# Latest **URL:** https://discuss.elastic.co/latest.md?page=1098 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1099 --- ## [Not able to add Elasticsearch Cloud in Azure due to required "Subscription owner" permission not allowed](https://discuss.elastic.co/t/not-able-to-add-elasticsearch-cloud-in-azure-due-to-required-subscription-owner-permission-not-allowed/306197)
**Author:** [@arunvelu](https://discuss.elastic.co/u/arunvelu)\ **Replies:** 4\ **Last updated:** [June 8, 2022, 12:10pm UTC](https://discuss.elastic.co/t/not-able-to-add-elasticsearch-cloud-in-azure-due-to-required-subscription-owner-permission-not-allowed/306197 "2022-06-08T12:10:36Z")
Hello, We are looking to try Elasticsearch in Azure for analyzing the application's log data. To do this, I planned on creating an instance in Azure, but I get an error message at creation – “Validation failed. Only sub… --- ## [Getting incorrect inner hits from parent child relationship when combined with boolean query](https://discuss.elastic.co/t/getting-incorrect-inner-hits-from-parent-child-relationship-when-combined-with-boolean-query/306688)
**Author:** [@Mohammad\_Parsa](https://discuss.elastic.co/u/Mohammad_Parsa)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 11:26am UTC](https://discuss.elastic.co/t/getting-incorrect-inner-hits-from-parent-child-relationship-when-combined-with-boolean-query/306688 "2022-06-08T11:26:52Z")
Hi Everyone I am getting incorrect inner hits results when combining parent-child query with boolean query. To reproduce the issue, I create this Index PUT /my-index-000001 { "mappings": { "\_routing": { "r… --- ## [Find nested document by min value of its field and apply another filters on this document](https://discuss.elastic.co/t/find-nested-document-by-min-value-of-its-field-and-apply-another-filters-on-this-document/306689)
**Author:** [@Nat123](https://discuss.elastic.co/u/Nat123)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 11:31am UTC](https://discuss.elastic.co/t/find-nested-document-by-min-value-of-its-field-and-apply-another-filters-on-this-document/306689 "2022-06-08T11:31:27Z")
Hello, I have a document (user) and a list of nested documents (orders) in Elastic. I need to find a user with an order satisfied a bunch of conditions: the status of order should have some specific value, its id should… --- ## [Multiple alerts from a single watch script - feasible?](https://discuss.elastic.co/t/multiple-alerts-from-a-single-watch-script-feasible/306685)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 11:14am UTC](https://discuss.elastic.co/t/multiple-alerts-from-a-single-watch-script-feasible/306685 "2022-06-08T11:14:22Z")
Hi All, Let me brief the scenario and the objective. The requirement is to create watcher alerts for different items where the threshold and timeframe are the same. Now to make it happen, I have created separate watch… --- ## [How to write kql query in kibana to include only 9 characters of a field?](https://discuss.elastic.co/t/how-to-write-kql-query-in-kibana-to-include-only-9-characters-of-a-field/306672)
**Author:** [@Arifullah](https://discuss.elastic.co/u/Arifullah)\ **Replies:** 5\ **Last updated:** [June 8, 2022, 11:02am UTC](https://discuss.elastic.co/t/how-to-write-kql-query-in-kibana-to-include-only-9-characters-of-a-field/306672 "2022-06-08T11:02:04Z")
I am using kibana 8.1 so I want to filter the data in discover section. Tha index has a field whic is in number format and it has different kinds of numbers which range from 4 characters up to 12 or 13 characters. So I w… --- ## [Increase max\_bucket to 60,000 or make 6 msearch returning 10,000 buckets each?](https://discuss.elastic.co/t/increase-max-bucket-to-60-000-or-make-6-msearch-returning-10-000-buckets-each/306480)
**Author:** [@misterone](https://discuss.elastic.co/u/misterone)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 10:50am UTC](https://discuss.elastic.co/t/increase-max-bucket-to-60-000-or-make-6-msearch-returning-10-000-buckets-each/306480 "2022-06-08T10:50:55Z")
hey, I have a query that does this. It's a bunch of terms aggregations. (group by = terms) filter by date from year 2015 to 2020 group by region group by date from year 2015 to 2020 group by country grou… --- ## [Elasticsearch input plugin used to \_count documents. Is it possible?](https://discuss.elastic.co/t/elasticsearch-input-plugin-used-to-count-documents-is-it-possible/306682)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-used-to-count-documents-is-it-possible/306682 "2022-06-08T10:46:44Z")
