# Latest **URL:** https://discuss.elastic.co/latest.md?page=1019 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1020 --- ## [Custom Aggregations in ES](https://discuss.elastic.co/t/custom-aggregations-in-es/311385)
**Author:** [@vishnu\_teja](https://discuss.elastic.co/u/vishnu_teja)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 9:18am UTC](https://discuss.elastic.co/t/custom-aggregations-in-es/311385 "2022-08-04T09:18:31Z")
Hi, I would like to know, if we can have custom aggregations in ElasticSearch, For EX: we have a use-case where we need a function like any\_value(), it works like this: Say I have the following documents in my index: {… --- ## [Kibana APIs: No handler found for uri](https://discuss.elastic.co/t/kibana-apis-no-handler-found-for-uri/310971)
**Author:** [@aman\_mahajan](https://discuss.elastic.co/u/aman_mahajan)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 8:57am UTC](https://discuss.elastic.co/t/kibana-apis-no-handler-found-for-uri/310971 "2022-08-04T08:57:26Z")
Hi, I am trying to do a curl request to the Kibana APIs but getting error that the handler does not exist. For eg. curl -H 'kbn-xsrf: true' -H "Authorization: Basic \" \:\/api/saved\_objects… --- ## [Getting 403 forbidden error while starting service for uptime monitoring](https://discuss.elastic.co/t/getting-403-forbidden-error-while-starting-service-for-uptime-monitoring/310812)
**Author:** [@amseshadri](https://discuss.elastic.co/u/amseshadri)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 8:49am UTC](https://discuss.elastic.co/t/getting-403-forbidden-error-while-starting-service-for-uptime-monitoring/310812 "2022-08-04T08:49:53Z")
Hi, I am trying to setup Uptime Monitoring for our application URL, and trying to setup the Elastic Observability Uptime Monitoring. While executing the below getting 403 Forbidden Error: .\\heartbeat.exe setup Error: … --- ## [Compare two indexes different field value](https://discuss.elastic.co/t/compare-two-indexes-different-field-value/311303)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 2\ **Last updated:** [August 4, 2022, 8:40am UTC](https://discuss.elastic.co/t/compare-two-indexes-different-field-value/311303 "2022-08-04T08:40:11Z")
Hi, i would like to know if it is possible to compare field.value with different indexes i mean for example i have index1 and index2 and each index has fields so i want to compare field value of index1 with field value … --- ## [Query returns empty result when filtering on labels and timestamp](https://discuss.elastic.co/t/query-returns-empty-result-when-filtering-on-labels-and-timestamp/311305)
**Author:** [@ithline](https://discuss.elastic.co/u/ithline)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 8:38am UTC](https://discuss.elastic.co/t/query-returns-empty-result-when-filtering-on-labels-and-timestamp/311305 "2022-08-04T08:38:11Z")
Hello there, I'm having some problems with querying in Kibana, so I tried to create manual query using the /\_search API. My index template is composed of .alerts-ecs-mappings, logs-mappings and logs-settings component … --- ## [Separating heartbeat synthetics logs from the rest](https://discuss.elastic.co/t/separating-heartbeat-synthetics-logs-from-the-rest/311193)
**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\ **Replies:** 7\ **Last updated:** [August 4, 2022, 8:33am UTC](https://discuss.elastic.co/t/separating-heartbeat-synthetics-logs-from-the-rest/311193 "2022-08-04T08:33:16Z")
Hello, I'm setting up Synthetic Monitoring using dockerised heartbeat image and want to separate the synthetics logs from the http/icmp ones. What I've noticed is that with the latest upgrade to 8.3 (or perhaps it was … --- ## [Unknown transaction name? It's a number?](https://discuss.elastic.co/t/unknown-transaction-name-its-a-number/311235)
**Author:** [@Scott\_Chapman](https://discuss.elastic.co/u/Scott_Chapman)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 8:31am UTC](https://discuss.elastic.co/t/unknown-transaction-name-its-a-number/311235 "2022-08-04T08:31:01Z")
I am using the current Java APM Agent to instrument a desktop java app (not a web server). I can see transactions for some runnable classes I recognize, but I am also seem a few like 1#run and 2#run. Not sure what those … --- ## [How to find the ingest pipeline used to parse for Nginx logs](https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263)
