")
I use Elasticsearch 7.17.4 with docker and hunspell for russian language. My settings for index analysis: "analysis": { "filter": { "my\_stemmer": { "type": "stemmer", "language… --- ## [Kibana 8.2.3, When installed kibana it requires service access token for connection elastic search](https://discuss.elastic.co/t/kibana-8-2-3-when-installed-kibana-it-requires-service-access-token-for-connection-elastic-search/307561)
**Author:** [@MaralErdene\_Tumursuh](https://discuss.elastic.co/u/MaralErdene_Tumursuh)\ **Replies:** 3\ **Last updated:** [June 20, 2022, 1:35am UTC](https://discuss.elastic.co/t/kibana-8-2-3-when-installed-kibana-it-requires-service-access-token-for-connection-elastic-search/307561 "2022-06-20T01:35:33Z")
I installed elastic and kibana 8.2.3 with Java 17 on ubuntu. Firstly I putted Elasticsearch.username, Elasticsearch.password. But it returns error below . Then i tried generate service account token like this. P… --- ## [Merging / Moving two different data paths on the same node](https://discuss.elastic.co/t/merging-moving-two-different-data-paths-on-the-same-node/307555)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 1\ **Last updated:** [June 20, 2022, 12:32am UTC](https://discuss.elastic.co/t/merging-moving-two-different-data-paths-on-the-same-node/307555 "2022-06-20T00:32:05Z")
When configuring a node, you can put multiple data paths in the configuration to spread the data across multiple drives, etc. If we were to upgrade our storage to a faster NVMe drive, how can we merge the two different … --- ## [Need to stop continuous logging of kibana](https://discuss.elastic.co/t/need-to-stop-continuous-logging-of-kibana/307157)
**Author:** [@Amy007](https://discuss.elastic.co/u/Amy007)\ **Replies:** 2\ **Last updated:** [June 19, 2022, 4:08pm UTC](https://discuss.elastic.co/t/need-to-stop-continuous-logging-of-kibana/307157 "2022-06-19T16:08:02Z")
Hi , After starting kibana in my windows machine, I see continuous logging of kibana on console. For eg., if i keep kibana open for 2 hours(without doing any operation at all), i see continuous logging for these 2 hours … --- ## [DSL - How to calculate a percentage value?](https://discuss.elastic.co/t/dsl-how-to-calculate-a-percentage-value/307584)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 1\ **Last updated:** [June 19, 2022, 3:53pm UTC](https://discuss.elastic.co/t/dsl-how-to-calculate-a-percentage-value/307584 "2022-06-19T15:53:42Z")
Hi guys, i'm trying to caclulate the relationship between two values, but i can't get the desired value. This is my (DSL) \_search: { "size": 0, "query": { "bool": { "filter": \[ {"term": {"h.cat": "o… --- ## [Kibana webhook watcher](https://discuss.elastic.co/t/kibana-webhook-watcher/306869)
**Author:** [@dee.lgp](https://discuss.elastic.co/u/dee.lgp)\ **Replies:** 2\ **Last updated:** [June 19, 2022, 11:54am UTC](https://discuss.elastic.co/t/kibana-webhook-watcher/306869 "2022-06-19T11:54:25Z")
''' Hi Team, I am getting the below error when I am trying to execute the webhook watcher. "actions": \[ { "id": "mw", "type": "webhook", "status": "failure", "error": { "root\_cause": \[ { "type": "socket\_timeou… --- ## [Elasticsearch index on blob](https://discuss.elastic.co/t/elasticsearch-index-on-blob/306951)
**Author:** [@Harsh\_Agarwal](https://discuss.elastic.co/u/Harsh_Agarwal)\ **Replies:** 5\ **Last updated:** [June 19, 2022, 11:48am UTC](https://discuss.elastic.co/t/elasticsearch-index-on-blob/306951 "2022-06-19T11:48:11Z")
Is it possible to make a blob which is a compressed binary representation of a string, searchable? --- ## [Merge data neflow and snmp, see description ports in neflow](https://discuss.elastic.co/t/merge-data-neflow-and-snmp-see-description-ports-in-neflow/305580)
