# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=900 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 901 --- ## [Combine two different aggregation results into one](https://discuss.elastic.co/t/combine-two-different-aggregation-results-into-one/307143)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 2\ **Last updated:** [June 16, 2022, 6:00pm UTC](https://discuss.elastic.co/t/combine-two-different-aggregation-results-into-one/307143 "2022-06-16T18:00:19Z")
We have traffic logs from and to WAN. We need to :slight\_smile: We need to add/aggregate the sentbytes when the source interface is WAN. We need to add/aggregate the receivedbytes when the destination interface is WAN… --- ## [Display All X values](https://discuss.elastic.co/t/display-all-x-values/306804)
**Author:** [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 5:39pm UTC](https://discuss.elastic.co/t/display-all-x-values/306804 "2022-06-16T17:39:39Z")
I'm currently creating a bar chart. However, as you can see, it on shows some of the months, and not all of them. Is there a way to show them all ? Thanks --- ## [Filebeat receives HTTP 405 from Elasticsearch after 7.x -\> 8.1 upgrade](https://discuss.elastic.co/t/filebeat-receives-http-405-from-elasticsearch-after-7-x-8-1-upgrade/303821)
**Author:** [@Specialist](https://discuss.elastic.co/u/Specialist)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 4:21pm UTC](https://discuss.elastic.co/t/filebeat-receives-http-405-from-elasticsearch-after-7-x-8-1-upgrade/303821 "2022-06-16T16:21:37Z")
Hi there, since upgrading to v8.1 Filebeat no longer starts with the following error: Connection marked as failed because the onConnect callback failed: error loading template: failure while checking if template exist… --- ## [\[Metricbeat\] Can't apply rollover when creating indexes](https://discuss.elastic.co/t/metricbeat-cant-apply-rollover-when-creating-indexes/306810)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 15\ **Last updated:** [June 16, 2022, 4:16pm UTC](https://discuss.elastic.co/t/metricbeat-cant-apply-rollover-when-creating-indexes/306810 "2022-06-16T16:16:39Z")
Hello, I have a metricbeat deployed in a kubernetes cluster, I'm trying to create, for each kubernetes namespace, a metricbeat index following this pattern: metricbeat-%{\[agent.version\]}-%{\[kubernetes.namespace\]}-{now/d… --- ## [Kibana visualization for a nested Cardinality aggregation](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 4\ **Last updated:** [June 16, 2022, 4:13pm UTC](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284 "2022-06-16T16:13:09Z")
Hi, I'm trying to create a visualization for the following query: GET \_search { "query": { "query\_string": { "query": "distribution.extension.id:org.xwiki.\* AND date.since:\[1 TO \*\]" } … --- ## [@timestamp to ISO (Europe/Madrid)](https://discuss.elastic.co/t/timestamp-to-iso-europe-madrid/307056)
**Author:** [@Jonathan\_Fernandez](https://discuss.elastic.co/u/Jonathan_Fernandez)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 3:55pm UTC](https://discuss.elastic.co/t/timestamp-to-iso-europe-madrid/307056 "2022-06-16T15:55:41Z")
Hi everyone! So basically I have to parse my UTC timestamp in a set of Elasticsearch Watchers to ISO (Europe/Madrid). IMPORTANT: I cannot use Logstash, quite unsure that use an Ingest Node for this would be permitted, … --- ## [Can we do : Analyser-\>Tokenizer-\>Token Filter-\>Re-tokenize and considers only these last tokens](https://discuss.elastic.co/t/can-we-do-analyser-tokenizer-token-filter-re-tokenize-and-considers-only-these-last-tokens/307298)
**Author:** [@fraf](https://discuss.elastic.co/u/fraf)\ **Replies:** 7\ **Last updated:** [June 16, 2022, 2:36pm UTC](https://discuss.elastic.co/t/can-we-do-analyser-tokenizer-token-filter-re-tokenize-and-considers-only-these-last-tokens/307298 "2022-06-16T14:36:54Z")
Hello, I want, given the input text : { "analyzer": "parapheur\_shingle", "text": "W 4.8.4.1 NI FNA NP 4.8.4 TEST 2" } having fllowing steps : tokenize as standard (word break with spaces =\> 8 tokens) filter … --- ## [Sort based on a Python List (array) and this list is not stored in the Elastic search](https://discuss.elastic.co/t/sort-based-on-a-python-list-array-and-this-list-is-not-stored-in-the-elastic-search/306528)