**Author:** [@Maduranga](https://discuss.elastic.co/u/Maduranga)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 8:26am UTC](https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263 "2022-08-04T08:26:43Z")
Hi, I am using Elastic cloud to send our Nginx logs using Filebeat Nginx module. However, the Nginx log is not parsed and gives "Provided Grok expressions do not match field value" error. The event.original field that… --- ## [How to visualise data geometric point](https://discuss.elastic.co/t/how-to-visualise-data-geometric-point/311345)
**Author:** [@5k\_pwc](https://discuss.elastic.co/u/5k_pwc)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 8:19am UTC](https://discuss.elastic.co/t/how-to-visualise-data-geometric-point/311345 "2022-08-04T08:19:22Z")
Hi, i would visualise my field 'geom' in kibana , but i have no idea at the moment have some one any solution --- ## [Filebeat consuming high I/O operations for smaller files](https://discuss.elastic.co/t/filebeat-consuming-high-i-o-operations-for-smaller-files/308105)
**Author:** [@diptesh2007](https://discuss.elastic.co/u/diptesh2007)\ **Replies:** 8\ **Last updated:** [August 4, 2022, 7:59am UTC](https://discuss.elastic.co/t/filebeat-consuming-high-i-o-operations-for-smaller-files/308105 "2022-08-04T07:59:39Z")
I have the following architecture: Files (\*.json) of ~1-5 KB gets written to a folder throughout the day where file beat is scanning with a frequency of 10s. A json file once written in the file system will never be up… --- ## [./filebeat setup failed to import dashboard](https://discuss.elastic.co/t/filebeat-setup-failed-to-import-dashboard/311371)
**Author:** [@cheching](https://discuss.elastic.co/u/cheching)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 7:55am UTC](https://discuss.elastic.co/t/filebeat-setup-failed-to-import-dashboard/311371 "2022-08-04T07:55:20Z")
Hello guys, I've encountered an issue when tried to install the filebeat in uBuntu Linux, can I have someone assist to look into below error messages please verwriting ILM policy is disabled. Set setup.ilm.overwrite: t… --- ## [Agent bad\_certificate](https://discuss.elastic.co/t/agent-bad-certificate/310827)
**Author:** [@immauss](https://discuss.elastic.co/u/immauss)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 7:33am UTC](https://discuss.elastic.co/t/agent-bad-certificate/310827 "2022-08-04T07:33:06Z")
There are quite a few search results on this topic, but they are all with elastic 7.x. I'm seeing it with 8.3.2. I'm certain that I'm doing something wrong, but for the life of me can not figure out what. I'm using dock… --- ## [How to filter only specific objects from nested array in elasticsearch?](https://discuss.elastic.co/t/how-to-filter-only-specific-objects-from-nested-array-in-elasticsearch/310691)
**Author:** [@Munam\_Tariq](https://discuss.elastic.co/u/Munam_Tariq)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 7:08am UTC](https://discuss.elastic.co/t/how-to-filter-only-specific-objects-from-nested-array-in-elasticsearch/310691 "2022-08-04T07:08:07Z")
{ "sku\_id": 12, "product\_id": 1, "product\_name": "coca-cola 1.5 L", "category\_name": "beverages", "brand\_name": "coca cola", "sellers": \[ { "seller": 1, "price": 50 }, { "seller"… --- ## [Task limitations](https://discuss.elastic.co/t/task-limitations/311271)
**Author:** [@Spyros\_Giannopulos](https://discuss.elastic.co/u/Spyros_Giannopulos)\ **Replies:** 2\ **Last updated:** [August 4, 2022, 6:57am UTC](https://discuss.elastic.co/t/task-limitations/311271 "2022-08-04T06:57:48Z")
Hello, I am planning to push in a cluster without limits tasks in low priority that may take time from seconds to maybe sometimes minutes to finish. The number of tasks can vary without protecting it with limits. I trie… --- ## [Datastream index name](https://discuss.elastic.co/t/datastream-index-name/310985)
**Author:** [@Viktor\_Avramovski](https://discuss.elastic.co/u/Viktor_Avramovski)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 6:56am UTC](https://discuss.elastic.co/t/datastream-index-name/310985 "2022-08-04T06:56:55Z")
Hey I was reading the documentation here: Data streams | Elasticsearch Guide \[7.17\] | Elastic I read that the index name is generated with the following format .ds-\-\-\ This means … --- ## [Need to migrate data from Single Node Elastic Search Cluster to new Multi Node Elastic Search Cluster](https://discuss.elastic.co/t/need-to-migrate-data-from-single-node-elastic-search-cluster-to-new-multi-node-elastic-search-cluster/311324)