**Author:** [@dreshme](https://discuss.elastic.co/u/dreshme)\ **Replies:** 1\ **Last updated:** [June 19, 2022, 11:26am UTC](https://discuss.elastic.co/t/merge-data-neflow-and-snmp-see-description-ports-in-neflow/305580 "2022-06-19T11:26:57Z")
Hello I use ELK 7.17. I get data from filebeat netflow and snmp plugin. I don't know, how i can combine information about interfaces.ifAlias and interfaces.index received from snmp plugin and netflow.egress\_interface… --- ## [Elastic Search Add Ingest Timestamp and Calculate Lag](https://discuss.elastic.co/t/elastic-search-add-ingest-timestamp-and-calculate-lag/307576)
**Author:** [@divyank.gupta](https://discuss.elastic.co/u/divyank.gupta)\ **Replies:** 1\ **Last updated:** [June 18, 2022, 9:25pm UTC](https://discuss.elastic.co/t/elastic-search-add-ingest-timestamp-and-calculate-lag/307576 "2022-06-18T21:25:35Z")
Elasticsearch Experts, need your help to achieve below mention goal. Goal: Try to find a way to calculate lag between the time, log message was generated at application end (@timestamp field) and the time, it was ingest… --- ## [ElasticSearch on AWS EC2](https://discuss.elastic.co/t/elasticsearch-on-aws-ec2/307565)
**Author:** [@chandramouli\_ravi](https://discuss.elastic.co/u/chandramouli_ravi)\ **Replies:** 2\ **Last updated:** [June 18, 2022, 7:58pm UTC](https://discuss.elastic.co/t/elasticsearch-on-aws-ec2/307565 "2022-06-18T19:58:45Z")
Hi, My project is having Elasticsearch running on few EC2 Machines. I want to do 2 things Check ES Query's executed in last 5 minutes or 1 hour Have a tool where i can run SQL on top of Elasticsearch. If user is fro… --- ## [Ingest-attachment plugin in elassandra](https://discuss.elastic.co/t/ingest-attachment-plugin-in-elassandra/307566)
**Author:** [@Harsh\_Agarwal](https://discuss.elastic.co/u/Harsh_Agarwal)\ **Replies:** 3\ **Last updated:** [June 18, 2022, 4:16pm UTC](https://discuss.elastic.co/t/ingest-attachment-plugin-in-elassandra/307566 "2022-06-18T16:16:35Z")
In elassandra: bin/elasticsearch-plugin install ingest-attachment I see: org.elasticsearch.plugins.PluginCli.main(PluginCli.java:48) Caused by: java.lang.IllegalStateException: jar hell! class: org.slf4j.helpers.Bas… --- ## [Logsstash and apache kafka](https://discuss.elastic.co/t/logsstash-and-apache-kafka/307559)
**Author:** [@Henk\_Stobbe](https://discuss.elastic.co/u/Henk_Stobbe)\ **Replies:** 3\ **Last updated:** [June 18, 2022, 3:53pm UTC](https://discuss.elastic.co/t/logsstash-and-apache-kafka/307559 "2022-06-18T15:53:03Z")
hello, Newbee so maybe strange question. In my enviroments Kafka is used and the main reason for this is the ability to temporaly queue data. This functionality is (now) available in logstash. So simple question, can … --- ## [New FileBeat Version required new "Ingest Pipeline"](https://discuss.elastic.co/t/new-filebeat-version-required-new-ingest-pipeline/307497)
**Author:** [@joshn](https://discuss.elastic.co/u/joshn)\ **Replies:** 1\ **Last updated:** [June 18, 2022, 3:50pm UTC](https://discuss.elastic.co/t/new-filebeat-version-required-new-ingest-pipeline/307497 "2022-06-18T15:50:22Z")
hey, So I updated filebeat on a couple machines and got an error: "reason"=\>"pipeline with id \[filebeat-7.17.4-system-syslog-pipeline\] does not exist" After doing some digging, this was because I was previosuly using … --- ## [How yo make a fuzzy query with the new java api](https://discuss.elastic.co/t/how-yo-make-a-fuzzy-query-with-the-new-java-api/307563)
