# Latest **URL:** https://discuss.elastic.co/latest.md?page=1057 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1058 --- ## [App Search group by multiple fields](https://discuss.elastic.co/t/app-search-group-by-multiple-fields/308932)
**Author:** [@StevenMartins](https://discuss.elastic.co/u/StevenMartins)\ **Replies:** 4\ **Last updated:** [July 7, 2022, 9:54am UTC](https://discuss.elastic.co/t/app-search-group-by-multiple-fields/308932 "2022-07-07T09:54:03Z")
Hi ! Is it possible to group by multiple fields with App Search API ? Such as : "group": { "field": "states", "towns" } like an sql query. it's a common need but I can't find it anywhere as an example. Than… --- ## [Elastalert create index error](https://discuss.elastic.co/t/elastalert-create-index-error/308947)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 9:31am UTC](https://discuss.elastic.co/t/elastalert-create-index-error/308947 "2022-07-07T09:31:16Z")
I have instaled elasticsearch kibana elastalert, when i try to run elastalert-create-index command i am facing this issue. should i run the command from an particular directory ? C:\\Windows\\system32\>elastalert-create-i… --- ## [Search Api doesn't give result of analytics clicks](https://discuss.elastic.co/t/search-api-doesnt-give-result-of-analytics-clicks/309089)
**Author:** [@bilal.shahid](https://discuss.elastic.co/u/bilal.shahid)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 8:55am UTC](https://discuss.elastic.co/t/search-api-doesnt-give-result-of-analytics-clicks/309089 "2022-07-07T08:55:05Z")
I have a table of Search Terms in Analytics of ElasticSearch with the columns of document\_ids of their products, Analytics tags, and clicks. I am searching the query on Postman using Search API of Elasticsearch to get th… --- ## [How to get index rollover last digit](https://discuss.elastic.co/t/how-to-get-index-rollover-last-digit/309010)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 10\ **Last updated:** [July 7, 2022, 8:47am UTC](https://discuss.elastic.co/t/how-to-get-index-rollover-last-digit/309010 "2022-07-07T08:47:24Z")
Hello team ES, In our project, we have a datename index. Index is using a policy that rolls over daily. Sometimes, we might need to update documents in rolled over indices. For that we have a pipeline, that figures out… --- ## [Kibana index .kibana\_task\_manager goes unassigned after few days and cause Red cluster health](https://discuss.elastic.co/t/kibana-index-kibana-task-manager-goes-unassigned-after-few-days-and-cause-red-cluster-health/309028)
**Author:** [@AaronSarkissian](https://discuss.elastic.co/u/AaronSarkissian)\ **Replies:** 2\ **Last updated:** [July 7, 2022, 8:37am UTC](https://discuss.elastic.co/t/kibana-index-kibana-task-manager-goes-unassigned-after-few-days-and-cause-red-cluster-health/309028 "2022-07-07T08:37:44Z")
I'm setting up a cluster on Azure using ECK. The specifications are following: ECK version: 2.2, 2.3 (tried both) Elastic version: 8.0, 8.1.0, 8.2.0, 8.3.1 (tried all versions) K8s version: 1.23.5 Node size: Standard… --- ## [Transform exception stop and expect auto restart](https://discuss.elastic.co/t/transform-exception-stop-and-expect-auto-restart/309069)
**Author:** [@yitiao\_feiyu](https://discuss.elastic.co/u/yitiao_feiyu)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 8:27am UTC](https://discuss.elastic.co/t/transform-exception-stop-and-expect-auto-restart/309069 "2022-07-07T08:27:18Z")
I use transform to filter and move index data. the transforom task run smoothly in nomal status. but in some case, I try to change the index setting e.g. set "number\_of\_replicas" : 0, the transtorm got exception and sto… --- ## [Docker fleet server binding error](https://discuss.elastic.co/t/docker-fleet-server-binding-error/309086)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 7:58am UTC](https://discuss.elastic.co/t/docker-fleet-server-binding-error/309086 "2022-07-07T07:58:53Z")
Hi, I am using containerized fleet server on another machine and getting the following error. \[elastic\_agent\]\[error\] 2022-07-07T07:24:31Z - message: Application: fleet-server--8.3.0\[68af02f0-da42-4b33-b6e0-5264fcf0d72e… --- ## [Can search\_as\_you\_type field show the prefix match results firstly](https://discuss.elastic.co/t/can-search-as-you-type-field-show-the-prefix-match-results-firstly/309083)
