# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=989 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 990 --- ## [Elastic search complex query](https://discuss.elastic.co/t/elastic-search-complex-query/301399)
**Author:** [@Hassan\_Shaitou](https://discuss.elastic.co/u/Hassan_Shaitou)\ **Replies:** 5\ **Last updated:** [April 3, 2022, 2:15pm UTC](https://discuss.elastic.co/t/elastic-search-complex-query/301399 "2022-04-03T14:15:03Z")
So, let us say I have 2 indices users and products. Within users I have the following format: users: { uid:"00001", name:"Hash", country:"US" }, Within the products I have the following format: product: { prod… --- ## [Aliases and indices on demand](https://discuss.elastic.co/t/aliases-and-indices-on-demand/298625)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 10\ **Last updated:** [April 3, 2022, 1:08pm UTC](https://discuss.elastic.co/t/aliases-and-indices-on-demand/298625 "2022-04-03T13:08:08Z")
We have many indices in our system, and we're following the general guideline to create indices only on demand. We're also starting to use aliases to allow for rollover and for background data migrations (using the inde… --- ## [The new variable in the filter ruby event must be set() before it can be used?](https://discuss.elastic.co/t/the-new-variable-in-the-filter-ruby-event-must-be-set-before-it-can-be-used/301406)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [April 3, 2022, 4:08am UTC](https://discuss.elastic.co/t/the-new-variable-in-the-filter-ruby-event-must-be-set-before-it-can-be-used/301406 "2022-04-03T04:08:51Z")
ruby { code =\> " pubtime\_new = event.get('\[pubtime\]').to\_i \* 1000 event.set('pubtime\_new',pubtime\_new) \>\>\>\> If I don't register pubtime\_new then below can't get the value of pubtime\_new.… --- ## [How to Increase timeout for kibana file upload](https://discuss.elastic.co/t/how-to-increase-timeout-for-kibana-file-upload/301407)
**Author:** [@fawazahmed0](https://discuss.elastic.co/u/fawazahmed0)\ **Replies:** 1\ **Last updated:** [April 3, 2022, 1:45am UTC](https://discuss.elastic.co/t/how-to-increase-timeout-for-kibana-file-upload/301407 "2022-04-03T01:45:33Z")
Hi I am getting started with Elasticsearch and I would like to import a csv file into Elasticsearch index. The problem is that, it is getting timeout error (file size is around 8mb). How would I increase the timeout… --- ## [Elasticsearch alerting free for MS Teams](https://discuss.elastic.co/t/elasticsearch-alerting-free-for-ms-teams/301400)
**Author:** [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Replies:** 1\ **Last updated:** [April 2, 2022, 8:42pm UTC](https://discuss.elastic.co/t/elasticsearch-alerting-free-for-ms-teams/301400 "2022-04-02T20:42:43Z")
Hi All, I would like to know whether Alerting to MS Teams is available for free (basic) in any version of Elasticsearch. Please confirm on this. --- ## [Duplicate Tokens in elasticsearch uax\_url\_email tokenizer](https://discuss.elastic.co/t/duplicate-tokens-in-elasticsearch-uax-url-email-tokenizer/301398)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 7:02pm UTC](https://discuss.elastic.co/t/duplicate-tokens-in-elasticsearch-uax-url-email-tokenizer/301398 "2022-04-02T19:02:48Z")
I have created a test index here { "settings" : { "analysis" : { "filter" : { "emailcustom" : { … --- ## [Logstash JSON parser Error](https://discuss.elastic.co/t/logstash-json-parser-error/301389)
**Author:** [@Lupul\_Dacic](https://discuss.elastic.co/u/Lupul_Dacic)\ **Replies:** 5\ **Last updated:** [April 2, 2022, 5:41pm UTC](https://discuss.elastic.co/t/logstash-json-parser-error/301389 "2022-04-02T17:41:38Z")
Hi guys, I am new to ELK and I need your help in order to parse a JSON file with Logstash. I want to make it available in Kibana. My logstash.conf is input { file { path =\> "/usr/share/logstash/c.json" star… --- ## [Sending Data from Metricbeat to Logstash not working](https://discuss.elastic.co/t/sending-data-from-metricbeat-to-logstash-not-working/301320)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 3\ **Last updated:** [April 2, 2022, 4:27pm UTC](https://discuss.elastic.co/t/sending-data-from-metricbeat-to-logstash-not-working/301320 "2022-04-02T16:27:15Z")