**Author:** [@Dorian](https://discuss.elastic.co/u/Dorian)\ **Replies:** 2\ **Last updated:** [June 18, 2022, 2:38pm UTC](https://discuss.elastic.co/t/how-yo-make-a-fuzzy-query-with-the-new-java-api/307563 "2022-06-18T14:38:21Z")
I try to make a fuzzy query but it doesn't work. Can someone help ? --- ## [Can not log in kibana using super account](https://discuss.elastic.co/t/can-not-log-in-kibana-using-super-account/307557)
**Author:** [@hanifanrn](https://discuss.elastic.co/u/hanifanrn)\ **Replies:** 1\ **Last updated:** [June 18, 2022, 2:23pm UTC](https://discuss.elastic.co/t/can-not-log-in-kibana-using-super-account/307557 "2022-06-18T14:23:06Z")
I have upgrade my ELK to version 8.2 from 7.17.4 it works well before, but after upgrade the RAM of the server, i cannot log in to kibana I try to reset password using: bin/elasticsearch-reset-password -u elastic b… --- ## [Filebeat journald input failing to open a handle to the library](https://discuss.elastic.co/t/filebeat-journald-input-failing-to-open-a-handle-to-the-library/307505)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 2\ **Last updated:** [June 18, 2022, 9:07am UTC](https://discuss.elastic.co/t/filebeat-journald-input-failing-to-open-a-handle-to-the-library/307505 "2022-06-18T09:07:16Z")
Hello everyone, i just managed to compile filebeat to work on armv7 with journald input (regular filestream works just fine) however when starting filebeat i get a following error message, filebeat keeps on running but … --- ## [Metricbeat mysql 8.2.3 fleet integration failing](https://discuss.elastic.co/t/metricbeat-mysql-8-2-3-fleet-integration-failing/307306)
**Author:** [@rbos](https://discuss.elastic.co/u/rbos)\ **Replies:** 7\ **Last updated:** [June 18, 2022, 5:15am UTC](https://discuss.elastic.co/t/metricbeat-mysql-8-2-3-fleet-integration-failing/307306 "2022-06-18T05:15:16Z")
On all my hosts that have upgraded to elastic-agent 8.2.3 (with the RHEL packages), the "mysql" integration is failing with: {"log.level":"error","@timestamp":"2022-06-15T09:01:06.421-0700","log.origin":{"file.name":"lo… --- ## [Assigning specific indices to specific storage devices / data tiers within a node](https://discuss.elastic.co/t/assigning-specific-indices-to-specific-storage-devices-data-tiers-within-a-node/306943)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 2\ **Last updated:** [June 18, 2022, 12:05am UTC](https://discuss.elastic.co/t/assigning-specific-indices-to-specific-storage-devices-data-tiers-within-a-node/306943 "2022-06-18T00:05:19Z")
I know it is possible to add multiple drives as data locations on a specific node but I am curious if it is possible to assign specific indices to a data tier within the same node. We are indexing a lot of data but we ha… --- ## [Painless Script to calculate time difference between 2 dates](https://discuss.elastic.co/t/painless-script-to-calculate-time-difference-between-2-dates/307335)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 1\ **Last updated:** [June 17, 2022, 10:46pm UTC](https://discuss.elastic.co/t/painless-script-to-calculate-time-difference-between-2-dates/307335 "2022-06-17T22:46:38Z")
Hi I have 2 columns as date datatype in my Kibana Index Pattern and I want to add a third column as the difference between the 2 columns: Here is sample and format of the columns: Col1: Jun 16, 2022 , 09:00:00.000 Col2… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=896) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=898)