**Author:** [@zhengpq](https://discuss.elastic.co/u/zhengpq)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 7:29am UTC](https://discuss.elastic.co/t/can-search-as-you-type-field-show-the-prefix-match-results-firstly/309083 "2022-07-07T07:29:47Z")
i am using the search\_as\_you\_type to auto complete, it is good, but i find the result is sorted by the score, now i need the prefix match results to come firstly, look the example blow: POST page-new/\_search { "\_sour… --- ## [Failed to resolve publish address - error in eck on-premise deployment with kubeadm kubernetes](https://discuss.elastic.co/t/failed-to-resolve-publish-address-error-in-eck-on-premise-deployment-with-kubeadm-kubernetes/307765)
**Author:** [@sanju\_techie](https://discuss.elastic.co/u/sanju_techie)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 7:19am UTC](https://discuss.elastic.co/t/failed-to-resolve-publish-address-error-in-eck-on-premise-deployment-with-kubeadm-kubernetes/307765 "2022-07-07T07:19:25Z")
Hi All, I have setup a kubernetes cluster with kubeadm where I am trying to deploy the eck , I am trying with the simple deployment mentioned below. apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metad… --- ## [How to send multiple email attachments to multiple recipients from single watcher](https://discuss.elastic.co/t/how-to-send-multiple-email-attachments-to-multiple-recipients-from-single-watcher/309009)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 7:07am UTC](https://discuss.elastic.co/t/how-to-send-multiple-email-attachments-to-multiple-recipients-from-single-watcher/309009 "2022-07-07T07:07:06Z")
Hi, The objective is to send multiple email attachments to multiple groups of recipients from a single watcher script. I want to achieve the below but getting error. "actions": { "email\_admin": { "email": {… --- ## [Edge-ngram not working for single edge case!](https://discuss.elastic.co/t/edge-ngram-not-working-for-single-edge-case/309059)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 7:06am UTC](https://discuss.elastic.co/t/edge-ngram-not-working-for-single-edge-case/309059 "2022-07-07T07:06:49Z")
My edge-ngram solution does not return any results for the following search: "10th A" Where 3 documents exist with the field values: "10th Avenue, Red Beach, New Zealand", "4 10th Avenue, Red Beach, New Zealand", … --- ## [Visualizeのデータテーブルについて](https://discuss.elastic.co/t/visualize/309079)
**Author:** [@na\_taka](https://discuss.elastic.co/u/na_taka)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 6:40am UTC](https://discuss.elastic.co/t/visualize/309079 "2022-07-07T06:40:20Z")
お世話になっております。 Visualizeのデータテーブルの設定について質問です。 【input data】 code result a OK a OK a NG b NG b NG 上記のようなデータに対し、以下のようにデータテーブルで表示させたいのですが、 実現できませんでしょうか。実現できる場合、どの様な設定を行えば良いかご教示頂けませんでしょうか。 ==== 【データテーブル… --- ## [Kubernete integration with Fleet](https://discuss.elastic.co/t/kubernete-integration-with-fleet/307712)
**Author:** [@Ehsan\_Orve](https://discuss.elastic.co/u/Ehsan_Orve)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 6:38am UTC](https://discuss.elastic.co/t/kubernete-integration-with-fleet/307712 "2022-07-07T06:38:41Z")
Hi I have started working with elastic\_agent for Kubernetes. I have deployed elastic\_agent pod with DaemonSet in kuber cluster and then register them successfully in Fleet by policy. But filebeat cant read the container… --- ## [Sorting on nested field and then apply aggregation](https://discuss.elastic.co/t/sorting-on-nested-field-and-then-apply-aggregation/309078)
**Author:** [@aryamansingh888](https://discuss.elastic.co/u/aryamansingh888)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 6:34am UTC](https://discuss.elastic.co/t/sorting-on-nested-field-and-then-apply-aggregation/309078 "2022-07-07T06:34:19Z")
"visitor\_data": \[ { "end\_date": "2021-06-08", "pre\_status": "1", "evisitor": true, "edition\_id": "644659", "flag": "1", "event\_functionality": "o… --- ## [Format issue using http output plugin to send logs from logstash to azure eventhub](https://discuss.elastic.co/t/format-issue-using-http-output-plugin-to-send-logs-from-logstash-to-azure-eventhub/309073)
