# Latest **URL:** https://discuss.elastic.co/latest.md?page=1187 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1188 --- ## [In which version was cluster.initial\_master\_nodes first introduced?](https://discuss.elastic.co/t/in-which-version-was-cluster-initial-master-nodes-first-introduced/301484)
**Author:** [@rachit\_upadhyay](https://discuss.elastic.co/u/rachit_upadhyay)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 9:58am UTC](https://discuss.elastic.co/t/in-which-version-was-cluster-initial-master-nodes-first-introduced/301484 "2022-04-04T09:58:13Z")
Which version was the cluster.initial\_master\_nodes first introduced? --- ## [Too long search with sort inside query after migrate es6.8 to es7.16](https://discuss.elastic.co/t/too-long-search-with-sort-inside-query-after-migrate-es6-8-to-es7-16/301157)
**Author:** [@111338](https://discuss.elastic.co/u/111338)\ **Replies:** 3\ **Last updated:** [April 4, 2022, 9:52am UTC](https://discuss.elastic.co/t/too-long-search-with-sort-inside-query-after-migrate-es6-8-to-es7-16/301157 "2022-04-04T09:52:54Z")
Several years we live with es68 and it works fine. But now we want to migrate to es716 and we got problem with queries which contains sort option inside. For example, we have simple query which returns only one record G… --- ## [Painless Scripting](https://discuss.elastic.co/t/painless-scripting/301043)
**Author:** [@chivas](https://discuss.elastic.co/u/chivas)\ **Replies:** 9\ **Last updated:** [April 4, 2022, 9:51am UTC](https://discuss.elastic.co/t/painless-scripting/301043 "2022-04-04T09:51:58Z")
Hi, I am trying to get a count of the requests hitting my server by time range, and have come up with below query: GET /logs-prod\*/\_search?pretty=true { "query": { "bool": { "filter": \[ { … --- ## [Rollover "action time" seems to increase 10m each day](https://discuss.elastic.co/t/rollover-action-time-seems-to-increase-10m-each-day/301483)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 9:46am UTC](https://discuss.elastic.co/t/rollover-action-time-seems-to-increase-10m-each-day/301483 "2022-04-04T09:46:41Z")
In my setup, the indices are created every day at midnight. I started to notice that "current action time" is increasing about 10m per day, which is starting to be a pattern. Here are the prints: 03-04-2022 04-04-20… --- ## [Mlockall in elastic 7.15.2](https://discuss.elastic.co/t/mlockall-in-elastic-7-15-2/301326)
**Author:** [@samiujan](https://discuss.elastic.co/u/samiujan)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 9:38am UTC](https://discuss.elastic.co/t/mlockall-in-elastic-7-15-2/301326 "2022-04-04T09:38:59Z")
Hi I have changed memory settings for the system and elastic, both, while working on ES v7.6.2 More recently, I've found an ES system running 7.15.2 whose mlockall returned false I checked the documentation and it say… --- ## [Do I need cluster.initial\_master\_nodes?](https://discuss.elastic.co/t/do-i-need-cluster-initial-master-nodes/301480)
**Author:** [@rachit\_upadhyay](https://discuss.elastic.co/u/rachit_upadhyay)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 9:17am UTC](https://discuss.elastic.co/t/do-i-need-cluster-initial-master-nodes/301480 "2022-04-04T09:17:59Z")
Below is the Elasticsearch.yml configuration for my ec2 based ECS Elasticsearch setup. cluster.name: dashboards-elasticsearch node.data: true node.master: true # node.name: ${ES\_NODE\_NAME:} path.data: ${ES\_DATA\_PATH:/… --- ## [How to do subqueries in Kibana?](https://discuss.elastic.co/t/how-to-do-subqueries-in-kibana/301471)