Hello All, In current implementation the data is going well from metricbeat to elastic but now while changing it from metricbeat-\>logstash-\>elastic it dosent works,data is not received by logstash.Can someone help wher… --- ## [Mutate replace using if](https://discuss.elastic.co/t/mutate-replace-using-if/301393)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 3:09pm UTC](https://discuss.elastic.co/t/mutate-replace-using-if/301393 "2022-04-02T15:09:05Z")
Hi, I have a question regarding updating and removing logstash. My situation is, that I am collecting logs using API, for the first time data is being shipped into logstash, the "GeoIP" is empty space, but it will have u… --- ## [Object mapping for \[tags\] tried to parse field \[tags\] as object, but found a concrete value](https://discuss.elastic.co/t/object-mapping-for-tags-tried-to-parse-field-tags-as-object-but-found-a-concrete-value/301375)
**Author:** [@D.J.2022](https://discuss.elastic.co/u/D.J.2022)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 3:28am UTC](https://discuss.elastic.co/t/object-mapping-for-tags-tried-to-parse-field-tags-as-object-but-found-a-concrete-value/301375 "2022-04-02T03:28:12Z")
Environment related Elasticsearch-7.14.2 logstash-7.14.2 kibana-7.14.2 DELETE tagsjons PUT tagsjons { "mappings": { "properties": { "title":{ "type":"text" }, "tags": … --- ## [The query speed of sentence vector in elasticsearch8 is slow](https://discuss.elastic.co/t/the-query-speed-of-sentence-vector-in-elasticsearch8-is-slow/301380)
**Author:** [@qili](https://discuss.elastic.co/u/qili)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 6:24am UTC](https://discuss.elastic.co/t/the-query-speed-of-sentence-vector-in-elasticsearch8-is-slow/301380 "2022-04-02T06:24:40Z")
The es7.16.2 version inserts 3 million 768-dimensional sentence vectors, and the query results in 2-3 seconds. After the es8.1.1 version is used, the query time reaches 5 or 6 minutes. Is there any special configuration … --- ## [Проблемы с отображением гео-кластеров на карты](https://discuss.elastic.co/t/topic/301385)
**Author:** [@Fess](https://discuss.elastic.co/u/Fess)\ **Replies:** 1\ **Last updated:** [April 2, 2022, 9:38am UTC](https://discuss.elastic.co/t/topic/301385 "2022-04-02T09:38:47Z")
Добрый день, рзвёрнут кластер Elasticsearch 7.1.2 в закрытой сети без доступа к интернету. Отображение иочек на карте работает, но при включения режима отображать кластера при количестве более 10000 отображение не происх… --- ## [How to set up filebeat](https://discuss.elastic.co/t/how-to-set-up-filebeat/301382)
**Author:** [@mick463](https://discuss.elastic.co/u/mick463)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 7:38am UTC](https://discuss.elastic.co/t/how-to-set-up-filebeat/301382 "2022-04-02T07:38:29Z")
Hi I am trying to set up filebeat to learn how to use it and Elastic ( I am new to this) I have set up winlogbeat and metric beat and they are working. When i set up filebeat i get No matching indices found: No indice… --- ## [Wrong sorting of colours in bar chart](https://discuss.elastic.co/t/wrong-sorting-of-colours-in-bar-chart/300955)
**Author:** [@JeroenK](https://discuss.elastic.co/u/JeroenK)\ **Replies:** 2\ **Last updated:** [April 2, 2022, 7:23am UTC](https://discuss.elastic.co/t/wrong-sorting-of-colours-in-bar-chart/300955 "2022-04-02T07:23:21Z")
I have a bar chart in Canvas for which I want to give each bar a separate colour in a gradient sorted in the same way the bar chart is sorted, example: My code: filters | essql query="select top 10 \\"sales.repres… --- ## [ERROR: Skipping security auto configuration because it appears that the node is not starting up for the first time. The node might already be part of a cluster and this auto setup utility is designed to configure Security for new clusters only](https://discuss.elastic.co/t/error-skipping-security-auto-configuration-because-it-appears-that-the-node-is-not-starting-up-for-the-first-time-the-node-might-already-be-part-of-a-cluster-and-this-auto-setup-utility-is-designed-to-configure-security-for-new-clusters-only/300568)
