# Latest **URL:** https://discuss.elastic.co/latest.md?page=1050 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1051 --- ## [Search query not returning result data](https://discuss.elastic.co/t/search-query-not-returning-result-data/309488)
**Author:** [@jsr](https://discuss.elastic.co/u/jsr)\ **Replies:** 6\ **Last updated:** [July 13, 2022, 11:10am UTC](https://discuss.elastic.co/t/search-query-not-returning-result-data/309488 "2022-07-13T11:10:29Z")
I tried to fetch data via search query api through postman /\_search if I search through without filter { "query": { "match": { "message": { "query": "matching\_data" } } } } I'm getting… --- ## [Full warm blocks transition to delete](https://discuss.elastic.co/t/full-warm-blocks-transition-to-delete/309521)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 10:49am UTC](https://discuss.elastic.co/t/full-warm-blocks-transition-to-delete/309521 "2022-07-13T10:49:11Z")
HI, I have ElasticSearch v"7.17.0" 1st day HOT 2nd day Warm 9nd day Delete the problem is when WARM is full , DELETE phase is not working. Shards are waiting for nodes to move to WARM and age above 9th day despite … --- ## [Foreach Ingest processor + condition](https://discuss.elastic.co/t/foreach-ingest-processor-condition/309435)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 9:55am UTC](https://discuss.elastic.co/t/foreach-ingest-processor-condition/309435 "2022-07-13T09:55:04Z")
Hello! Please advice. I have documents with fields looks like this { "something": "some value", ... "outdated\_products": \[ { "product": "Google Chrome earlier than 101.0.1034.124" } \], "softw… --- ## [Elasic-agent is online but don't send data](https://discuss.elastic.co/t/elasic-agent-is-online-but-dont-send-data/256293)
**Author:** [@aloalo2242](https://discuss.elastic.co/u/aloalo2242)\ **Replies:** 12\ **Last updated:** [July 13, 2022, 9:40am UTC](https://discuss.elastic.co/t/elasic-agent-is-online-but-dont-send-data/256293 "2022-07-13T09:40:44Z")
Hi, I'm trying to use Elastic Agent and Ingest Manager. I have enroll 2 windows agent with fleet. Installation is ok. In Fleet Tab, Kibana, 2 agent is Online. But it don't send any data (Logs, Index Management, Dashboar… --- ## [Restore Status](https://discuss.elastic.co/t/restore-status/309070)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 5\ **Last updated:** [July 13, 2022, 9:28am UTC](https://discuss.elastic.co/t/restore-status/309070 "2022-07-13T09:28:55Z")
Hello Elastic Team, I have a question regarding on Restoring an index. I perform restore and it ask me to close the indices, so I closed the indices mentioned. Then performed Restore, I checked the Status and its says "… --- ## [Azure App Service Web Job won't start after update: Exiting: The system cannot find the file specified](https://discuss.elastic.co/t/azure-app-service-web-job-wont-start-after-update-exiting-the-system-cannot-find-the-file-specified/309449)
**Author:** [@daymansiege](https://discuss.elastic.co/u/daymansiege)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 5:56pm UTC](https://discuss.elastic.co/t/azure-app-service-web-job-wont-start-after-update-exiting-the-system-cannot-find-the-file-specified/309449 "2022-07-12T17:56:51Z")
Hi! I was using 7.9.2 filebeat successfully as Azure Web Job with IIS module enabled. Was running it as this: run.cmd: set JOB\_DIR=%~dp0 %JOB\_DIR%filebeat.exe --environment=windows\_service -c %JOB\_DIR%filebeat.yml --… --- ## [Mass Custom SVG Icons for Map](https://discuss.elastic.co/t/mass-custom-svg-icons-for-map/309455)
**Author:** [@WMask](https://discuss.elastic.co/u/WMask)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 9:05am UTC](https://discuss.elastic.co/t/mass-custom-svg-icons-for-map/309455 "2022-07-13T09:05:30Z")
My company is trying to add a very large number of SVG Icons (10,000+ individual icons) to our world map visualized on Kibana and link it to data keywords we have in one of our data streams. Does anyone know an easy way… --- ## [Count emails that have more than 10 documents (buckets count)](https://discuss.elastic.co/t/count-emails-that-have-more-than-10-documents-buckets-count/307477)
