# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=923 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 924 --- ## [Error fetching fields for index pattern abcd-\* (ID: 9dffc420-9ea5-11ec-93d5-xxxxxxxxxx)](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-abcd-id-9dffc420-9ea5-11ec-93d5-xxxxxxxxxx/304552)
**Author:** [@homesh\_joshi](https://discuss.elastic.co/u/homesh_joshi)\ **Replies:** 7\ **Last updated:** [May 30, 2022, 3:04am UTC](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-abcd-id-9dffc420-9ea5-11ec-93d5-xxxxxxxxxx/304552 "2022-05-30T03:04:30Z")
Hi , I am using kibana 7.17.0 , started getting this error "Error fetching fields for index pattern abcd-\* (ID: 9dffc420-9ea5-11ec-93d5-xxxxxxxxxx) undefined Response" from today. it was working from last 2 months. it p… --- ## [No more XContentType in 17.7.3?](https://discuss.elastic.co/t/no-more-xcontenttype-in-17-7-3/305888)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 0\ **Last updated:** [May 30, 2022, 2:56am UTC](https://discuss.elastic.co/t/no-more-xcontenttype-in-17-7-3/305888 "2022-05-30T02:56:00Z")
Where can I find XContentType? --- ## [How to enable cluster with 3 master node and lost 2 nodes to work again](https://discuss.elastic.co/t/how-to-enable-cluster-with-3-master-node-and-lost-2-nodes-to-work-again/305611)
**Author:** [@moashour94](https://discuss.elastic.co/u/moashour94)\ **Replies:** 4\ **Last updated:** [May 29, 2022, 7:49pm UTC](https://discuss.elastic.co/t/how-to-enable-cluster-with-3-master-node-and-lost-2-nodes-to-work-again/305611 "2022-05-29T19:49:39Z")
I was having 3 nodes all are master eligible and I lost 2 node from them, I google to find a solution, but nothing is clear to me. Note: The current node has a data folder which I can't delete it. --- ## [Recommend pls Elasticsearch courses or tutorials](https://discuss.elastic.co/t/recommend-pls-elasticsearch-courses-or-tutorials/305876)
**Author:** [@MarkDoronin](https://discuss.elastic.co/u/MarkDoronin)\ **Replies:** 1\ **Last updated:** [May 29, 2022, 3:03pm UTC](https://discuss.elastic.co/t/recommend-pls-elasticsearch-courses-or-tutorials/305876 "2022-05-29T15:03:58Z")
Help pls to choose an online course about Elasticsearch. I have found this list, but there are better options. --- ## [Can you match an index template based on a doc's field value?](https://discuss.elastic.co/t/can-you-match-an-index-template-based-on-a-docs-field-value/305867)
**Author:** [@Nama\_Illo](https://discuss.elastic.co/u/Nama_Illo)\ **Replies:** 2\ **Last updated:** [May 29, 2022, 3:27pm UTC](https://discuss.elastic.co/t/can-you-match-an-index-template-based-on-a-docs-field-value/305867 "2022-05-29T15:27:45Z")
It appears docs being indexed can hit a specific Index Template based on an "index pattern" that matches a specific naming pattern of an index. I was wondering if there was a way to have a doc hit a specific Index Templ… --- ## [Kibana email connector "unable to verify the first certificate"](https://discuss.elastic.co/t/kibana-email-connector-unable-to-verify-the-first-certificate/304892)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 4\ **Last updated:** [May 29, 2022, 3:26pm UTC](https://discuss.elastic.co/t/kibana-email-connector-unable-to-verify-the-first-certificate/304892 "2022-05-29T15:26:47Z")
Dears, ELK in version: 7.16 I want to test and deploy email notification in Kibana. During configuration of email connector I've got error message like this: {"type":"log","@timestamp":"2022-05-17T08:51:18+02:00","tag… --- ## [A better way to implement an analyzer coded by myself into elastic search](https://discuss.elastic.co/t/a-better-way-to-implement-an-analyzer-coded-by-myself-into-elastic-search/305872)
