# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=910 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 911 --- ## [PIT on alias with filter](https://discuss.elastic.co/t/pit-on-alias-with-filter/306715)
**Author:** [@mhugo](https://discuss.elastic.co/u/mhugo)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 2:42pm UTC](https://discuss.elastic.co/t/pit-on-alias-with-filter/306715 "2022-06-08T14:42:28Z")
Hi, I am trying to understand the resource demand for pagination queries over large datasets using search\_after and a Point-In-Time. The application I work on exposes "datasets" to its customers. These datasets may be … --- ## [esrally.exceptions.LaunchError: Daemon startup failed with exit code \[1\] on Elasticsearch post 8.0.0 version](https://discuss.elastic.co/t/esrally-exceptions-launcherror-daemon-startup-failed-with-exit-code-1-on-elasticsearch-post-8-0-0-version/306714)
**Author:** [@Gsqsf](https://discuss.elastic.co/u/Gsqsf)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 2:40pm UTC](https://discuss.elastic.co/t/esrally-exceptions-launcherror-daemon-startup-failed-with-exit-code-1-on-elasticsearch-post-8-0-0-version/306714 "2022-06-08T14:40:08Z")
Similar to the problem esrally.exceptions.LaunchError: Daemon startup failed with exit code \[1\] I had the error code esrally.exceptions.LaunchError: Daemon startup failed with exit code \[1\] with the command: esrally ra… --- ## [Are these reasonable/expected metrics for an idle cluster?](https://discuss.elastic.co/t/are-these-reasonable-expected-metrics-for-an-idle-cluster/306644)
**Author:** [@AS11](https://discuss.elastic.co/u/AS11)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:30am UTC](https://discuss.elastic.co/t/are-these-reasonable-expected-metrics-for-an-idle-cluster/306644 "2022-06-08T07:30:16Z")
For an idle 3-node cluster (7.17.4), where all nodes are masters, i.e. listed under initial\_master\_nodes, is it normal that: Documents merged rate, red-bordered on the image below, would be on the order of 1000/s on a… --- ## [No alert on missing data - Kibana](https://discuss.elastic.co/t/no-alert-on-missing-data-kibana/305792)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 2:16pm UTC](https://discuss.elastic.co/t/no-alert-on-missing-data-kibana/305792 "2022-06-08T14:16:09Z")
Hello, I have set up alerts on the metric threshold like the one below. But when I stop the metricbeat on a server the state from "Active" changes to "Recovered" and no missing data alert is created. I was testin… --- ## [Opendistro Alerting indices retrieves nothing](https://discuss.elastic.co/t/opendistro-alerting-indices-retrieves-nothing/306707)
**Author:** [@noob2](https://discuss.elastic.co/u/noob2)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 2:05pm UTC](https://discuss.elastic.co/t/opendistro-alerting-indices-retrieves-nothing/306707 "2022-06-08T14:05:25Z")
Hi Team, I am facing some issue in opendistro kibana v7.10.2, The created alerts are not stored in Alerting index .opendistro-alerting-config as per opendistro documentation. But i can the see functionality working we… --- ## [Logstash not sending all data to elasti search](https://discuss.elastic.co/t/logstash-not-sending-all-data-to-elasti-search/306699)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 1:39pm UTC](https://discuss.elastic.co/t/logstash-not-sending-all-data-to-elasti-search/306699 "2022-06-08T13:39:31Z")
Hi, My logstash is getting data continuously. I know this because I can see it at the logs (logstash debugging mode) but the if I go to kibana I see that 8 or 7 hrs ago I got 10 min of data and that was it when it was … --- ## [Remove documents with existing value in given field](https://discuss.elastic.co/t/remove-documents-with-existing-value-in-given-field/306572)
**Author:** [@fran\_hernandez](https://discuss.elastic.co/u/fran_hernandez)\ **Replies:** 4\ **Last updated:** [June 8, 2022, 1:09pm UTC](https://discuss.elastic.co/t/remove-documents-with-existing-value-in-given-field/306572 "2022-06-08T13:09:33Z")
Hello, I am trying to delete or pipe (Delete), an event that already has the same indexed value for a given field. The scenario is as follows: I have a fleet server and an agent to fetch logs from AD Server, Windows f… --- ## [How to update a single field using the Java API Client?](https://discuss.elastic.co/t/how-to-update-a-single-field-using-the-java-api-client/306679)