**Author:** [@Kv\_Karthik](https://discuss.elastic.co/u/Kv_Karthik)\ **Replies:** 4\ **Last updated:** [June 16, 2022, 2:32pm UTC](https://discuss.elastic.co/t/sort-based-on-a-python-list-array-and-this-list-is-not-stored-in-the-elastic-search/306528 "2022-06-16T14:32:52Z")
I would like to sort the hits in my results in a specific order and this order can be made available from a Python list or a python dictionary. I already tried using the script fields like mentioned in Medium website( M… --- ## [Sort data based on result of Vertical axis in vertical Bar graph(lens)](https://discuss.elastic.co/t/sort-data-based-on-result-of-vertical-axis-in-vertical-bar-graph-lens/307392)
**Author:** [@Mohit.Sharma](https://discuss.elastic.co/u/Mohit.Sharma)\ **Replies:** 6\ **Last updated:** [June 16, 2022, 2:01pm UTC](https://discuss.elastic.co/t/sort-data-based-on-result-of-vertical-axis-in-vertical-bar-graph-lens/307392 "2022-06-16T14:01:04Z")
Hello Team, I am new to Kibana & Elasticsearch and trying to create a vertical Bar graph(Lens) that will show top 10 failure Interfaces based on failure percentage and sort interfaces based on percentage of failure. mea… --- ## [Pass multiple values in filter](https://discuss.elastic.co/t/pass-multiple-values-in-filter/307417)
**Author:** [@Abdulaziz](https://discuss.elastic.co/u/Abdulaziz)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 1:51pm UTC](https://discuss.elastic.co/t/pass-multiple-values-in-filter/307417 "2022-06-16T13:51:49Z")
Hi, How can i pass multiple values in kibana - 'add filter' - 'is one of' ? I have a txt file with 500 values ​​in it and want to search them all at once --- ## [Date conversion adds one microsecond](https://discuss.elastic.co/t/date-conversion-adds-one-microsecond/307418)
**Author:** [@sudden](https://discuss.elastic.co/u/sudden)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 1:49pm UTC](https://discuss.elastic.co/t/date-conversion-adds-one-microsecond/307418 "2022-06-16T13:49:24Z")
I'm converting date from string but for some strange reason it sometimes add one microsecond in the timestamp field: logstash 8.1.3 String field: 2022-06-16T13:44:04.615 Logstash code: date { match =\> \[ "fluent\_time… --- ## [Comparison between Elasticsearch version](https://discuss.elastic.co/t/comparison-between-elasticsearch-version/307212)
**Author:** [@Wan\_Nur\_Athirah\_Wan](https://discuss.elastic.co/u/Wan_Nur_Athirah_Wan)\ **Replies:** 4\ **Last updated:** [June 16, 2022, 1:42pm UTC](https://discuss.elastic.co/t/comparison-between-elasticsearch-version/307212 "2022-06-16T13:42:25Z")
Hai there. Do anyone knows how to do comparison or is there any document that shows or list all the changes between this version and other version. example for Elasticsearch version 7.3.1, what is the changes or what has… --- ## [Inquiries about metricbeat disk write visualize](https://discuss.elastic.co/t/inquiries-about-metricbeat-disk-write-visualize/307342)
**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 5\ **Last updated:** [June 16, 2022, 1:39pm UTC](https://discuss.elastic.co/t/inquiries-about-metricbeat-disk-write-visualize/307342 "2022-06-16T13:39:20Z")
hello~! Information on disk write capacity is collected and displayed. As you can see, the maximum capacity is 110 TB. I'm not sure if this is daily data, monthly data, or yearly data. How long is this data? Could i… --- ## [\[Metricbeat\] Can't get metrics: Get https://docker-desktop:10250/stats/summary, (Client.Timeout exceeded while awaiting headers](https://discuss.elastic.co/t/metricbeat-cant-get-metrics-get-https-docker-desktop-10250-stats-summary-client-timeout-exceeded-while-awaiting-headers/307415)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 1:37pm UTC](https://discuss.elastic.co/t/metricbeat-cant-get-metrics-get-https-docker-desktop-10250-stats-summary-client-timeout-exceeded-while-awaiting-headers/307415 "2022-06-16T13:37:40Z")
Hello, Follwoing this post to create index per namespace, I couldn't make metricbeat work to get metrics first from kubernetes. I'm using: ELK v8.2 metricbeat 8.2 kube-state-metrics Microsoft Windows \[version 10.0.19… --- ## [Query to get results based on priority of fields](https://discuss.elastic.co/t/query-to-get-results-based-on-priority-of-fields/307214)