**Author:** [@Gresmir](https://discuss.elastic.co/u/Gresmir)\ **Replies:** 0\ **Last updated:** [May 29, 2022, 9:53am UTC](https://discuss.elastic.co/t/a-better-way-to-implement-an-analyzer-coded-by-myself-into-elastic-search/305872 "2022-05-29T09:53:07Z")
Hello In my textual data, I have structures like this: ст. ст. 40, 131, 132, 176-178, 183, ч. 2 ст. 187, 188, 184, 189, 194 KK Where KK is the name of a codex, ст. ст., or ст. mean article, ч. mean part. So I want El… --- ## [Can't connect to Elasticsearch from logstash version8.2](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-from-logstash-version8-2/305785)
**Author:** [@oga](https://discuss.elastic.co/u/oga)\ **Replies:** 7\ **Last updated:** [May 29, 2022, 5:08am UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-from-logstash-version8-2/305785 "2022-05-29T05:08:51Z")
I want to use Elasticsearch and Logstash(ver 8.2). After installed Elasticsearch and Kibana, I installed logstash. But I got error.It seems logstash can't connect to Elasticsearch. But Elasticsearch is runnning correc… --- ## [Exporting kibana spaces & objects from all spaces](https://discuss.elastic.co/t/exporting-kibana-spaces-objects-from-all-spaces/305861)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 0\ **Last updated:** [May 28, 2022, 4:26pm UTC](https://discuss.elastic.co/t/exporting-kibana-spaces-objects-from-all-spaces/305861 "2022-05-28T16:26:35Z")
Hi, Is there a way to export entire Kibana spaces & its objects (like dashboards) to ndjson file in one go. Kibana 8.0 Thanks --- ## [Seems Role Kibana privileges are not the same as the DOCS](https://discuss.elastic.co/t/seems-role-kibana-privileges-are-not-the-same-as-the-docs/305846)
**Author:** [@Miguel\_Frazao](https://discuss.elastic.co/u/Miguel_Frazao)\ **Replies:** 2\ **Last updated:** [May 28, 2022, 3:26pm UTC](https://discuss.elastic.co/t/seems-role-kibana-privileges-are-not-the-same-as-the-docs/305846 "2022-05-28T15:26:31Z")
Hello I'm trying to create an User/Role to view only dashboard, I'm following this Kibana role management | Kibana Guide \[8.0\] | Elastic . However on this section Kibana role management | Kibana Guide \[8.0\] | Elastic as… --- ## [Error while connecting logstash to elasticsearch](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch/304693)
**Author:** [@skander\_khalfet](https://discuss.elastic.co/u/skander_khalfet)\ **Replies:** 13\ **Last updated:** [May 28, 2022, 3:05pm UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch/304693 "2022-05-28T15:05:26Z")
hi guys i have installed elk stack on kubernetes using helm charts. all pods are running fine except logstash with this error message. \[2022-05-13T12:01:46,928\]\[WARN \]\[logstash.licensechecker.licensereader\] Attempted t… --- ## [Filter in multiple docs](https://discuss.elastic.co/t/filter-in-multiple-docs/305741)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 1\ **Last updated:** [May 28, 2022, 2:24pm UTC](https://discuss.elastic.co/t/filter-in-multiple-docs/305741 "2022-05-28T14:24:58Z")
Hi, I have an index that has a tracking by ID. For each step that id pass writes a DOC to elastic. But I'm trying to make a filter that does the following validation. It passed Step2 but did not pass at Step4. Exempl… --- ## [Increase Top values aggregation limit above 1000](https://discuss.elastic.co/t/increase-top-values-aggregation-limit-above-1000/305652)