**Author:** [@Sidd\_Sach](https://discuss.elastic.co/u/Sidd_Sach)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 6:51am UTC](https://discuss.elastic.co/t/need-to-migrate-data-from-single-node-elastic-search-cluster-to-new-multi-node-elastic-search-cluster/311324 "2022-08-04T06:51:06Z")
We have a single node Elastic Search cluster (v7.17.1) running. We are creating a new multi node Master-Data-Client Elastic Search (v7.17.1) cluster for high-availability. We are using Kubernetes and helm charts for dep… --- ## [Combined fields error](https://discuss.elastic.co/t/combined-fields-error/311364)
**Author:** [@renxu](https://discuss.elastic.co/u/renxu)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 6:50am UTC](https://discuss.elastic.co/t/combined-fields-error/311364 "2022-08-04T06:50:47Z")
{ "query": { "combined\_fields" : { "query": "database systems", "fields": \[ "title", "abstract", "body"\], "operator": "and" } } } { "error": { "root\_cause": \[ { "type": "parsing\_exception", "reas… --- ## [Why is retry\_on\_conflict necessary?](https://discuss.elastic.co/t/why-is-retry-on-conflict-necessary/311177)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 6:50am UTC](https://discuss.elastic.co/t/why-is-retry-on-conflict-necessary/311177 "2022-08-04T06:50:09Z")
We are battling to understand why version conflicts occur and why retry\_on\_conflict is a sensible strategy to resolving them. Consider Document \_id: 1 which has value foo: 1 and \_version: 1. If several processes try to … --- ## [ES VersionConflictEngineException current version \[-1\]](https://discuss.elastic.co/t/es-versionconflictengineexception-current-version-1/311282)
**Author:** [@zhcwang](https://discuss.elastic.co/u/zhcwang)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 6:33am UTC](https://discuss.elastic.co/t/es-versionconflictengineexception-current-version-1/311282 "2022-08-04T06:33:23Z")
I am using ElasticSearch Cluster backed by 3 nodes and batch update several items in one run. It reports version conflicts of one item, and the raw log is VersionConflictEngineException\[\[informationObjects\]\[BTRB3H7GNVG… --- ## [Logstash filter condition not working some times](https://discuss.elastic.co/t/logstash-filter-condition-not-working-some-times/310722)
**Author:** [@perezdev](https://discuss.elastic.co/u/perezdev)\ **Replies:** 6\ **Last updated:** [August 4, 2022, 6:31am UTC](https://discuss.elastic.co/t/logstash-filter-condition-not-working-some-times/310722 "2022-08-04T06:31:29Z")
Hello, I have following logstash configuration file for winlogbeat events: input { #Winlgobeat beats { port =\> 5044 } } filter { #Filter winlogbeat events mutate { rename =\> { "… --- ## [No support for distance between a term and an exact term with slop](https://discuss.elastic.co/t/no-support-for-distance-between-a-term-and-an-exact-term-with-slop/311309)
**Author:** [@Savi\_Ifraimov](https://discuss.elastic.co/u/Savi_Ifraimov)\ **Replies:** 2\ **Last updated:** [August 4, 2022, 6:16am UTC](https://discuss.elastic.co/t/no-support-for-distance-between-a-term-and-an-exact-term-with-slop/311309 "2022-08-04T06:16:59Z")
Hello, I am trying to use the 'simple query string query' (as well as other query options) to give me certain results and wonder about my options / if it is possible. The challenge: to search for a term1 within distanc… --- ## [Elasticsearch: Nested JSON object parsing and aggregation](https://discuss.elastic.co/t/elasticsearch-nested-json-object-parsing-and-aggregation/311340)
**Author:** [@Josh\_Thatcher](https://discuss.elastic.co/u/Josh_Thatcher)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 6:12am UTC](https://discuss.elastic.co/t/elasticsearch-nested-json-object-parsing-and-aggregation/311340 "2022-08-04T06:12:33Z")
I am currently working on a project that takes GitLab Security Scanner artifacts, curls the JSON artifact files to ElasticSearch, and then visualizes certain information from said artifacts. In this scenario, I am trying… --- ## [Configuration of heartbeat on Scale](https://discuss.elastic.co/t/configuration-of-heartbeat-on-scale/311027)
**Author:** [@syd05](https://discuss.elastic.co/u/syd05)\ **Replies:** 3\ **Last updated:** [August 4, 2022, 5:33am UTC](https://discuss.elastic.co/t/configuration-of-heartbeat-on-scale/311027 "2022-08-04T05:33:28Z")
Hello, I'm evaluating the option of configuring heartbeat to monitor URL's at scale. I have 1000's of endpoints to monitor with a check interval ranging between 30 seconds to a few minutes . I don't have an idea of how … --- ## [Transport Error 503](https://discuss.elastic.co/t/transport-error-503/311201)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 2:00am UTC](https://discuss.elastic.co/t/transport-error-503/311201 "2022-08-04T02:00:21Z")
