# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=917 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 918 --- ## [Results are showing different than expected](https://discuss.elastic.co/t/results-are-showing-different-than-expected/306102)
**Author:** [@akshay\_bhardwaj](https://discuss.elastic.co/u/akshay_bhardwaj)\ **Replies:** 2\ **Last updated:** [June 2, 2022, 7:27am UTC](https://discuss.elastic.co/t/results-are-showing-different-than-expected/306102 "2022-06-02T07:27:49Z")
I take a sum of a column to visualize a bar chart but results are showing different that i expected. as shown in below picture:-1453.42299 My values are like 8.533,9.64,5.03.8.238 How i round up these values so that i… --- ## [Trying to build grok pattern for impossible logfile fetched with filebeat sent to logstash](https://discuss.elastic.co/t/trying-to-build-grok-pattern-for-impossible-logfile-fetched-with-filebeat-sent-to-logstash/306192)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 0\ **Last updated:** [June 2, 2022, 7:10am UTC](https://discuss.elastic.co/t/trying-to-build-grok-pattern-for-impossible-logfile-fetched-with-filebeat-sent-to-logstash/306192 "2022-06-02T07:10:33Z")
I've gotten this logfile from UNICA by IBM. It's impossible :slight\_smile: A few lines of example. 18 feb 2016 10:37:46,292 - ERROR - An error occured while scanning for the next trigger to fire. org.quartz.JobPersiste… --- ## [Can't get highlighted results using Java High Level Rest Client](https://discuss.elastic.co/t/cant-get-highlighted-results-using-java-high-level-rest-client/305261)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 17\ **Last updated:** [June 2, 2022, 6:53am UTC](https://discuss.elastic.co/t/cant-get-highlighted-results-using-java-high-level-rest-client/305261 "2022-06-02T06:53:37Z")
I am using Java 1.8 and Elasticsearch 7.12.0. Hello, I am trying to get Highlighter to work but all i'm getting is the whole document in which word is available and I should get only the snippets of the highlighted word… --- ## [ElasticSearch Java RESTAPI dout?](https://discuss.elastic.co/t/elasticsearch-java-restapi-dout/306117)
**Author:** [@Maheee000](https://discuss.elastic.co/u/Maheee000)\ **Replies:** 3\ **Last updated:** [June 2, 2022, 6:45am UTC](https://discuss.elastic.co/t/elasticsearch-java-restapi-dout/306117 "2022-06-02T06:45:30Z")
Hi Team, PFA and how to I do in java with dynamic field value and dynamic boolqueries. In this part dynamic values comes from CSV file. BoolQueries : must, should, mustnot --- it will change user purpose Queries:--… --- ## [Is there a straight forward method of cloning an index on one cluster from another cluster](https://discuss.elastic.co/t/is-there-a-straight-forward-method-of-cloning-an-index-on-one-cluster-from-another-cluster/306180)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [June 2, 2022, 6:45am UTC](https://discuss.elastic.co/t/is-there-a-straight-forward-method-of-cloning-an-index-on-one-cluster-from-another-cluster/306180 "2022-06-02T06:45:00Z")
I am setting up a test cluster and want to copy all the index definitions from the production one. --- ## [Elasticsearch Can I create a calculated dashboard (GB) per day?](https://discuss.elastic.co/t/elasticsearch-can-i-create-a-calculated-dashboard-gb-per-day/306179)
**Author:** [@Tassanai\_Chopseang](https://discuss.elastic.co/u/Tassanai_Chopseang)\ **Replies:** 3\ **Last updated:** [June 2, 2022, 6:44am UTC](https://discuss.elastic.co/t/elasticsearch-can-i-create-a-calculated-dashboard-gb-per-day/306179 "2022-06-02T06:44:45Z")
I want to make a dashboard to monitor instead of running a backyard query. :face\_holding\_back\_tears: --- ## [LOGSTASH DISCOVER FILES EACH 3 HOURS APROX](https://discuss.elastic.co/t/logstash-discover-files-each-3-hours-aprox/306186)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 0\ **Last updated:** [June 2, 2022, 6:00am UTC](https://discuss.elastic.co/t/logstash-discover-files-each-3-hours-aprox/306186 "2022-06-02T06:00:52Z")
Hi! I'm started a new pipeline for reading xml from a cifs mounted unit from a Windows Server in my centos server, the issue I have is that logstash reads the unit each 3 hours and I don't know why, I'm indexing old fil… --- ## [Date math in index name error in 8.1.3](https://discuss.elastic.co/t/date-math-in-index-name-error-in-8-1-3/305186)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 12\ **Last updated:** [May 27, 2022, 2:19am UTC](https://discuss.elastic.co/t/date-math-in-index-name-error-in-8-1-3/305186 "2022-05-27T02:19:31Z")