**Author:** [@dawood\_abdullah](https://discuss.elastic.co/u/dawood_abdullah)\ **Replies:** 8\ **Last updated:** [June 16, 2022, 1:31pm UTC](https://discuss.elastic.co/t/query-to-get-results-based-on-priority-of-fields/307214 "2022-06-16T13:31:16Z")
Hi, I have following mapping : \> PUT products \> { \> "mappings" : { \> "properties" : { \> "item\_name" : {"type" : "keyword"}, \> "catalog\_name" : {"type" : "keyword"}, \> "group" : {"type" : "keyword"}, \> "l… --- ## [Confusion around geo.country\_iso\_code vs country\_code2](https://discuss.elastic.co/t/confusion-around-geo-country-iso-code-vs-country-code2/306857)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [June 16, 2022, 1:06pm UTC](https://discuss.elastic.co/t/confusion-around-geo-country-iso-code-vs-country-code2/306857 "2022-06-16T13:06:14Z")
When we parse an IP for geo info using: geoip { source =\> "ip" target =\> "client" fields =\> \["location", "country\_code2", "country\_name"\] } LogStash creates documents with: client: { geo: { country\_iso\_c… --- ## [Grok Pattern for dynamic json](https://discuss.elastic.co/t/grok-pattern-for-dynamic-json/307408)
**Author:** [@Ahmad\_Ahsan\_Saleem](https://discuss.elastic.co/u/Ahmad_Ahsan_Saleem)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 1:01pm UTC](https://discuss.elastic.co/t/grok-pattern-for-dynamic-json/307408 "2022-06-16T13:01:15Z")
Hi, My data is coming live from spring boot logs and in successful execution the logs show in json format (each json has different input fields).In case of any error the logs show error with a string format Here is a s… --- ## [Where can we find the data from apache integration](https://discuss.elastic.co/t/where-can-we-find-the-data-from-apache-integration/307397)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 12:55pm UTC](https://discuss.elastic.co/t/where-can-we-find-the-data-from-apache-integration/307397 "2022-06-16T12:55:32Z")
We have installed elastic agent in a client system (apache server) and enrolled it in the fleet. We have added apache http server integration to its policy. We can see the data in /var/log/apache2/access.log of the apa… --- ## [\[WARNING\] No throughput metrics available for \[index-append\]. Likely cause: The benchmark ended already during warmup](https://discuss.elastic.co/t/warning-no-throughput-metrics-available-for-index-append-likely-cause-the-benchmark-ended-already-during-warmup/306935)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 9\ **Last updated:** [June 16, 2022, 11:11am UTC](https://discuss.elastic.co/t/warning-no-throughput-metrics-available-for-index-append-likely-cause-the-benchmark-ended-already-during-warmup/306935 "2022-06-16T11:11:16Z")
cluster is running on kubernetes NUMBER\_OF\_SHARDS=${NUMBER\_OF\_SHARDS:-10} NUMBER\_OF\_REPLICAS=${NUMBER\_OF\_REPLICAS:-0} INGEST\_PERCENTAGE=${INGEST\_PERCENTAGE:-100} BULK\_SIZE=${BULK\_SIZE:-5000} BULK\_INDEXING\_CLIENTS=${BULK… --- ## [LOG SOURCES](https://discuss.elastic.co/t/log-sources/307137)
**Author:** [@mkibani](https://discuss.elastic.co/u/mkibani)\ **Replies:** 2\ **Last updated:** [June 16, 2022, 11:06am UTC](https://discuss.elastic.co/t/log-sources/307137 "2022-06-16T11:06:38Z")
Hello, I'am fairly new to ELK STACK, and i'm wondering if there's way to list all of the log sources integrated with the STACK, i received bunch of logs from multiple security solutions and i would love to list all the … --- ## [Best way to contains search in elastic search](https://discuss.elastic.co/t/best-way-to-contains-search-in-elastic-search/307369)
**Author:** [@khasim\_vali\_dudekula](https://discuss.elastic.co/u/khasim_vali_dudekula)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 11:01am UTC](https://discuss.elastic.co/t/best-way-to-contains-search-in-elastic-search/307369 "2022-06-16T11:01:36Z")
Hi, I am working on a use case which does contains search in logs data indexed in elastic server. the query is a case-insensitive one I am aware of match, match\_phrase and query string. But none of the seems to be wor… --- ## [ILM not working correctly or is stuck somewhere](https://discuss.elastic.co/t/ilm-not-working-correctly-or-is-stuck-somewhere/307387)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 10:47am UTC](https://discuss.elastic.co/t/ilm-not-working-correctly-or-is-stuck-somewhere/307387 "2022-06-16T10:47:29Z")
We have some problem with ILM not working as intended, at least it seems like that. We have added cold node to the cluster and I have set up policy logs to default levels - 50Gb or 30days, as our hot instance allows tha… --- ## [How to use search-ui Conditional Facets](https://discuss.elastic.co/t/how-to-use-search-ui-conditional-facets/307386)