**Author:** [@Shakib\_farooq](https://discuss.elastic.co/u/Shakib_farooq)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 6:02am UTC](https://discuss.elastic.co/t/format-issue-using-http-output-plugin-to-send-logs-from-logstash-to-azure-eventhub/309073 "2022-07-07T06:02:02Z")
Hello, I am facing an issue in forwarding logs from logstash to the event hub, below is the conf file. the requirement is to forward winlog beats logs to the event hub. I am receiving logs in elastic if I kept the form… --- ## [Send an email when Logstash service is down/not running](https://discuss.elastic.co/t/send-an-email-when-logstash-service-is-down-not-running/309068)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 2\ **Last updated:** [July 7, 2022, 5:56am UTC](https://discuss.elastic.co/t/send-an-email-when-logstash-service-is-down-not-running/309068 "2022-07-07T05:56:33Z")
Hi team, I have run Logstash as a service in Remote windows. It is working fine now. But in case of failure scenario, If Logstash service shuts down unexpectedly, then I need to send(alert) an email to the team. How c… --- ## [Create simulated data for ingestion using Rally](https://discuss.elastic.co/t/create-simulated-data-for-ingestion-using-rally/308392)
**Author:** [@lance.zukel](https://discuss.elastic.co/u/lance.zukel)\ **Replies:** 8\ **Last updated:** [July 7, 2022, 3:14am UTC](https://discuss.elastic.co/t/create-simulated-data-for-ingestion-using-rally/308392 "2022-07-07T03:14:53Z")
I would like to be able to perform the following: Have a sample templated document for ingestion Have a custom class that randomizes data to be inserted into the templated document Be able to specify the number of docu… --- ## [Cannot use scripted field in Elasticsearch query?](https://discuss.elastic.co/t/cannot-use-scripted-field-in-elasticsearch-query/309040)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 2:41am UTC](https://discuss.elastic.co/t/cannot-use-scripted-field-in-elasticsearch-query/309040 "2022-07-07T02:41:11Z")
Hi all, I'm using a scripted field, but I'm unable to query with scripted field. Anyway we can use scripted field in elasticsearch? For ex if I query below in dev tools it always gives count as 0: GET my\_index\_\*/\_sea… --- ## [Node Not Showing in Kibana](https://discuss.elastic.co/t/node-not-showing-in-kibana/309027)
**Author:** [@bkamiche](https://discuss.elastic.co/u/bkamiche)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 2:04am UTC](https://discuss.elastic.co/t/node-not-showing-in-kibana/309027 "2022-07-07T02:04:50Z")
I have a 9 node Cluster (6 data and 3 Masters), with version 7.15.5 (all on Intel platform), the cluster works fine. I've added a new data node, with the same version but in ARM, the node has been recognized by the clus… --- ## [Metricbeat monitoring logstash via kubernetes service endpoint issues](https://discuss.elastic.co/t/metricbeat-monitoring-logstash-via-kubernetes-service-endpoint-issues/309064)
**Author:** [@aaronpjak](https://discuss.elastic.co/u/aaronpjak)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 1:59am UTC](https://discuss.elastic.co/t/metricbeat-monitoring-logstash-via-kubernetes-service-endpoint-issues/309064 "2022-07-07T01:59:18Z")
Hi, I am trying to use metricbeat to monitor my logstash instances. I have logstash deployed using the official helm chart and I am running multiple logstash pods behind the kubernetes service. When I use the service en… --- ## [Block 32844 not found](https://discuss.elastic.co/t/block-32844-not-found/308873)
**Author:** [@zhilong](https://discuss.elastic.co/u/zhilong)\ **Replies:** 5\ **Last updated:** [July 7, 2022, 1:41am UTC](https://discuss.elastic.co/t/block-32844-not-found/308873 "2022-07-07T01:41:31Z")
This category relates to the Enterprise Search set of products - App Search, Site Search and Workplace Search. If your question relates to core Elasticsearch functionality, please head over to the #elastic-stack:elastic… --- ## [Can we save some own query params when using trackUrlState?](https://discuss.elastic.co/t/can-we-save-some-own-query-params-when-using-trackurlstate/308883)
**Author:** [@Pudge\_Zhang](https://discuss.elastic.co/u/Pudge_Zhang)\ **Replies:** 2\ **Last updated:** [July 7, 2022, 1:03am UTC](https://discuss.elastic.co/t/can-we-save-some-own-query-params-when-using-trackurlstate/308883 "2022-07-07T01:03:20Z")
Hey guys, I just notice if we put customize query params in url, that would be overridden by search-ui for example, the original url is React App and we change this to (just add abc=123 ) React App when the page is l… --- ## [Error deserializing Phrase Suggester - Java API Client](https://discuss.elastic.co/t/error-deserializing-phrase-suggester-java-api-client/309058)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 12:17am UTC](https://discuss.elastic.co/t/error-deserializing-phrase-suggester-java-api-client/309058 "2022-07-07T00:17:01Z")