**Author:** [@jack\_daniels00](https://discuss.elastic.co/u/jack_daniels00)\ **Replies:** 3\ **Last updated:** [July 13, 2022, 8:58am UTC](https://discuss.elastic.co/t/count-emails-that-have-more-than-10-documents-buckets-count/307477 "2022-07-13T08:58:07Z")
Hi! I have documents in elastic like: { "email": "user@example.com", "subject": "Email subject", "body": "Email body" } And I'm trying to count all unique emails that have more than 10 documents. I can re… --- ## [Failed to start Elasticsearch(/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)](https://discuss.elastic.co/t/failed-to-start-elasticsearch-usr-lib-systemd-system-elasticsearch-service-disabled-vendor-preset-disabled/309514)
**Author:** [@sagar\_hukre](https://discuss.elastic.co/u/sagar_hukre)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 8:43am UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-usr-lib-systemd-system-elasticsearch-service-disabled-vendor-preset-disabled/309514 "2022-07-13T08:43:08Z")
● elasticsearch.service - Elasticsearch Loaded: loaded \`(/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)\` Active: failed (Result: exit-code) since Wed 2022-07-13 14:05:42 IST; 1min… --- ## [Is combined\_script required or not in scripted\_metric?](https://discuss.elastic.co/t/is-combined-script-required-or-not-in-scripted-metric/309502)
**Author:** [@angelo\_c](https://discuss.elastic.co/u/angelo_c)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 7:54am UTC](https://discuss.elastic.co/t/is-combined-script-required-or-not-in-scripted-metric/309502 "2022-07-13T07:54:54Z")
Hi there, I was reading the documentation for scripted\_metric aggregation here, but I feel it is a bit confusing. I report what written there: map\_script Executed once per document collected. This is a required scrip… --- ## [Writing to wrong data stream's backing index after rollover](https://discuss.elastic.co/t/writing-to-wrong-data-streams-backing-index-after-rollover/309505)
**Author:** [@NejcK](https://discuss.elastic.co/u/NejcK)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 8:11am UTC](https://discuss.elastic.co/t/writing-to-wrong-data-streams-backing-index-after-rollover/309505 "2022-07-13T08:11:32Z")
Hi. I have a strange problem with data stream and filebeat. I've updated a mapping table and wanted to see if the new mappings work so I ran a manual rollup on the (test) data stream with POST robobeat-ds-sim-01-7.17/\_… --- ## [Failed to process cluster event (index-aliases) within 30s](https://discuss.elastic.co/t/failed-to-process-cluster-event-index-aliases-within-30s/309504)
**Author:** [@Anca\_Muresan](https://discuss.elastic.co/u/Anca_Muresan)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 8:09am UTC](https://discuss.elastic.co/t/failed-to-process-cluster-event-index-aliases-within-30s/309504 "2022-07-13T08:09:54Z")
Hello everyone , I get this error very frequently Elasticsearch\\Common\\Exceptions\\ServerErrorResponseException: {"error":{"root\_cause":\[{"type":"process\_cluster\_event\_timeout\_exception","reason":"failed to process clus… --- ## [Logstash monitoring with metricbeat](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat/308474)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 5\ **Last updated:** [July 13, 2022, 7:53am UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat/308474 "2022-07-13T07:53:51Z")
Hi, I have an Elastic Cloud cluster running (7.17.3). I'm plugging in a local logstash monitoring with metricbeat (7.17.4). I can see an index .monitoring-logstash-7-mb-2022.06.29 filling in over time. But I can't fin… --- ## [Invalid Index Error in Elastic Search - querying against multiple indexes](https://discuss.elastic.co/t/invalid-index-error-in-elastic-search-querying-against-multiple-indexes/309462)
**Author:** [@bigalbunayan](https://discuss.elastic.co/u/bigalbunayan)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 10:49pm UTC](https://discuss.elastic.co/t/invalid-index-error-in-elastic-search-querying-against-multiple-indexes/309462 "2022-07-12T22:49:36Z")
When I run the below code I'm running the following in error in Elasticsearch: Invalid alias name \[...\] must not contain the following characters \[ , \\", \*, \\\\, \<, |, ,, \>, /, ?\] It doesn't like that I'm using index1,i… --- ## [Error Install APM-Agent M1](https://discuss.elastic.co/t/error-install-apm-agent-m1/308805)
**Author:** [@sefhi](https://discuss.elastic.co/u/sefhi)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 10:18am UTC](https://discuss.elastic.co/t/error-install-apm-agent-m1/308805 "2022-07-04T10:18:24Z")
I'm having some trouble installing Fleet Server in Kibana on an m1 pro. When I run the command sudo ./elastic-agent install -v \\ --fleet-server-es=http://localhost:9200 \\ --fleet-server-service-token=AAEAAWVsYXN… --- ## [Filebeat cannt connect to kibana](https://discuss.elastic.co/t/filebeat-cannt-connect-to-kibana/309433)