**Author:** [@Yazid\_S](https://discuss.elastic.co/u/Yazid_S)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 8:23am UTC](https://discuss.elastic.co/t/how-to-do-subqueries-in-kibana/301471 "2022-04-04T08:23:11Z")
Hi all, I am exploring log files throught Kibana and I would like to extract the logs that are in error. My problem is that in a day, a machine can be in error in the morning and not be in error in the afternoon. So I … --- ## [Visualize date range pie using custom timestamp with format YYYY-MM-DD-HH:MM:SS](https://discuss.elastic.co/t/visualize-date-range-pie-using-custom-timestamp-with-format-yyyy-mm-dd-hhss/301456)
**Author:** [@ashiqab](https://discuss.elastic.co/u/ashiqab)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 9:10am UTC](https://discuss.elastic.co/t/visualize-date-range-pie-using-custom-timestamp-with-format-yyyy-mm-dd-hhss/301456 "2022-04-04T09:10:39Z")
Dear all, I am trying to visualize a pie chart using one of my custom timestamp columns available in my custom log which has the format YYYY-MM-DD-HH:MM:SS (example 2020-02-18-00:13:17). However "create visualizations… --- ## [Create visualization with average of the last 3 weeks](https://discuss.elastic.co/t/create-visualization-with-average-of-the-last-3-weeks/301288)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 9:00am UTC](https://discuss.elastic.co/t/create-visualization-with-average-of-the-last-3-weeks/301288 "2022-04-04T09:00:11Z")
Hello! I would like to know if there is any way to create a visualization in kibana that makes an average of a metric of the last 3 weeks. I attached a simple drawing for better understanding. If someone could help … --- ## [How to use Top\_Hit in a alarm querry](https://discuss.elastic.co/t/how-to-use-top-hit-in-a-alarm-querry/301473)
**Author:** [@mathric](https://discuss.elastic.co/u/mathric)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 8:40am UTC](https://discuss.elastic.co/t/how-to-use-top-hit-in-a-alarm-querry/301473 "2022-04-04T08:40:50Z")
Hi, we use alarms to get notification about missing (or new) machines onbording to our elk. Therefore we querry the docs containing heartbeats for the last 15min and have a look if every machine has more than 12 beats. … --- ## [How to configure metric threshold using elastic query](https://discuss.elastic.co/t/how-to-configure-metric-threshold-using-elastic-query/301307)
**Author:** [@waelboss](https://discuss.elastic.co/u/waelboss)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 8:27am UTC](https://discuss.elastic.co/t/how-to-configure-metric-threshold-using-elastic-query/301307 "2022-04-04T08:27:00Z")
i want to create a metric threshold using the elastic query that calculate the percentage rate between Max value filed and Current value field and fire the alert when the rate \>= 90% could you please help to write the q… --- ## [Elasticsearch performance](https://discuss.elastic.co/t/elasticsearch-performance/301430)
**Author:** [@osamaali2405](https://discuss.elastic.co/u/osamaali2405)\ **Replies:** 5\ **Last updated:** [April 4, 2022, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch-performance/301430 "2022-04-04T08:23:23Z")
I have an issue when try to update in Elasticsearch, sometimes it takes more than 10 seconds According to the elastic logs, the overall health check itself takes too long , below example is \> 20 seconds {"type": "serve… --- ## [Help with a visualization](https://discuss.elastic.co/t/help-with-a-visualization/301267)
**Author:** [@edu\_perez\_alvarez](https://discuss.elastic.co/u/edu_perez_alvarez)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 8:15am UTC](https://discuss.elastic.co/t/help-with-a-visualization/301267 "2022-04-04T08:15:00Z")
Hello! I have a simple visualization in a dashboard. X-axis is the @timestamp. Y-axis is a MetricValue of a service. I want to add another visualization (another graphic) with the same X-axis. Here, the MetricValue for … --- ## [How to add hyperlink on pie chart block?](https://discuss.elastic.co/t/how-to-add-hyperlink-on-pie-chart-block/300947)