**Author:** [@dsc](https://discuss.elastic.co/u/dsc)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 12:33pm UTC](https://discuss.elastic.co/t/how-to-update-a-single-field-using-the-java-api-client/306679 "2022-06-08T12:33:34Z")
I'm currently using the deprecated Java High Level REST Client to partially update a document using something similar to the guide: Update API | Java REST Client \[7.17\] | Elastic I'm trying to migrate to the latest Elas… --- ## [Not able to add Elasticsearch Cloud in Azure due to required "Subscription owner" permission not allowed](https://discuss.elastic.co/t/not-able-to-add-elasticsearch-cloud-in-azure-due-to-required-subscription-owner-permission-not-allowed/306197)
**Author:** [@arunvelu](https://discuss.elastic.co/u/arunvelu)\ **Replies:** 4\ **Last updated:** [June 8, 2022, 12:10pm UTC](https://discuss.elastic.co/t/not-able-to-add-elasticsearch-cloud-in-azure-due-to-required-subscription-owner-permission-not-allowed/306197 "2022-06-08T12:10:36Z")
Hello, We are looking to try Elasticsearch in Azure for analyzing the application's log data. To do this, I planned on creating an instance in Azure, but I get an error message at creation – “Validation failed. Only sub… --- ## [Getting incorrect inner hits from parent child relationship when combined with boolean query](https://discuss.elastic.co/t/getting-incorrect-inner-hits-from-parent-child-relationship-when-combined-with-boolean-query/306688)
**Author:** [@Mohammad\_Parsa](https://discuss.elastic.co/u/Mohammad_Parsa)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 11:26am UTC](https://discuss.elastic.co/t/getting-incorrect-inner-hits-from-parent-child-relationship-when-combined-with-boolean-query/306688 "2022-06-08T11:26:52Z")
Hi Everyone I am getting incorrect inner hits results when combining parent-child query with boolean query. To reproduce the issue, I create this Index PUT /my-index-000001 { "mappings": { "\_routing": { "r… --- ## [Find nested document by min value of its field and apply another filters on this document](https://discuss.elastic.co/t/find-nested-document-by-min-value-of-its-field-and-apply-another-filters-on-this-document/306689)
**Author:** [@Nat123](https://discuss.elastic.co/u/Nat123)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 11:31am UTC](https://discuss.elastic.co/t/find-nested-document-by-min-value-of-its-field-and-apply-another-filters-on-this-document/306689 "2022-06-08T11:31:27Z")
Hello, I have a document (user) and a list of nested documents (orders) in Elastic. I need to find a user with an order satisfied a bunch of conditions: the status of order should have some specific value, its id should… --- ## [Multiple alerts from a single watch script - feasible?](https://discuss.elastic.co/t/multiple-alerts-from-a-single-watch-script-feasible/306685)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 11:14am UTC](https://discuss.elastic.co/t/multiple-alerts-from-a-single-watch-script-feasible/306685 "2022-06-08T11:14:22Z")
Hi All, Let me brief the scenario and the objective. The requirement is to create watcher alerts for different items where the threshold and timeframe are the same. Now to make it happen, I have created separate watch… --- ## [How to write kql query in kibana to include only 9 characters of a field?](https://discuss.elastic.co/t/how-to-write-kql-query-in-kibana-to-include-only-9-characters-of-a-field/306672)
**Author:** [@Arifullah](https://discuss.elastic.co/u/Arifullah)\ **Replies:** 5\ **Last updated:** [June 8, 2022, 11:02am UTC](https://discuss.elastic.co/t/how-to-write-kql-query-in-kibana-to-include-only-9-characters-of-a-field/306672 "2022-06-08T11:02:04Z")
I am using kibana 8.1 so I want to filter the data in discover section. Tha index has a field whic is in number format and it has different kinds of numbers which range from 4 characters up to 12 or 13 characters. So I w… --- ## [Increase max\_bucket to 60,000 or make 6 msearch returning 10,000 buckets each?](https://discuss.elastic.co/t/increase-max-bucket-to-60-000-or-make-6-msearch-returning-10-000-buckets-each/306480)
**Author:** [@misterone](https://discuss.elastic.co/u/misterone)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 10:50am UTC](https://discuss.elastic.co/t/increase-max-bucket-to-60-000-or-make-6-msearch-returning-10-000-buckets-each/306480 "2022-06-08T10:50:55Z")
hey, I have a query that does this. It's a bunch of terms aggregations. (group by = terms) filter by date from year 2015 to 2020 group by region group by date from year 2015 to 2020 group by country grou… --- ## [Elasticsearch input plugin used to \_count documents. Is it possible?](https://discuss.elastic.co/t/elasticsearch-input-plugin-used-to-count-documents-is-it-possible/306682)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-used-to-count-documents-is-it-possible/306682 "2022-06-08T10:46:44Z")