**Author:** [@matin44](https://discuss.elastic.co/u/matin44)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 7:29am UTC](https://discuss.elastic.co/t/filebeat-cannt-connect-to-kibana/309433 "2022-07-13T07:29:39Z")
i try to setup filebeat on redhat when i run the command "filebeat setup -e" i get error message "Exiting: error connecting to Kibana: fail to get the Kibana version ....." i changed the kibana host name at filebeat.y… --- ## [Docker memory and cpu metrics for windows 2019](https://discuss.elastic.co/t/docker-memory-and-cpu-metrics-for-windows-2019/309494)
**Author:** [@Chetan\_Goswami](https://discuss.elastic.co/u/Chetan_Goswami)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 7:15am UTC](https://discuss.elastic.co/t/docker-memory-and-cpu-metrics-for-windows-2019/309494 "2022-07-13T07:15:54Z")
Using metricbeat with Docker module on windows server 2019, unable to get any memory and cpu with all values 0. For memory metricset I get an error No memory stats data available There are issues and topics about this i… --- ## [Error on starting elasticsearch](https://discuss.elastic.co/t/error-on-starting-elasticsearch/309493)
**Author:** [@fransrampai](https://discuss.elastic.co/u/fransrampai)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 7:13am UTC](https://discuss.elastic.co/t/error-on-starting-elasticsearch/309493 "2022-07-13T07:13:05Z")
Hi I am having error when start elasticsearch.8.3.2, please see my logs: Jul 13 09:06:22 rnb03-sbices1 systemd-entrypoint\[22381\]: /usr/share/elasticsearch/bin/systemd-entrypoint: line 7: my\_pwd\_file.tmp: No such file or… --- ## [Watcher fails to send email](https://discuss.elastic.co/t/watcher-fails-to-send-email/309490)
**Author:** [@Jacky\_Kwok](https://discuss.elastic.co/u/Jacky_Kwok)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 7:05am UTC](https://discuss.elastic.co/t/watcher-fails-to-send-email/309490 "2022-07-13T07:05:08Z")
Hi. I am currently using the trial version of elastic cloud. I have setup a watch alert which will send email daily. I have whitelisted my email address. But still, it shows execution failing. My actual mail address i… --- ## [Query two Indexes, only get results which match in both indexes](https://discuss.elastic.co/t/query-two-indexes-only-get-results-which-match-in-both-indexes/309480)
**Author:** [@manoj-manoharan](https://discuss.elastic.co/u/manoj-manoharan)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 6:41am UTC](https://discuss.elastic.co/t/query-two-indexes-only-get-results-which-match-in-both-indexes/309480 "2022-07-13T06:41:07Z")
I have a use case in Elasticsearch. I want to search two indexes containing different schemas and get result which matches the query An example of what i want to achieve is here : Query Multiple Indexes, but apply queri… --- ## [How to compare data to find missing one](https://discuss.elastic.co/t/how-to-compare-data-to-find-missing-one/308924)
**Author:** [@josephLiu](https://discuss.elastic.co/u/josephLiu)\ **Replies:** 15\ **Last updated:** [July 13, 2022, 6:37am UTC](https://discuss.elastic.co/t/how-to-compare-data-to-find-missing-one/308924 "2022-07-13T06:37:31Z")
I need to use ES to realize an automatic function of detecting lost logs，Company don't want to write extra code The method is as follows： Through filebeat, log is continuously sent to two indexes from different source… --- ## [Event filter for Elastict Agent and Endpoint Security](https://discuss.elastic.co/t/event-filter-for-elastict-agent-and-endpoint-security/309429)
**Author:** [@Axel\_zendata](https://discuss.elastic.co/u/Axel_zendata)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 5:48am UTC](https://discuss.elastic.co/t/event-filter-for-elastict-agent-and-endpoint-security/309429 "2022-07-13T05:48:08Z")
Dear all, I created lot of event filter in Security -\> Event Filter for the Elastic Endpoint Agent, but it 's still impossible to use regular expression to exclude event (except for file.path.text). Do you have an id… --- ## [Mapper\_parsing\_Exception\\", \\"reason\\"=\>\\"failed to parse field \[service\] of type \[text\] in document](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-field-service-of-type-text-in-document/309476)