**Author:** [@lerignoux](https://discuss.elastic.co/u/lerignoux)\ **Replies:** 5\ **Last updated:** [May 28, 2022, 2:22pm UTC](https://discuss.elastic.co/t/increase-top-values-aggregation-limit-above-1000/305652 "2022-05-28T14:22:20Z")
Hello I am trying to generate a graph with a lot of records (~10k) and get the top values in an horizontal bar chart. It works well but the Top Values: Number of values is limited to 1000 entries meaning I cant see all… --- ## [Parsing timestamp](https://discuss.elastic.co/t/parsing-timestamp/305708)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 5\ **Last updated:** [May 28, 2022, 1:10pm UTC](https://discuss.elastic.co/t/parsing-timestamp/305708 "2022-05-28T13:10:38Z")
trying to parse with this :slight\_smile: if "one-sync" in \[tags\] and "heart-sync" in \[tags\] and "edemand" in \[tags\] and "events" in \[tags\] { date { match =\> \["timestamp", "yyyy-MM-dd'T'HH:mm:ss'.'SSS'Z'"\] … --- ## [Synonyms for medical text search](https://discuss.elastic.co/t/synonyms-for-medical-text-search/305853)
**Author:** [@Tim\_Shurlock](https://discuss.elastic.co/u/Tim_Shurlock)\ **Replies:** 0\ **Last updated:** [May 28, 2022, 12:25pm UTC](https://discuss.elastic.co/t/synonyms-for-medical-text-search/305853 "2022-05-28T12:25:39Z")
Hi, I am trying to build a synonym list of medical terms for use in Elasticsearch. The purpose being to catch exceptions that wont conflate properly with the already implemented porter stemmer, for example none of the v… --- ## [Jdbc\_fetch\_size, what would be the ideal value?](https://discuss.elastic.co/t/jdbc-fetch-size-what-would-be-the-ideal-value/305830)
**Author:** [@Rauly\_Koto](https://discuss.elastic.co/u/Rauly_Koto)\ **Replies:** 1\ **Last updated:** [May 28, 2022, 11:36am UTC](https://discuss.elastic.co/t/jdbc-fetch-size-what-would-be-the-ideal-value/305830 "2022-05-28T11:36:31Z")
200k lines: jdbc\_fetch\_size =\> 50000 (1/4) or jdbc\_fetch\_size =\> 100000 (1/2)? --- ## [Elastic Search Query to match Only if Specific value is present](https://discuss.elastic.co/t/elastic-search-query-to-match-only-if-specific-value-is-present/305796)
**Author:** [@Harinder\_Singh](https://discuss.elastic.co/u/Harinder_Singh)\ **Replies:** 2\ **Last updated:** [May 28, 2022, 11:30am UTC](https://discuss.elastic.co/t/elastic-search-query-to-match-only-if-specific-value-is-present/305796 "2022-05-28T11:30:41Z")
Hi, I have data like below { "instance": { "items": \[ { "name": "name\_1" }, { "name": "name\_2" } \] } } items is an array and it can contains many values. I am looki… --- ## [Elasticsearch search query quide](https://discuss.elastic.co/t/elasticsearch-search-query-quide/305847)
**Author:** [@Satya10](https://discuss.elastic.co/u/Satya10)\ **Replies:** 0\ **Last updated:** [May 28, 2022, 9:53am UTC](https://discuss.elastic.co/t/elasticsearch-search-query-quide/305847 "2022-05-28T09:53:59Z")
Currently, I'm working on ELK 8 (Filebeat, Logstash, Elasticsearch & Kibana) stuck in the middle The sample log is here, 2021-07-30 16:34:22 INFO com.example.OrderRest \[fhxh750df392\] Session opened OId 31324 2021-07-3… --- ## [Create a watcher to check that the IP address of device is same or changing](https://discuss.elastic.co/t/create-a-watcher-to-check-that-the-ip-address-of-device-is-same-or-changing/305294)