Per the doc, I'm trying to create an index with the date in it's name: PUT /%3Call-dns-%7Bnow%2Fd%7D%-0000013E?pretty { "aliases": { "all-dns": { "is\_write\_index": true } } } But I'm getting this erro… --- ## [Vega scatter plot based on array of points in document](https://discuss.elastic.co/t/vega-scatter-plot-based-on-array-of-points-in-document/305252)
**Author:** [@qd-danh](https://discuss.elastic.co/u/qd-danh)\ **Replies:** 4\ **Last updated:** [June 2, 2022, 5:16am UTC](https://discuss.elastic.co/t/vega-scatter-plot-based-on-array-of-points-in-document/305252 "2022-06-02T05:16:17Z")
I have been working through simple scatter plots, boxplots in Kibana with Vega. Now I'm getting to what I actually need to render. Each document from elastic has an array of points. From a query, I will likely have up t… --- ## [Custom sorting query results by index name with scripting](https://discuss.elastic.co/t/custom-sorting-query-results-by-index-name-with-scripting/306176)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 0\ **Last updated:** [June 2, 2022, 1:29am UTC](https://discuss.elastic.co/t/custom-sorting-query-results-by-index-name-with-scripting/306176 "2022-06-02T01:29:55Z")
I have 4 indexes: first, second, third, fourth. I have a query that searches text on a field called "name" against all indexes. POST /\_all/\_search?pretty { "\_source": \["name"\], "query": { "match": { "nam… --- ## [Custom beat to monitor a file in a server folder is possible?](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142)
**Author:** [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)\ **Replies:** 2\ **Last updated:** [June 2, 2022, 12:50am UTC](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142 "2022-06-02T00:50:17Z")
I have a doubt in making a custom beat that reads or monitors the state of a file, example: In a server, a file is within the Inbound folder if stays the file for more than 5 minutes in this folder and doesnt move to th… --- ## [Kibana alert | Custom interval](https://discuss.elastic.co/t/kibana-alert-custom-interval/306109)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 10:28am UTC](https://discuss.elastic.co/t/kibana-alert-custom-interval/306109 "2022-06-01T10:28:28Z")
Hello guys, I have an alert created on Kibana that checks when a host is running or not. But i want to disallow that alert when the time is between 22:00PM and 9:30AM. During that time interval i will be shutting down m… --- ## [Fleet Managed Pipelines and Indexes](https://discuss.elastic.co/t/fleet-managed-pipelines-and-indexes/306058)
**Author:** [@kinderrs](https://discuss.elastic.co/u/kinderrs)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 5:44pm UTC](https://discuss.elastic.co/t/fleet-managed-pipelines-and-indexes/306058 "2022-05-31T17:44:54Z")
I have the integration for Nginx installed on my cloud deployment, monitoring and ingesting logs from a container deployment of the Nginx proxy. The integration for Nginx appears to be looking for an access log format t… --- ## [Transferred bytes Y-axis labels need to be more rounded up](https://discuss.elastic.co/t/transferred-bytes-y-axis-labels-need-to-be-more-rounded-up/306169)
**Author:** [@tee101](https://discuss.elastic.co/u/tee101)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 11:28pm UTC](https://discuss.elastic.co/t/transferred-bytes-y-axis-labels-need-to-be-more-rounded-up/306169 "2022-06-01T23:28:44Z")
Here is a picture from Create your first dashboard | Kibana Guide \[8.2\] | Elastic The transferred bytes labels are 1.53MB, 1.34MB, 1.14MB, etc. The ask is to make them into more rounded numbers. Like, 100, 200, 300, 4… --- ## [Sort multi-index query by index name alphabetically](https://discuss.elastic.co/t/sort-multi-index-query-by-index-name-alphabetically/306171)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 10:55pm UTC](https://discuss.elastic.co/t/sort-multi-index-query-by-index-name-alphabetically/306171 "2022-06-01T22:55:35Z")