**Author:** [@qili](https://discuss.elastic.co/u/qili)\ **Replies:** 3\ **Last updated:** [April 2, 2022, 6:41am UTC](https://discuss.elastic.co/t/error-skipping-security-auto-configuration-because-it-appears-that-the-node-is-not-starting-up-for-the-first-time-the-node-might-already-be-part-of-a-cluster-and-this-auto-setup-utility-is-designed-to-configure-security-for-new-clusters-only/300568 "2022-04-02T06:41:38Z")
why？ I use es8.1.1 mast node had Started ，but failed to join cluster from node mast node is ： --- ## [Greedymultine works in simulation but fails when actually used](https://discuss.elastic.co/t/greedymultine-works-in-simulation-but-fails-when-actually-used/301364)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 1\ **Last updated:** [April 2, 2022, 4:26am UTC](https://discuss.elastic.co/t/greedymultine-works-in-simulation-but-fails-when-actually-used/301364 "2022-04-02T04:26:05Z")
Hello all, I am trying to use the GREEDYMULTILINE in one of ingest pipeline as the GREEDYDATA is not working. So when I do the simulation using my grok processor in dev tools it works just fine but it fails when I actua… --- ## [Will allocation settings work on closed indexes?](https://discuss.elastic.co/t/will-allocation-settings-work-on-closed-indexes/301190)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 4\ **Last updated:** [April 2, 2022, 2:15am UTC](https://discuss.elastic.co/t/will-allocation-settings-work-on-closed-indexes/301190 "2022-04-02T02:15:26Z")
When I set the cluster settings as follows： "cluster.routing.allocation.exclude.\_ip" : "10.1.1.1" It's means that All indices will be removed from this node（10.1.1.1） My question is ：Will the closed index be moved？ --- ## [SQL column alias equivalent in Elasticsearch query](https://discuss.elastic.co/t/sql-column-alias-equivalent-in-elasticsearch-query/301362)
**Author:** [@elk.pepper](https://discuss.elastic.co/u/elk.pepper)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 6:12pm UTC](https://discuss.elastic.co/t/sql-column-alias-equivalent-in-elasticsearch-query/301362 "2022-04-01T18:12:41Z")
Hello, I am trying to create a query similar to the following (ignore the fact that time is not taken into account): SELECT host, sum(bytes) FROM (SELECT sender as host, sent\_bytes as bytes from traffic UNION SE… --- ## [Winlogbeat Index is yellow. Having weird errors in discover tab, and I cannot view winlog data](https://discuss.elastic.co/t/winlogbeat-index-is-yellow-having-weird-errors-in-discover-tab-and-i-cannot-view-winlog-data/301373)
**Author:** [@jthare](https://discuss.elastic.co/u/jthare)\ **Replies:** 1\ **Last updated:** [April 2, 2022, 12:58am UTC](https://discuss.elastic.co/t/winlogbeat-index-is-yellow-having-weird-errors-in-discover-tab-and-i-cannot-view-winlog-data/301373 "2022-04-02T00:58:40Z")
Just set up a Wec server to forward windows event logs to my elk stack via the setup powershell script. We were successful in the command running, but now we're receiving the logs. I just can't view them in Discover and … --- ## [Slow cosine similarity script](https://discuss.elastic.co/t/slow-cosine-similarity-script/299496)
**Author:** [@adibaba](https://discuss.elastic.co/u/adibaba)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 11:02pm UTC](https://discuss.elastic.co/t/slow-cosine-similarity-script/299496 "2022-04-01T23:02:22Z")
Hi, in a query, I am executing a cosine similarity script. It takes multiple seconds, but the top command shows CPU and memory usage of nearly zero. It looks like a configuration issue to me, but I can not figure out th… --- ## [Logstash-keystore error](https://discuss.elastic.co/t/logstash-keystore-error/301216)
**Author:** [@jack3368](https://discuss.elastic.co/u/jack3368)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 7:49pm UTC](https://discuss.elastic.co/t/logstash-keystore-error/301216 "2022-04-01T19:49:35Z")
I am upgrading logstash v7.5.2 to v7.17.1. The step in docker file that using logstash-keystore to create keystore always return the following error message: Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit S… --- ## [Reporting Error in Kibana: Spawning Chromium Browser in Docker, Kibana 8](https://discuss.elastic.co/t/reporting-error-in-kibana-spawning-chromium-browser-in-docker-kibana-8/300574)
**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\ **Replies:** 12\ **Last updated:** [April 1, 2022, 7:10pm UTC](https://discuss.elastic.co/t/reporting-error-in-kibana-spawning-chromium-browser-in-docker-kibana-8/300574 "2022-04-01T19:10:40Z")
I am having issue in Report generation in Kibana v8. I am running in Docker. Getting like Chromium headless Browser error. After that i had ran Diagnostics. It shows the error that i need to disable sandbox. That also m… --- ## [Adding component templates to existing index templates](https://discuss.elastic.co/t/adding-component-templates-to-existing-index-templates/301368)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 7:09pm UTC](https://discuss.elastic.co/t/adding-component-templates-to-existing-index-templates/301368 "2022-04-01T19:09:56Z")