Traceback (most recent call last): File "/usr/lib/python3.8/code.py", line 90, in runcode exec(code, self.locals) File "", line 1, in File "/usr/local/lib/python3.8/dist-packages/elasticsearch/client/utils.py", line… --- ## [Failed to put mappings on indices](https://discuss.elastic.co/t/failed-to-put-mappings-on-indices/311224)
**Author:** [@davekang](https://discuss.elastic.co/u/davekang)\ **Replies:** 2\ **Last updated:** [August 4, 2022, 1:59am UTC](https://discuss.elastic.co/t/failed-to-put-mappings-on-indices/311224 "2022-08-04T01:59:59Z")
hi I created a new index for re-indexing and tried re-indexing, but I get the following error: \[DEBUG\]\[o.e.a.a.i.m.p.TransportPutMappingAction\] \[node-01\] failed to put mappings on indices \[\[\[ma\_2022/mmRNrJPwRfutlNQs8L… --- ## [LICENSE \[EXPIRED\]?](https://discuss.elastic.co/t/license-expired/311279)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 1:57am UTC](https://discuss.elastic.co/t/license-expired/311279 "2022-08-04T01:57:16Z")
HELLO, I used elasticsearch + kibana for a 30 day trial on mars so LICENSE \[EXPIRED\] ON \[WEDNESDAY, APRIL 20, 2022\]. so i reinstalled another elasticsearch+kibana and i start using normally. yesterday i created new inde… --- ## [Elastalert certification on ELK 8](https://discuss.elastic.co/t/elastalert-certification-on-elk-8/311350)
**Author:** [@Mohamed\_Alawami](https://discuss.elastic.co/u/Mohamed_Alawami)\ **Replies:** 1\ **Last updated:** [August 4, 2022, 12:04am UTC](https://discuss.elastic.co/t/elastalert-certification-on-elk-8/311350 "2022-08-04T00:04:54Z")
I am having an error and not ebale to setup the certification for pem in ELK. The certification comes end with. . 12 not pem. I tired to generate it using ELK tools but it did not work --- ## ["CURATE YOUR RESULT" for lab 1-"Introduction to Elastic App Search". https://enterprise-search-fundamentals-af0040.kb.us-east4.gcp.elastic-cloud.com:9243/app/enterprise\_search/app\_search/engines/app-search-fundamentals/curations](https://discuss.elastic.co/t/curate-your-result-for-lab-1-introduction-to-elastic-app-search-https-enterprise-search-fundamentals-af0040-kb-us-east4-gcp-elastic-cloud-com-9243-app-enterprise-search-app-search-engines-app-search-fundamentals-curations/310793)
**Author:** [@Kimberly](https://discuss.elastic.co/u/Kimberly)\ **Replies:** 7\ **Last updated:** [August 3, 2022, 9:32pm UTC](https://discuss.elastic.co/t/curate-your-result-for-lab-1-introduction-to-elastic-app-search-https-enterprise-search-fundamentals-af0040-kb-us-east4-gcp-elastic-cloud-com-9243-app-enterprise-search-app-search-engines-app-search-fundamentals-curations/310793 "2022-08-03T21:32:25Z")
I am working on "CURATE YOUR RESULT" for lab 1-"Introduction to Elastic App Search" for the class 1. I turned on "Enable suggestions" on Setting and unchecked "Automatically accept new suggestions. I followed the instr… --- ## [Alerts based on Logs of Analytics and not from APM data](https://discuss.elastic.co/t/alerts-based-on-logs-of-analytics-and-not-from-apm-data/311347)
**Author:** [@gabrsar](https://discuss.elastic.co/u/gabrsar)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 9:27pm UTC](https://discuss.elastic.co/t/alerts-based-on-logs-of-analytics-and-not-from-apm-data/311347 "2022-08-03T21:27:56Z")
I already can make alerts from APM data, but would also need to make some alarms from my own logs (the ones from Kibana, in the Analytics -\> Discover window) too. Is it possible? Thank you --- ## [Using Elastic.Apm.NetCoreAll with Serilog.AspNetCore](https://discuss.elastic.co/t/using-elastic-apm-netcoreall-with-serilog-aspnetcore/311349)
**Author:** [@aims519](https://discuss.elastic.co/u/aims519)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 9:24pm UTC](https://discuss.elastic.co/t/using-elastic-apm-netcoreall-with-serilog-aspnetcore/311349 "2022-08-03T21:24:35Z")
Kibana version: 7.16.3 Elasticsearch version: 7.16.3 APM Server version: 7.16.3 I'm having an issue when trying to use the Elastic APM performance monitoring while also sending logs to Elastic Search. I've reproduced … [Previous page](https://discuss.elastic.co/latest.md?page=1018) [Next page](https://discuss.elastic.co/latest.md?page=1020)