In other words, how can I "boost" indices based on their alphabetical order? --- ## [Merging multiple queries](https://discuss.elastic.co/t/merging-multiple-queries/306099)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 9:49pm UTC](https://discuss.elastic.co/t/merging-multiple-queries/306099 "2022-06-01T21:49:49Z")
I have 3 queries as following First query gives us the file name of the content we search. First query GET all\_files/\_search?scroll=1m { "\_source": "file.filename", "query": { "match\_phrase": { "content": { "que… --- ## [FSCrawler - OCR not working anymore in 2.9 without Tesseract location in PATH](https://discuss.elastic.co/t/fscrawler-ocr-not-working-anymore-in-2-9-without-tesseract-location-in-path/306128)
**Author:** [@HaroldH](https://discuss.elastic.co/u/HaroldH)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 9:46pm UTC](https://discuss.elastic.co/t/fscrawler-ocr-not-working-anymore-in-2-9-without-tesseract-location-in-path/306128 "2022-06-01T21:46:54Z")
Hello, Upgrading FSCrawler from 2.7 to 2.9 I noticed that with our configuration OCR wasn't working anymore. In our \_settings.yaml file we set the path to Tesseract we like below: ocr: language: "eng+nld" pat… --- ## [Type usage in libbeat/outputs/elasticsearch/client causes issue on OpenSearch 2.0+ engine](https://discuss.elastic.co/t/type-usage-in-libbeat-outputs-elasticsearch-client-causes-issue-on-opensearch-2-0-engine/306166)
**Author:** [@Suraj\_Singh](https://discuss.elastic.co/u/Suraj_Singh)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 9:40pm UTC](https://discuss.elastic.co/t/type-usage-in-libbeat-outputs-elasticsearch-client-causes-issue-on-opensearch-2-0-engine/306166 "2022-06-01T21:40:44Z")
With \_type removal in OpenSearch 2.0+ (previously deprecated in Elasticsearch 7.x); beat still uses \_type as DocType while building BulkRequest meta data; resulting in illegal\_argument\_exception from OpenSearch engine. E… --- ## [Cannot import elastic RPM GPG key on EL9](https://discuss.elastic.co/t/cannot-import-elastic-rpm-gpg-key-on-el9/306164)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 9:32pm UTC](https://discuss.elastic.co/t/cannot-import-elastic-rpm-gpg-key-on-el9/306164 "2022-06-01T21:32:14Z")
On AlmaLinux 9.0: # rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-elasticsearch error: /etc/pki/rpm-gpg/RPM-GPG-KEY-elasticsearch: key 1 import failed. I believe this is due to newer restrictions on RPM GPG keys in EL9. --- ## [Pipeline to ingest JSON files with old objects from old cluster](https://discuss.elastic.co/t/pipeline-to-ingest-json-files-with-old-objects-from-old-cluster/306163)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 9:28pm UTC](https://discuss.elastic.co/t/pipeline-to-ingest-json-files-with-old-objects-from-old-cluster/306163 "2022-06-01T21:28:58Z")
Hi, I still very new to ELK and need help. We had an old cluster with 2 logstashs, 3 elasticsearchs, and 2 kibana. They are running version 6.23. We built a new cluster and install version 7.15. We want to configure a … --- ## [Index out of bound exception on aggregation](https://discuss.elastic.co/t/index-out-of-bound-exception-on-aggregation/303763)
**Author:** [@Bob\_Strickland](https://discuss.elastic.co/u/Bob_Strickland)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 9:23pm UTC](https://discuss.elastic.co/t/index-out-of-bound-exception-on-aggregation/303763 "2022-06-01T21:23:32Z")
Working on a small index that has 1556 documents. We are getting an exception when running the following: GET search\_stage\_jacked\_backup\_3/\_search?&error\_trace=true { "aggs": { "parentDealerName": { "terms"… --- ## [Graph elastic](https://discuss.elastic.co/t/graph-elastic/305968)
**Author:** [@Oscar\_V](https://discuss.elastic.co/u/Oscar_V)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 8:21pm UTC](https://discuss.elastic.co/t/graph-elastic/305968 "2022-06-01T20:21:44Z")
Hi ! I am filtering some events by a specific id with Graph Elastic but the result doesn't filter it because I can see other differents ids in the graph. I don't understand which is the reason. Regards. Óscar --- ## [Need grok pattern for logstash](https://discuss.elastic.co/t/need-grok-pattern-for-logstash/305835)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 6\ **Last updated:** [June 1, 2022, 6:09pm UTC](https://discuss.elastic.co/t/need-grok-pattern-for-logstash/305835 "2022-06-01T18:09:18Z")