**Author:** [@varsha\_kamble](https://discuss.elastic.co/u/varsha_kamble)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 8:06am UTC](https://discuss.elastic.co/t/how-to-add-hyperlink-on-pie-chart-block/300947 "2022-04-04T08:06:10Z")
hello there? I need to add hyperlinks on pie chart so that it will redirected to other webpage , any provision to do that ? --- ## [How to Reduce Received Logs Size in ELK Stack?](https://discuss.elastic.co/t/how-to-reduce-received-logs-size-in-elk-stack/301066)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 31\ **Last updated:** [April 4, 2022, 7:56am UTC](https://discuss.elastic.co/t/how-to-reduce-received-logs-size-in-elk-stack/301066 "2022-04-04T07:56:54Z")
Hi, I would like to ask, any way we can compress / dedup the sizes of the logs that we received in ELK stack? Thanks. --- ## [Can I have only one master eligible node in elasticsearch](https://discuss.elastic.co/t/can-i-have-only-one-master-eligible-node-in-elasticsearch/301461)
**Author:** [@rachit\_upadhyay](https://discuss.elastic.co/u/rachit_upadhyay)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 7:39am UTC](https://discuss.elastic.co/t/can-i-have-only-one-master-eligible-node-in-elasticsearch/301461 "2022-04-04T07:39:46Z")
I am getting following log message when my single master eligible node goes down and then starts again in ecs. Is it possible to have a cluster with only one master eligible node? What is the ideal number of master e… --- ## [Metricbeat jolokia vs Red Hat AMQ servers vs HTTP error 403](https://discuss.elastic.co/t/metricbeat-jolokia-vs-red-hat-amq-servers-vs-http-error-403/301401)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [April 4, 2022, 7:24am UTC](https://discuss.elastic.co/t/metricbeat-jolokia-vs-red-hat-amq-servers-vs-http-error-403/301401 "2022-04-04T07:24:18Z")
Trying to fetch data through jolokia module from Red Hat AMQ process(es) on a host. Have this module.d/jojokia.yml: - module: jolokia metricsets: \["jmx"\] period: 1m hosts: \["http://localhost:5008"\] namespace: "… --- ## [Logstash queue.drain: true setting not being honored](https://discuss.elastic.co/t/logstash-queue-drain-true-setting-not-being-honored/301460)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 7:19am UTC](https://discuss.elastic.co/t/logstash-queue-drain-true-setting-not-being-honored/301460 "2022-04-04T07:19:33Z")
I've enabled the queue.drain: true setting on one of my logstash instances which has a persistent queue. The behavior I would expect is that when I stop the logstash process ( systemctl logstash stop ) the page files wo… --- ## [Elasticsearch on large HW](https://discuss.elastic.co/t/elasticsearch-on-large-hw/301445)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 3\ **Last updated:** [April 4, 2022, 7:16am UTC](https://discuss.elastic.co/t/elasticsearch-on-large-hw/301445 "2022-04-04T07:16:57Z")
Hi, There is request for me to set up Elasticsearch cluster (8.1) on large hardwares. The hardware of the data nodes: RAM: 384GB Cores: 48 Storage: 11.52 TB SSD Please help me how to set the jvm.options for this set… --- ## [How to remove the white list email Id's from the elastic cloud](https://discuss.elastic.co/t/how-to-remove-the-white-list-email-ids-from-the-elastic-cloud/299860)
**Author:** [@Kannan\_Rajendran](https://discuss.elastic.co/u/Kannan_Rajendran)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 6:51am UTC](https://discuss.elastic.co/t/how-to-remove-the-white-list-email-ids-from-the-elastic-cloud/299860 "2022-04-04T06:51:47Z")
Hi Team, I have situation that we have already whitelist list of email address in the elastic cloud and now our email domain was migrated last week and after migration of domain we don't receive the elastic alert for th… --- ## [Advanced Watcher: Use key value in a mail webhook](https://discuss.elastic.co/t/advanced-watcher-use-key-value-in-a-mail-webhook/299457)