Hey there, I was trying to use the Elasticsearch input plugin just to count documents in a specific timerange or to count the specific \_type documents or so on, but I saw that I cannot use the \_count method and I saw al… --- ## [AWS fleet integration fails with API key error on ingest](https://discuss.elastic.co/t/aws-fleet-integration-fails-with-api-key-error-on-ingest/304846)
**Author:** [@diogof](https://discuss.elastic.co/u/diogof)\ **Replies:** 10\ **Last updated:** [June 8, 2022, 10:42am UTC](https://discuss.elastic.co/t/aws-fleet-integration-fails-with-api-key-error-on-ingest/304846 "2022-06-08T10:42:40Z")
Hi I'm in the process of trying to set AWS log ingestion into Elastic Cloud via a Fleet elastic cloud managed elastic agent. I followed the instructions on Install Fleet-managed Elastic Agents | Fleet and Elastic Agent … --- ## [Saved Objectsにて「-」を含む名称の検索について](https://discuss.elastic.co/t/saved-objects/306642)
**Author:** [@na\_taka](https://discuss.elastic.co/u/na_taka)\ **Replies:** 5\ **Last updated:** [June 8, 2022, 10:33am UTC](https://discuss.elastic.co/t/saved-objects/306642 "2022-06-08T10:33:11Z")
zzz-zzzのようなObject名称である場合に、名称を完全一致で検索を行うには、どのように指定したら検索できるのでしょうか。 部分一致では、以下のように検索は可能である。 しかし、以下のように完全一致となるように指定した場合には該当しない。 "zzz-zzz"と「"」で囲ってみた場合でも検索がでませんでした。 --- ## [Rubyフィルターで指定したフィールドを特定フィールド配下に格納したい](https://discuss.elastic.co/t/ruby/306516)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 10:20am UTC](https://discuss.elastic.co/t/ruby/306516 "2022-06-08T10:20:48Z")
下記の構成のドキュメントをlogstashからElasticsearchに連携しております ～省略～ "timestamp\_log": "2022-06-03T09:01:28.000+09:00", "awsRegion": "us-east-1", "requestParameters": { "template": false, "resourceId": "5tfEXAMPLE", "restApiId": "3r… --- ## [Kubernetes Application Logs to App Specific Indexes](https://discuss.elastic.co/t/kubernetes-application-logs-to-app-specific-indexes/306670)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 9:49am UTC](https://discuss.elastic.co/t/kubernetes-application-logs-to-app-specific-indexes/306670 "2022-06-08T09:49:46Z")
We have filebeat collecting logs in kubernetes. We use a data view that is created to view these logs filebeat-\*. Using the filebeat indexes to search our logs has been working fine up until now, but now we are starti… --- ## [Numeric values on timeline](https://discuss.elastic.co/t/numeric-values-on-timeline/306548)
**Author:** [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)\ **Replies:** 6\ **Last updated:** [June 8, 2022, 9:36am UTC](https://discuss.elastic.co/t/numeric-values-on-timeline/306548 "2022-06-08T09:36:20Z")
Hello Kibana users! Can anyone suggest me how can I represent numeric values on a timeline?he fields I'm referrering to are @timestamp and used.bytes; I want to see the distribution of this field over time. thank you in… --- ## [Group by kibana Query](https://discuss.elastic.co/t/group-by-kibana-query/306617)
**Author:** [@chamod\_maduranga](https://discuss.elastic.co/u/chamod_maduranga)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 9:08am UTC](https://discuss.elastic.co/t/group-by-kibana-query/306617 "2022-06-08T09:08:46Z")
I have fields ID, Type, Count and timestamp as follows: { "ID": "15211", "Type": "C", "count": "17", "timestamp": "Jun 3, 2022 @ 12:26:34.000",....}, { "ID": "11243", "Type": "C", "count": "64", "timestamp": "Jun 1, 202… --- ## [How to install kibana and logstash as service in windows server](https://discuss.elastic.co/t/how-to-install-kibana-and-logstash-as-service-in-windows-server/306587)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 8:57am UTC](https://discuss.elastic.co/t/how-to-install-kibana-and-logstash-as-service-in-windows-server/306587 "2022-06-08T08:57:53Z")
How to install kibana and logstash as service in windows server? Can please someone help with the command --- ## [How to identify whether a elasticsearch document is modified or not?](https://discuss.elastic.co/t/how-to-identify-whether-a-elasticsearch-document-is-modified-or-not/306537)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 8:37am UTC](https://discuss.elastic.co/t/how-to-identify-whether-a-elasticsearch-document-is-modified-or-not/306537 "2022-06-08T08:37:38Z")