Hi All, I need to use grok filter to parse the following log pattern: \[2022-05-24T02:15:20.979+0000\]\[info\]\[gc \] GC(187) Pause Full (G1 Evacuation Pause) 2559M-\>1698M(2560M) 724.899ms The idea is to capture… --- ## [Create Live Kibana Dashboard using UiPath logs](https://discuss.elastic.co/t/create-live-kibana-dashboard-using-uipath-logs/305931)
**Author:** [@risr](https://discuss.elastic.co/u/risr)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 5:26pm UTC](https://discuss.elastic.co/t/create-live-kibana-dashboard-using-uipath-logs/305931 "2022-06-01T17:26:54Z")
Hello everyone, Need to create Live Dashboard in Kibana using the UiPath generated Logs. We are sending log fields for the email received statuses and corresponding data and need to create the live dashboard to track t… --- ## [Kibana -Canvas : Unable to access URL param value](https://discuss.elastic.co/t/kibana-canvas-unable-to-access-url-param-value/305665)
**Author:** [@shivani\_chavan](https://discuss.elastic.co/u/shivani_chavan)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 5:23pm UTC](https://discuss.elastic.co/t/kibana-canvas-unable-to-access-url-param-value/305665 "2022-06-01T17:23:00Z")
Hi Team , I am trying to filter out values from my Drop down filter. I want to use URL Param for the same. I have specified url param and trying to get its value in my SQL query. But I am getting result as No documents… --- ## [Jitter Plot on Kibana](https://discuss.elastic.co/t/jitter-plot-on-kibana/306121)
**Author:** [@squa](https://discuss.elastic.co/u/squa)\ **Replies:** 4\ **Last updated:** [June 1, 2022, 5:17pm UTC](https://discuss.elastic.co/t/jitter-plot-on-kibana/306121 "2022-06-01T17:17:57Z")
Hi there, I'm evaluating Kibana for a project. Is it possible to have the following chart style in Kibana? Thank you everyone for helping out. https://datavizproject.com/data-type/jitter-plot/jitter1/ Thank you --- ## [Logstash output file plugin adds automatically hostname](https://discuss.elastic.co/t/logstash-output-file-plugin-adds-automatically-hostname/306113)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 4:51pm UTC](https://discuss.elastic.co/t/logstash-output-file-plugin-adds-automatically-hostname/306113 "2022-06-01T16:51:31Z")
Hello I am using Logstash version 7.8.0. I am having my configuration as input is logstash-plain.log file which is its logfile. It does not contain hostname , on its line, while logstash when processing data to output… --- ## [Has\_parent query performance](https://discuss.elastic.co/t/has-parent-query-performance/306107)
**Author:** [@maariolopezz](https://discuss.elastic.co/u/maariolopezz)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 10:00am UTC](https://discuss.elastic.co/t/has-parent-query-performance/306107 "2022-06-01T10:00:01Z")
Hello everyone, I have a case where I have two types of documents (Doc1 & Doc2). There are about 100 Doc1 (parent) and 2000000 Doc2 (child) and in the case of Doc1 they have duplicated data from other Doc1s and this dat… --- ## [Compare two large indexes with transform preview](https://discuss.elastic.co/t/compare-two-large-indexes-with-transform-preview/306149)
**Author:** [@szaby20](https://discuss.elastic.co/u/szaby20)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 4:30pm UTC](https://discuss.elastic.co/t/compare-two-large-indexes-with-transform-preview/306149 "2022-06-01T16:30:52Z")
Hi, I'm pretty new to Elastic so please bear with me. I'm trying to compare two large indexes (1.7 million and 400k) for regression testing purposes, which should contain exactly the same data once the larger index is fi… --- ## [Logstash container shut down + error creating action from filter](https://discuss.elastic.co/t/logstash-container-shut-down-error-creating-action-from-filter/306140)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 4:23pm UTC](https://discuss.elastic.co/t/logstash-container-shut-down-error-creating-action-from-filter/306140 "2022-06-01T16:23:18Z")
Hello I'm new to Elasticsearch I'm working with log files comming from filebeat and logstash and I'm trying to add a field "response\_time", and then affect the difference between timestamps to It. So I create a logstash… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=916) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=918)