How can I apply a new component template to all existing index templates that I have? I know you can supply the "composed\_of" field, but that looks like all of the component templates that should be on the index template… --- ## [Data intersection](https://discuss.elastic.co/t/data-intersection/301351)
**Author:** [@ratel\_joun](https://discuss.elastic.co/u/ratel_joun)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 5:47pm UTC](https://discuss.elastic.co/t/data-intersection/301351 "2022-04-01T17:47:48Z")
hello everybody, can anyone answer how to get the intersection between data in two fields in the same index, in other words the data found in field1 and field2 but not at the same row. for example, i want to get the su… --- ## [Create Timerange](https://discuss.elastic.co/t/create-timerange/301015)
**Author:** [@GoncaloCarvalho](https://discuss.elastic.co/u/GoncaloCarvalho)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 5:42pm UTC](https://discuss.elastic.co/t/create-timerange/301015 "2022-04-01T17:42:58Z")
Greetings, Was wondering if someone could throw at me an example of how to use the Timerange in the expression language? I'm currently trying something of the likes: | var\_set "timeToGo" value={timerange from="2022-03… --- ## [Comparative study for ELK VS SolarWind](https://discuss.elastic.co/t/comparative-study-for-elk-vs-solarwind/301357)
**Author:** [@gbiswas](https://discuss.elastic.co/u/gbiswas)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 5:10pm UTC](https://discuss.elastic.co/t/comparative-study-for-elk-vs-solarwind/301357 "2022-04-01T17:10:01Z")
Looking for some comparative study on why ELK would be a better choice than SolarWind for application monitoring and Management --- ## [Logstash to Elasticsearch resilience](https://discuss.elastic.co/t/logstash-to-elasticsearch-resilience/301346)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 4:33pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-resilience/301346 "2022-04-01T16:33:02Z")
Hello everyone, Im having a little bit of trouble finding a way to approach resilience on my Elasticsearch cluster. Currently i have 2 Logstash nodes for resilience. Each one of them are pointing to my 4 Elasticsearch… --- ## [How to improve Logstash configuration for outputs](https://discuss.elastic.co/t/how-to-improve-logstash-configuration-for-outputs/301332)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 4:25pm UTC](https://discuss.elastic.co/t/how-to-improve-logstash-configuration-for-outputs/301332 "2022-04-01T16:25:27Z")
Dear team, can you advise on how to improve my configuration for outputs from Logstash? In our environment, the only output is Elasticsearch, and we have around 30 sources which are sent to Elasticsearch from logstash … --- ## [Parse nested json - Logstash v16.2 on Windows 10](https://discuss.elastic.co/t/parse-nested-json-logstash-v16-2-on-windows-10/301296)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 4:15pm UTC](https://discuss.elastic.co/t/parse-nested-json-logstash-v16-2-on-windows-10/301296 "2022-04-01T16:15:36Z")
Hi guys, I'm trying to import a nested json into Elasticsearch v7.16, but I haven't been successful so far. I managed successfully to import a "normal" (not nested) json, but for the nested one I'm in trouble. Could you … --- ## [How to handle fine grained errors in new Java API 8.0.1 for Bulk?](https://discuss.elastic.co/t/how-to-handle-fine-grained-errors-in-new-java-api-8-0-1-for-bulk/301285)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 4:10pm UTC](https://discuss.elastic.co/t/how-to-handle-fine-grained-errors-in-new-java-api-8-0-1-for-bulk/301285 "2022-04-01T16:10:21Z")
With much sweat I could build a Bulk Request, on the new Java API 8.1.0, like this // build request ArrayList\ bulkOperations = new ArrayList\(); BulkOperation bulkOperation = BulkOperation.o… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=988) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=990)