Hey there, I was trying to use the Elasticsearch input plugin just to count documents in a specific timerange or to count the specific \_type documents or so on, but I saw that I cannot use the \_count method and I saw al… --- ## [Kubernetes Application Logs to App Specific Indexes](https://discuss.elastic.co/t/kubernetes-application-logs-to-app-specific-indexes/306670)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 9:49am UTC](https://discuss.elastic.co/t/kubernetes-application-logs-to-app-specific-indexes/306670 "2022-06-08T09:49:46Z")
We have filebeat collecting logs in kubernetes. We use a data view that is created to view these logs filebeat-\*. Using the filebeat indexes to search our logs has been working fine up until now, but now we are starti… --- ## [Numeric values on timeline](https://discuss.elastic.co/t/numeric-values-on-timeline/306548)
**Author:** [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)\ **Replies:** 6\ **Last updated:** [June 8, 2022, 9:36am UTC](https://discuss.elastic.co/t/numeric-values-on-timeline/306548 "2022-06-08T09:36:20Z")
Hello Kibana users! Can anyone suggest me how can I represent numeric values on a timeline?he fields I'm referrering to are @timestamp and used.bytes; I want to see the distribution of this field over time. thank you in… --- ## [Group by kibana Query](https://discuss.elastic.co/t/group-by-kibana-query/306617)
**Author:** [@chamod\_maduranga](https://discuss.elastic.co/u/chamod_maduranga)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 9:08am UTC](https://discuss.elastic.co/t/group-by-kibana-query/306617 "2022-06-08T09:08:46Z")
I have fields ID, Type, Count and timestamp as follows: { "ID": "15211", "Type": "C", "count": "17", "timestamp": "Jun 3, 2022 @ 12:26:34.000",....}, { "ID": "11243", "Type": "C", "count": "64", "timestamp": "Jun 1, 202… --- ## [How to install kibana and logstash as service in windows server](https://discuss.elastic.co/t/how-to-install-kibana-and-logstash-as-service-in-windows-server/306587)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 8:57am UTC](https://discuss.elastic.co/t/how-to-install-kibana-and-logstash-as-service-in-windows-server/306587 "2022-06-08T08:57:53Z")
How to install kibana and logstash as service in windows server? Can please someone help with the command --- ## [How to identify whether a elasticsearch document is modified or not?](https://discuss.elastic.co/t/how-to-identify-whether-a-elasticsearch-document-is-modified-or-not/306537)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 8:37am UTC](https://discuss.elastic.co/t/how-to-identify-whether-a-elasticsearch-document-is-modified-or-not/306537 "2022-06-08T08:37:38Z")
Hi All, If a logstash pipeline (conf file) is used to update and insert both i.e., enabled below in the conf file. doc\_as\_upsert =\> true action =\> "update" How to know which documents are updated and which are inserte… --- ## [Testing DNS Performance](https://discuss.elastic.co/t/testing-dns-performance/306652)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 8:26am UTC](https://discuss.elastic.co/t/testing-dns-performance/306652 "2022-06-08T08:26:56Z")
I've installed packetbeat on a windows dns server to try and get some insight into requests and performance Is there anything specific I should be looking at from the dashboard to find out if there are issues I'm looki… --- ## [Timelion Aggregate graph with different interval/condition](https://discuss.elastic.co/t/timelion-aggregate-graph-with-different-interval-condition/306651)
**Author:** [@Robert\_Naccache](https://discuss.elastic.co/u/Robert_Naccache)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 8:15am UTC](https://discuss.elastic.co/t/timelion-aggregate-graph-with-different-interval-condition/306651 "2022-06-08T08:15:40Z")
Hello, I'm trying to create a Timelion aggregation and wondering if its possible. Basically the case is, I have documents that includes http response codes. What i'm trying to do is: The default interval could be day… --- ## [Granting Privileges on Datastream Alias not the same in Backing Indices](https://discuss.elastic.co/t/granting-privileges-on-datastream-alias-not-the-same-in-backing-indices/306643)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:28am UTC](https://discuss.elastic.co/t/granting-privileges-on-datastream-alias-not-the-same-in-backing-indices/306643 "2022-06-08T07:28:08Z")