Hi All, If a logstash pipeline (conf file) is used to update and insert both i.e., enabled below in the conf file. doc\_as\_upsert =\> true action =\> "update" How to know which documents are updated and which are inserte… --- ## [Testing DNS Performance](https://discuss.elastic.co/t/testing-dns-performance/306652)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 8:26am UTC](https://discuss.elastic.co/t/testing-dns-performance/306652 "2022-06-08T08:26:56Z")
I've installed packetbeat on a windows dns server to try and get some insight into requests and performance Is there anything specific I should be looking at from the dashboard to find out if there are issues I'm looki… --- ## [Timelion Aggregate graph with different interval/condition](https://discuss.elastic.co/t/timelion-aggregate-graph-with-different-interval-condition/306651)
**Author:** [@Robert\_Naccache](https://discuss.elastic.co/u/Robert_Naccache)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 8:15am UTC](https://discuss.elastic.co/t/timelion-aggregate-graph-with-different-interval-condition/306651 "2022-06-08T08:15:40Z")
Hello, I'm trying to create a Timelion aggregation and wondering if its possible. Basically the case is, I have documents that includes http response codes. What i'm trying to do is: The default interval could be day… --- ## [How to assign index routing allocation with APM](https://discuss.elastic.co/t/how-to-assign-index-routing-allocation-with-apm/306650)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 8:10am UTC](https://discuss.elastic.co/t/how-to-assign-index-routing-allocation-with-apm/306650 "2022-06-08T08:10:53Z")
I am using APM version 8.2.0, how do i allocate the indexes/data-streams to be on a specific nodeset. For example in my metricbeat.yml and filebeat.yml i might do the following: setup.template.settings: index: … --- ## [Granting Privileges on Datastream Alias not the same in Backing Indices](https://discuss.elastic.co/t/granting-privileges-on-datastream-alias-not-the-same-in-backing-indices/306643)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:28am UTC](https://discuss.elastic.co/t/granting-privileges-on-datastream-alias-not-the-same-in-backing-indices/306643 "2022-06-08T07:28:08Z")
I'm using filebeat and i have created 3 datastreams . PUT \_data\_stream/data\_s1-2022.06.08 PUT \_data\_stream/data\_s2-2022.06.08 PUT \_data\_stream/data\_s3-2022.06.08 And created 3 alias for that datastreams: POST \_aliases… --- ## [Aggregration buckets can access in Elasticsearch query of "Rules and Connectors"](https://discuss.elastic.co/t/aggregration-buckets-can-access-in-elasticsearch-query-of-rules-and-connectors/306641)
**Author:** [@hari\_priya1](https://discuss.elastic.co/u/hari_priya1)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:17am UTC](https://discuss.elastic.co/t/aggregration-buckets-can-access-in-elasticsearch-query-of-rules-and-connectors/306641 "2022-06-08T07:17:58Z")
I am trying to trigger an alert if BindRequestCount is zero for the last 30 mins. So I have created a rule using the Elasticsearch query rule type. { "query": { "bool": { "must": \[ { "term"… --- ## [How to search in attachment content?](https://discuss.elastic.co/t/how-to-search-in-attachment-content/305287)
**Author:** [@frankmehlhop](https://discuss.elastic.co/u/frankmehlhop)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 7:17am UTC](https://discuss.elastic.co/t/how-to-search-in-attachment-content/305287 "2022-06-08T07:17:33Z")
I ingest pdf files into elastic. I can successful search in it using Kibana Console. But at my C# code I don't get any result. I'm quit sure the problem is syntax of my code. But I tried many things and still I don't… --- ## [ELK 7.16.2 hardware requirements - suggestions?](https://discuss.elastic.co/t/elk-7-16-2-hardware-requirements-suggestions/306475)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 7\ **Last updated:** [June 8, 2022, 7:12am UTC](https://discuss.elastic.co/t/elk-7-16-2-hardware-requirements-suggestions/306475 "2022-06-08T07:12:07Z")
Hi Guys, I am using the ELK stack in version 7.16.2 and I would like to ask for some suggestions about the hardware configuration. My Elastic will receive a log of 5 MB every day and I would like to have a retention of … --- ## [Configuration of Logstash to remove domain from URL](https://discuss.elastic.co/t/configuration-of-logstash-to-remove-domain-from-url/305667)