Hi everyone. I'm implementing the Phrase Suggester in the Java API Client, the error below occurs: \[Request processing failed; nested exception is co.elastic.clients.json.JsonpMappingException: Error deserializing co.e… --- ## [Http input logstash I want filter logs](https://discuss.elastic.co/t/http-input-logstash-i-want-filter-logs/307724)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 11:37pm UTC](https://discuss.elastic.co/t/http-input-logstash-i-want-filter-logs/307724 "2022-07-06T23:37:12Z")
Hello Everyone I am using http input plugin in logstash I want to filter only POST request from Perticular URL logs should be input and output to elasticsearch how can I achive this. --- ## [Windows elastic-agent-8.2.3-windows-x86\_64](https://discuss.elastic.co/t/windows-elastic-agent-8-2-3-windows-x86-64/309056)
**Author:** [@mluer](https://discuss.elastic.co/u/mluer)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 11:19pm UTC](https://discuss.elastic.co/t/windows-elastic-agent-8-2-3-windows-x86-64/309056 "2022-07-06T23:19:14Z")
I installed a previous version of this agent without issue. This agent has a problem with the installer and it creates an Agent Folder and copies the files, then creates another agent folder inside this one and copies i… --- ## [Auditd ingest pipeline with forwarded logs](https://discuss.elastic.co/t/auditd-ingest-pipeline-with-forwarded-logs/309054)
**Author:** [@parisila](https://discuss.elastic.co/u/parisila)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 10:23pm UTC](https://discuss.elastic.co/t/auditd-ingest-pipeline-with-forwarded-logs/309054 "2022-07-06T22:23:37Z")
I have a central log server where all my audit logs are sent via rsyslog. I was running into an issue where the standard auditd ingest pipeline didn't properly parse the audit log because when it is sent from a remote h… --- ## [Error while starting logstash 8.3.1](https://discuss.elastic.co/t/error-while-starting-logstash-8-3-1/308811)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 10:01pm UTC](https://discuss.elastic.co/t/error-while-starting-logstash-8-3-1/308811 "2022-07-06T22:01:21Z")
Hello guys, Recently i upgraded my logstash instance from 7.x to 8.3.1. But now when i try to start the logstash service, i get the following log: \[ERROR\]\[logstash.runner \] Logging configuration uses Script … --- ## [Java API update index](https://discuss.elastic.co/t/java-api-update-index/308928)
**Author:** [@Dorian](https://discuss.elastic.co/u/Dorian)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 9:18pm UTC](https://discuss.elastic.co/t/java-api-update-index/308928 "2022-07-06T21:18:43Z")
HI everyone, I want to add a new field to a document already indexed. I find this in the documentation: curl -X POST "localhost:9200/home2/\_update/Y\_vIvoEB3cv\_8tuHzt7j?pretty" -H 'Content-Type: application/json' -d' { … --- ## [Manipulate fields in Kibana](https://discuss.elastic.co/t/manipulate-fields-in-kibana/308512)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 8:48pm UTC](https://discuss.elastic.co/t/manipulate-fields-in-kibana/308512 "2022-07-06T20:48:23Z")
Hello. We are using ELK 7.6.2 stack. Kibana console shows the fields as follows: I want to introduce/ add a new field displayed as say "sum" and it should display the sum of "before" and "after" (highlighted as yell… --- ## [Logstash isn't starting. Getting a FATAL error](https://discuss.elastic.co/t/logstash-isnt-starting-getting-a-fatal-error/309045)
**Author:** [@kakkarsachin7](https://discuss.elastic.co/u/kakkarsachin7)\ **Replies:** 6\ **Last updated:** [July 6, 2022, 8:40pm UTC](https://discuss.elastic.co/t/logstash-isnt-starting-getting-a-fatal-error/309045 "2022-07-06T20:40:00Z")
I am new to ELK stack. I am able to start Elasticsearch and Kibana but unable to start Logstash using command logstash -f logstash-studio.conf Version 7.14 Java Version 1.8 Here are the logs:- Using JAVA\_HOME defined… [Previous page](https://discuss.elastic.co/latest.md?page=1056) [Next page](https://discuss.elastic.co/latest.md?page=1058)