**Author:** [@no0ne](https://discuss.elastic.co/u/no0ne)\ **Replies:** 4\ **Last updated:** [May 27, 2022, 6:11pm UTC](https://discuss.elastic.co/t/create-a-watcher-to-check-that-the-ip-address-of-device-is-same-or-changing/305294 "2022-05-27T18:11:23Z")
I have a data set in which I want to check if each device's IP is the same or changed if it is the same then good if it is changing then notify alert or Jira ticket. How do I make the watcher for that I am a novice in e… --- ## [Elastic Cloud | How and why to handle Kibana resources when creating deploy](https://discuss.elastic.co/t/elastic-cloud-how-and-why-to-handle-kibana-resources-when-creating-deploy/305838)
**Author:** [@caraboy](https://discuss.elastic.co/u/caraboy)\ **Replies:** 1\ **Last updated:** [May 27, 2022, 11:44pm UTC](https://discuss.elastic.co/t/elastic-cloud-how-and-why-to-handle-kibana-resources-when-creating-deploy/305838 "2022-05-27T23:44:28Z")
I am wondering which would be the reasons/use-cases that would require to assign Kibana high RAM, CPU and zone resources. I mean, it's clear what does this means for Elasticsearch component (I/O efficiency). But how the… --- ## [Custom Authz Engine Configuration](https://discuss.elastic.co/t/custom-authz-engine-configuration/305837)
**Author:** [@ash\_n](https://discuss.elastic.co/u/ash_n)\ **Replies:** 0\ **Last updated:** [May 27, 2022, 11:10pm UTC](https://discuss.elastic.co/t/custom-authz-engine-configuration/305837 "2022-05-27T23:10:06Z")
I'm working on an implementation of a custom authorization engine by following the instructions on this page. I'm using Elasticsearch v8.2.0. Step 2) on this page seems to indicate that I can pass settings for my custom… --- ## [Define Primaries and Replicas for Elastic Agent Integrations](https://discuss.elastic.co/t/define-primaries-and-replicas-for-elastic-agent-integrations/305560)
**Author:** [@Fikrat\_Karimli](https://discuss.elastic.co/u/Fikrat_Karimli)\ **Replies:** 8\ **Last updated:** [May 27, 2022, 8:46pm UTC](https://discuss.elastic.co/t/define-primaries-and-replicas-for-elastic-agent-integrations/305560 "2022-05-27T20:46:37Z")
Hi, I have elastic agent managed by fleet and I want to define primaries and replicas. By default it has 1 primary and 1 replica but want to do 3 primary and 0 replica. I tried to play with data stream but nothing seem … --- ## [Set flattened field type to avoid the limit of total fields \[1000\] issue](https://discuss.elastic.co/t/set-flattened-field-type-to-avoid-the-limit-of-total-fields-1000-issue/305834)
**Author:** [@austin0918](https://discuss.elastic.co/u/austin0918)\ **Replies:** 0\ **Last updated:** [May 27, 2022, 8:43pm UTC](https://discuss.elastic.co/t/set-flattened-field-type-to-avoid-the-limit-of-total-fields-1000-issue/305834 "2022-05-27T20:43:58Z")
I need to set flattened type for some fields, e.g., msgParts.urls, msgParts.metadata, filter.modules to avoid the limit of total fields \[1000\] issue. Below are the current settings that don't work, please advise. { "i… --- ## [Getting handshake error while enabling SSL in elasticsearch cluster](https://discuss.elastic.co/t/getting-handshake-error-while-enabling-ssl-in-elasticsearch-cluster/305783)
**Author:** [@AnandThakur](https://discuss.elastic.co/u/AnandThakur)\ **Replies:** 1\ **Last updated:** [May 27, 2022, 7:56pm UTC](https://discuss.elastic.co/t/getting-handshake-error-while-enabling-ssl-in-elasticsearch-cluster/305783 "2022-05-27T19:56:55Z")
Hi All, We are new to using Elasticsearch and we use elasticsearch as audittrail for Informatica PIM. We were able to successfully create Elasticsearch nodes and enable SSL in DEV and SIT which have standalone nodes but… --- ## [Is it possible to know when no more changes will be included in a snapshot?](https://discuss.elastic.co/t/is-it-possible-to-know-when-no-more-changes-will-be-included-in-a-snapshot/305816)