**Author:** [@skumarp7](https://discuss.elastic.co/u/skumarp7)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 5:47am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-field-service-of-type-text-in-document/309476 "2022-07-13T05:47:28Z")
Hi Team, Elasticsearch is throwing mapper\_parsing\_exception when we try to push logs to an index from different applications. As different applications generates logs with same field \[whose type might differ\], there are… --- ## [How many Log's supports Elasticsearch version Free](https://discuss.elastic.co/t/how-many-logs-supports-elasticsearch-version-free/309466)
**Author:** [@Javier\_Alberto\_Ameli](https://discuss.elastic.co/u/Javier_Alberto_Ameli)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 11:38pm UTC](https://discuss.elastic.co/t/how-many-logs-supports-elasticsearch-version-free/309466 "2022-07-12T23:38:57Z")
How many machines sending log's simultaneously, does Elasticksearch Stack support the Free version, not licensed? --- ## [Filebeat central log server and hostname](https://discuss.elastic.co/t/filebeat-central-log-server-and-hostname/308832)
**Author:** [@parisila](https://discuss.elastic.co/u/parisila)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 10:51pm UTC](https://discuss.elastic.co/t/filebeat-central-log-server-and-hostname/308832 "2022-07-12T22:51:52Z")
I have a central log server receiving all system and audit logs. The system logs all go into the same log file and have the host name in the message. I only have filebeat running on the central log server processing lo… --- ## [Indicator Match Rule Fails with too\_many\_nested\_clauses](https://discuss.elastic.co/t/indicator-match-rule-fails-with-too-many-nested-clauses/309233)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 4\ **Last updated:** [July 12, 2022, 9:46pm UTC](https://discuss.elastic.co/t/indicator-match-rule-fails-with-too-many-nested-clauses/309233 "2022-07-12T21:46:03Z")
Hi, I created an indicator match rule using intel from the Recorded Future integration package v1.0.1 I am getting the following failure when the rule runs: Bulk Indexing of signals failed: ResponseError: search\_phase… --- ## [Elasticsearch.service failing on Debian](https://discuss.elastic.co/t/elasticsearch-service-failing-on-debian/309366)
**Author:** [@kamie](https://discuss.elastic.co/u/kamie)\ **Replies:** 21\ **Last updated:** [July 12, 2022, 9:25pm UTC](https://discuss.elastic.co/t/elasticsearch-service-failing-on-debian/309366 "2022-07-12T21:25:07Z")
My operating system is Debian 11 (Bullseye), it runs on a Pentium E5800 I've installed JDK/Java 11 (and set the path), apt-transport-https, the Elasticsearch keys and repo, and have updated my system multiple times. I'v… --- ## [Failed to filter using following grok pattern](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116)
**Author:** [@Rao\_Nelakurti](https://discuss.elastic.co/u/Rao_Nelakurti)\ **Replies:** 2\ **Last updated:** [July 12, 2022, 8:06pm UTC](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116 "2022-07-12T20:06:15Z")
Hi Team, I'm trying filter following log message, \[2022-07-06T20:54:20.471-0700\] \[LogLevel:INFO\] \[ServerName:xyz.vcn.com\] \[IP:10.x.x.66\]\[AppName:IoT\] \[FlowName: updateDevice\] \[ID:2022-07-06 20:54:20.471\] \[ECID:yja\_Y1eg… --- ## [Timestamp in Windows event message encoded ANSI/Windows-12 adds garbage value when converted in utf8 by winlogbeat](https://discuss.elastic.co/t/timestamp-in-windows-event-message-encoded-ansi-windows-12-adds-garbage-value-when-converted-in-utf8-by-winlogbeat/299069)
**Author:** [@Raunak17](https://discuss.elastic.co/u/Raunak17)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 8:00pm UTC](https://discuss.elastic.co/t/timestamp-in-windows-event-message-encoded-ansi-windows-12-adds-garbage-value-when-converted-in-utf8-by-winlogbeat/299069 "2022-07-12T20:00:41Z")
The windows event message is below when converted to utf8, it is adding garbage value "The system time has changed to ‎2022‎-‎03‎-‎08T09:51:08.763000000Z from ‎2022‎-‎03‎-‎08T09:50:14.842044400Z.… --- ## [LogStash::Json::ParserError: Unexpected character ('(' (code 40))](https://discuss.elastic.co/t/logstash-unexpected-character-code-40/309438)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 9\ **Last updated:** [July 12, 2022, 7:59pm UTC](https://discuss.elastic.co/t/logstash-unexpected-character-code-40/309438 "2022-07-12T19:59:26Z")
I'm getting following error Error: :exception=\>#\