**Author:** [@fkvivid](https://discuss.elastic.co/u/fkvivid)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 10:44am UTC](https://discuss.elastic.co/t/how-to-use-search-ui-conditional-facets/307386 "2022-06-16T10:44:29Z")
How to use Conditional Facets in my App-search I read the example github elastic docs but not working any help :pray: Target: if choose California of states Then show conditional Facet Here is a national park example … --- ## [Filebeat 7.17.3 invalid CRI log format error](https://discuss.elastic.co/t/filebeat-7-17-3-invalid-cri-log-format-error/307130)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 5\ **Last updated:** [June 16, 2022, 10:17am UTC](https://discuss.elastic.co/t/filebeat-7-17-3-invalid-cri-log-format-error/307130 "2022-06-16T10:17:01Z")
I am getting various CRI parsing errors, on Filebeat 7.17.3. I have cleared all filebeat state and restarted Filebeat, but these errors always occur. Here are a couple: FYI :- I am using Nomad containers. ERROR \[rea… --- ## [Collapse in In-group and out-of-group sorting problem](https://discuss.elastic.co/t/collapse-in-in-group-and-out-of-group-sorting-problem/307378)
**Author:** [@EaChou](https://discuss.elastic.co/u/EaChou)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 10:01am UTC](https://discuss.elastic.co/t/collapse-in-in-group-and-out-of-group-sorting-problem/307378 "2022-06-16T10:01:57Z")
I want to group by a certain field, take only one of each group, and then sort by this document outside the group I used collapse to group and deduplicate, but after deduplication, it is not the first result after sorti… --- ## [Get sum of created metrics](https://discuss.elastic.co/t/get-sum-of-created-metrics/307311)
**Author:** [@chamod\_maduranga](https://discuss.elastic.co/u/chamod_maduranga)\ **Replies:** 7\ **Last updated:** [June 16, 2022, 10:11am UTC](https://discuss.elastic.co/t/get-sum-of-created-metrics/307311 "2022-06-16T10:11:18Z")
what i need to get is get top hits for each TYPE and need to get the summation of them. For this example summation should be 25(1+1+1+22). .Can i get 25 as in one metric visual so that i can add to dashboard as one … --- ## [Can we use same index for 2 different sources?](https://discuss.elastic.co/t/can-we-use-same-index-for-2-different-sources/307366)
**Author:** [@Avinash\_Pattnaik](https://discuss.elastic.co/u/Avinash_Pattnaik)\ **Replies:** 3\ **Last updated:** [June 16, 2022, 9:46am UTC](https://discuss.elastic.co/t/can-we-use-same-index-for-2-different-sources/307366 "2022-06-16T09:46:45Z")
Hello, I am new to Elastic and have a query. We are feeding Elastic with logs from our VMware infrastructure via vrops. All vrops logs are uploaded to Elastic with the index check\_vrops.mm.yyyy Now, I want to send some… --- ## [Retention policy for Transform's index](https://discuss.elastic.co/t/retention-policy-for-transforms-index/306767)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 9:11am UTC](https://discuss.elastic.co/t/retention-policy-for-transforms-index/306767 "2022-06-16T09:11:19Z")
Hi, If I set a retention policy on a Transform, like 7 days, the whole index will be deleted after 7 days. How can I set up something like "delete the data older than 7 days, and keep the rest alive"? Thanks! --- ## [Query field value to reindex existing indexes](https://discuss.elastic.co/t/query-field-value-to-reindex-existing-indexes/307367)
**Author:** [@dapmI](https://discuss.elastic.co/u/dapmI)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 9:07am UTC](https://discuss.elastic.co/t/query-field-value-to-reindex-existing-indexes/307367 "2022-06-16T09:07:52Z")
Hello, I'm trying to achieve a complex action where we currently have a common index filebeat-%{beat version}-%{YY-mm-dd} type of index with multiple log.file.path different. The idea is to have them in other index depe… --- ## [Anyone has a performance evaluation with NGram tokenizer?](https://discuss.elastic.co/t/anyone-has-a-performance-evaluation-with-ngram-tokenizer/307356)
**Author:** [@fraf](https://discuss.elastic.co/u/fraf)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 8:59am UTC](https://discuss.elastic.co/t/anyone-has-a-performance-evaluation-with-ngram-tokenizer/307356 "2022-06-16T08:59:09Z")
Hello searchers, I think, one of the best tokenizer algorithm (and maybe the most used), is the NGram tokenizer (equivalent to the SQL : where table.column like '%search\_text%'. Indeed, given an input text, it can gene… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=899) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=901)