**Author:** [@gearoidibm](https://discuss.elastic.co/u/gearoidibm)\ **Replies:** 1\ **Last updated:** [May 27, 2022, 6:38pm UTC](https://discuss.elastic.co/t/is-it-possible-to-know-when-no-more-changes-will-be-included-in-a-snapshot/305816 "2022-05-27T18:38:38Z")
To create a backup that's consistent across my index and other application data I create a snapshot when there's no changes being made to the index. I want to start making changes to the index as soon as possible after … --- ## [Looking for a chart/line graph that could display the changes of status](https://discuss.elastic.co/t/looking-for-a-chart-line-graph-that-could-display-the-changes-of-status/305738)
**Author:** [@JaNa\_Cy](https://discuss.elastic.co/u/JaNa_Cy)\ **Replies:** 0\ **Last updated:** [May 26, 2022, 5:20pm UTC](https://discuss.elastic.co/t/looking-for-a-chart-line-graph-that-could-display-the-changes-of-status/305738 "2022-05-26T17:20:27Z")
Hi, I got data like name = "Interface1", status = "down", time="5:10 " name = "Interface1", status = "up", time="5:20 " name = "Interface1", status = "down", time="5:30 " name = "Interface1", status = "up", time="5:… --- ## [Export visualisation data as csv (7.17)](https://discuss.elastic.co/t/export-visualisation-data-as-csv-7-17/305748)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [May 27, 2022, 2:16pm UTC](https://discuss.elastic.co/t/export-visualisation-data-as-csv-7-17/305748 "2022-05-27T14:16:45Z")
I used to be able to use the "share' button at the top to export the aggregated data but that option is no longer there. how can I get the data\> --- ## [Convert Date time Using StandardTimeZonename instead of Zoneid](https://discuss.elastic.co/t/convert-date-time-using-standardtimezonename-instead-of-zoneid/305800)
**Author:** [@M.Naim](https://discuss.elastic.co/u/M.Naim)\ **Replies:** 1\ **Last updated:** [May 27, 2022, 1:22pm UTC](https://discuss.elastic.co/t/convert-date-time-using-standardtimezonename-instead-of-zoneid/305800 "2022-05-27T13:22:12Z")
Hi Team, I am facing issue to convert Datetime value into their Specific time zone by refering Timezone name from doc. Scenario: In my scenario, we have data for different timezones on elastic with thereTimezone belon… --- ## [Last\_failure\_timestamp](https://discuss.elastic.co/t/last-failure-timestamp/305591)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 11\ **Last updated:** [May 27, 2022, 1:13pm UTC](https://discuss.elastic.co/t/last-failure-timestamp/305591 "2022-05-27T13:13:01Z")
Hi How I can manage reload parameter, and why this output is "null" failure\_timestamp" : null In my config I'm using log.level: info "outputs" : \[ { "id" : "1937dea243c36a25e890be2892a0097740ae92… --- ## [Starting with snapshots when we already have a large amount of data?](https://discuss.elastic.co/t/starting-with-snapshots-when-we-already-have-a-large-amount-of-data/305781)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 1\ **Last updated:** [May 27, 2022, 1:11pm UTC](https://discuss.elastic.co/t/starting-with-snapshots-when-we-already-have-a-large-amount-of-data/305781 "2022-05-27T13:11:09Z")
Hi, We shall do an upgrade from 7.10.2 to 7.17+ and have tried this is lab env. But one question that comes to mind is, how is the cluster going to react when starting a snapshot on over 10TB data with cold storage? W… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=922) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=924)