I'm using filebeat and i have created 3 datastreams . PUT \_data\_stream/data\_s1-2022.06.08 PUT \_data\_stream/data\_s2-2022.06.08 PUT \_data\_stream/data\_s3-2022.06.08 And created 3 alias for that datastreams: POST \_aliases… --- ## [Aggregration buckets can access in Elasticsearch query of "Rules and Connectors"](https://discuss.elastic.co/t/aggregration-buckets-can-access-in-elasticsearch-query-of-rules-and-connectors/306641)
**Author:** [@hari\_priya1](https://discuss.elastic.co/u/hari_priya1)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:17am UTC](https://discuss.elastic.co/t/aggregration-buckets-can-access-in-elasticsearch-query-of-rules-and-connectors/306641 "2022-06-08T07:17:58Z")
I am trying to trigger an alert if BindRequestCount is zero for the last 30 mins. So I have created a rule using the Elasticsearch query rule type. { "query": { "bool": { "must": \[ { "term"… --- ## [How to search in attachment content?](https://discuss.elastic.co/t/how-to-search-in-attachment-content/305287)
**Author:** [@frankmehlhop](https://discuss.elastic.co/u/frankmehlhop)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 7:17am UTC](https://discuss.elastic.co/t/how-to-search-in-attachment-content/305287 "2022-06-08T07:17:33Z")
I ingest pdf files into elastic. I can successful search in it using Kibana Console. But at my C# code I don't get any result. I'm quit sure the problem is syntax of my code. But I tried many things and still I don't… --- ## [ELK 7.16.2 hardware requirements - suggestions?](https://discuss.elastic.co/t/elk-7-16-2-hardware-requirements-suggestions/306475)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 7\ **Last updated:** [June 8, 2022, 7:12am UTC](https://discuss.elastic.co/t/elk-7-16-2-hardware-requirements-suggestions/306475 "2022-06-08T07:12:07Z")
Hi Guys, I am using the ELK stack in version 7.16.2 and I would like to ask for some suggestions about the hardware configuration. My Elastic will receive a log of 5 MB every day and I would like to have a retention of … --- ## [Configuration of Logstash to remove domain from URL](https://discuss.elastic.co/t/configuration-of-logstash-to-remove-domain-from-url/305667)
**Author:** [@wii](https://discuss.elastic.co/u/wii)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 6:06am UTC](https://discuss.elastic.co/t/configuration-of-logstash-to-remove-domain-from-url/305667 "2022-06-08T06:06:17Z")
Is it possible to configure Logstash to remove domain name when receiving URL input? E.g: Picture above as an example, I would like to eliminate everthing behind 'path' to send to Elasticsearch. If it is possible, ma… --- ## [Visualize datatable : reformat aggrated value](https://discuss.elastic.co/t/visualize-datatable-reformat-aggrated-value/306562)
**Author:** [@Espen\_Schulstad](https://discuss.elastic.co/u/Espen_Schulstad)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 5:38am UTC](https://discuss.elastic.co/t/visualize-datatable-reformat-aggrated-value/306562 "2022-06-08T05:38:44Z")
Hi, I'd like to use a value in an aggregation to create a link in the datatable. Is this possible? Eg; in the datatable I have a value "specific app name", I'd like to reformat that value to be a string that ends up as… --- ## [Updating only a single field of an elasticsearch data through logstash](https://discuss.elastic.co/t/updating-only-a-single-field-of-an-elasticsearch-data-through-logstash/306540)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 8:37am UTC](https://discuss.elastic.co/t/updating-only-a-single-field-of-an-elasticsearch-data-through-logstash/306540 "2022-06-07T08:37:48Z")
I have a logstash pipeline put into place through which I am getting logs. I want to handle a use-case through logstash configuration in which I have to append a particular value to a field. Currently, it is happening th… --- ## [How to install Kibana and logstash as service in winodws?](https://discuss.elastic.co/t/how-to-install-kibana-and-logstash-as-service-in-winodws/306622)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 4:15am UTC](https://discuss.elastic.co/t/how-to-install-kibana-and-logstash-as-service-in-winodws/306622 "2022-06-08T04:15:09Z")
how to install Kibana and logstash(v.7.17.3) as service in winodws can please someone help with command line [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=909) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=911)