**Author:** [@wii](https://discuss.elastic.co/u/wii)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 6:06am UTC](https://discuss.elastic.co/t/configuration-of-logstash-to-remove-domain-from-url/305667 "2022-06-08T06:06:17Z")
Is it possible to configure Logstash to remove domain name when receiving URL input? E.g: Picture above as an example, I would like to eliminate everthing behind 'path' to send to Elasticsearch. If it is possible, ma… --- ## [Visualize datatable : reformat aggrated value](https://discuss.elastic.co/t/visualize-datatable-reformat-aggrated-value/306562)
**Author:** [@Espen\_Schulstad](https://discuss.elastic.co/u/Espen_Schulstad)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 5:38am UTC](https://discuss.elastic.co/t/visualize-datatable-reformat-aggrated-value/306562 "2022-06-08T05:38:44Z")
Hi, I'd like to use a value in an aggregation to create a link in the datatable. Is this possible? Eg; in the datatable I have a value "specific app name", I'd like to reformat that value to be a string that ends up as… --- ## [Updating only a single field of an elasticsearch data through logstash](https://discuss.elastic.co/t/updating-only-a-single-field-of-an-elasticsearch-data-through-logstash/306540)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 8:37am UTC](https://discuss.elastic.co/t/updating-only-a-single-field-of-an-elasticsearch-data-through-logstash/306540 "2022-06-07T08:37:48Z")
I have a logstash pipeline put into place through which I am getting logs. I want to handle a use-case through logstash configuration in which I have to append a particular value to a field. Currently, it is happening th… --- ## [How to install Kibana and logstash as service in winodws?](https://discuss.elastic.co/t/how-to-install-kibana-and-logstash-as-service-in-winodws/306622)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 4:15am UTC](https://discuss.elastic.co/t/how-to-install-kibana-and-logstash-as-service-in-winodws/306622 "2022-06-08T04:15:09Z")
how to install Kibana and logstash(v.7.17.3) as service in winodws can please someone help with command line --- ## [Enable control access to user in Kibana 8](https://discuss.elastic.co/t/enable-control-access-to-user-in-kibana-8/306539)
**Author:** [@eduhernandezm](https://discuss.elastic.co/u/eduhernandezm)\ **Replies:** 3\ **Last updated:** [June 8, 2022, 4:07am UTC](https://discuss.elastic.co/t/enable-control-access-to-user-in-kibana-8/306539 "2022-06-08T04:07:27Z")
Hello, I have recently installed and configured the ELK architecture on three different linux servers. The configuration that has been implemented is the one that comes by default. Right now, I'm at the point where I … --- ## [Reindex from Remote not working](https://discuss.elastic.co/t/reindex-from-remote-not-working/306532)
**Author:** [@Bit\_Addict](https://discuss.elastic.co/u/Bit_Addict)\ **Replies:** 3\ **Last updated:** [June 8, 2022, 4:04am UTC](https://discuss.elastic.co/t/reindex-from-remote-not-working/306532 "2022-06-08T04:04:40Z")
Hi, I am trying to migrate all watchers from one cluster to another (both on 7.9.2) using the "Reindex from remote" feature, but it looks like the reindex is not picking up any documents. POST \_reindex { "source": { … --- ## [How to secure Beat communication to Elasticsearch](https://discuss.elastic.co/t/how-to-secure-beat-communication-to-elasticsearch/306538)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 3:30am UTC](https://discuss.elastic.co/t/how-to-secure-beat-communication-to-elasticsearch/306538 "2022-06-08T03:30:59Z")
Hello everyone, i've got the following Setup: 3 Node Cluster OS: RedHat 8.6 Kibana: 7.17 Elasticsearch: 7.17 Winlogbeat/Filebeat: 7.17 So i've followed the "Secure your Cluster"-Guides provided: Minimal: Basic: … --- ## [The value of a metric field capped at 1000 (using histogram instrumentation)](https://discuss.elastic.co/t/the-value-of-a-metric-field-capped-at-1000-using-histogram-instrumentation/306612)
**Author:** [@Shuai\_Yuan](https://discuss.elastic.co/u/Shuai_Yuan)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 12:42am UTC](https://discuss.elastic.co/t/the-value-of-a-metric-field-capped-at-1000-using-histogram-instrumentation/306612 "2022-06-08T00:42:51Z")
Hi there, Kibana version: Elasticsearch version: 8.1.3 APM Server version: 8.1.3 APM Agent language and version: Version: 8.1.2 .Net Description of the problem including expected versus actual behavior. Please in… [Previous page](https://discuss.elastic.co/latest.md?page=1097) [Next page](https://discuss.elastic.co/latest.md?page=1099)