**Author:** [@Jonathan\_Fernandez](https://discuss.elastic.co/u/Jonathan_Fernandez)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 6:50am UTC](https://discuss.elastic.co/t/advanced-watcher-use-key-value-in-a-mail-webhook/299457 "2022-04-04T06:50:03Z")
Hello everybody! So, basically I'm trying to get my 'key' value to print it into my mail body, but I'm not being able to do it. Once I get it, I will iterate over the buckets with a "foreach" before the webhook (within … --- ## [Not able to create Kibana alert on Json log due to match all is not working and time is coming as string](https://discuss.elastic.co/t/not-able-to-create-kibana-alert-on-json-log-due-to-match-all-is-not-working-and-time-is-coming-as-string/300036)
**Author:** [@riya9](https://discuss.elastic.co/u/riya9)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 11:33am UTC](https://discuss.elastic.co/t/not-able-to-create-kibana-alert-on-json-log-due-to-match-all-is-not-working-and-time-is-coming-as-string/300036 "2022-03-18T11:33:01Z")
Hi All , I am looking to create alert on Json log to match on any of the 3 job name with failed condition to check this condition every 70 min . the alert is not working because of 2 reason.Preformatted text 1)the s… --- ## [Beat(Nomad cluster\>Logstash\>Elasticsearch\>Graylog](https://discuss.elastic.co/t/beat-nomad-cluster-logstash-elasticsearch-graylog/300145)
**Author:** [@Uzmasaman\_Chanderki](https://discuss.elastic.co/u/Uzmasaman_Chanderki)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 11:18pm UTC](https://discuss.elastic.co/t/beat-nomad-cluster-logstash-elasticsearch-graylog/300145 "2022-03-20T23:18:31Z")
I am new to Elasticsearch. I have filebeat running on Nomad cluster as system job. I have to collect logs and ship it to a centralized server which has Logstash, Elasticsearch and graylog running on docker-compose. Some … --- ## [Resurrect Connection to dead ES Instance](https://discuss.elastic.co/t/resurrect-connection-to-dead-es-instance/300265)
**Author:** [@karewise\_tech](https://discuss.elastic.co/u/karewise_tech)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 5:08am UTC](https://discuss.elastic.co/t/resurrect-connection-to-dead-es-instance/300265 "2022-03-22T05:08:52Z")
\[logstash.outputs.Elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"http://elastic:xxxxxx@elasticsearch:9200/", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient:… --- ## [Monitoring ElasticSearch pipelines](https://discuss.elastic.co/t/monitoring-elasticsearch-pipelines/300270)
**Author:** [@florinsfetea](https://discuss.elastic.co/u/florinsfetea)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 6:37am UTC](https://discuss.elastic.co/t/monitoring-elasticsearch-pipelines/300270 "2022-04-04T06:37:10Z")
if you want the UI monitoring of pipelines included in Kibana please Upvote! --- ## [Filebeat logstash encoding problem](https://discuss.elastic.co/t/filebeat-logstash-encoding-problem/301454)
**Author:** [@joie](https://discuss.elastic.co/u/joie)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 6:33am UTC](https://discuss.elastic.co/t/filebeat-logstash-encoding-problem/301454 "2022-04-04T06:33:31Z")
Hi Thank you in advance. i am very stuggle to deal with this problem. push the oracle alert.log from the filebeat to logstash and see int ths slack message. my data source in alert log (Mon Apr 4 15:11:52 KST 2022 한글… --- ## [Remove "Recent Log Entries" section](https://discuss.elastic.co/t/remove-recent-log-entries-section/301339)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 6:32am UTC](https://discuss.elastic.co/t/remove-recent-log-entries-section/301339 "2022-04-04T06:32:01Z")
Kibana 7.17. I've just upgraded Kibana on a monitoring node from 6 to 7 and now in the Overview tab there's a section called Recent Log Entries, which wasn't there in 6. I'm not interested in this, it's taking up signif… --- ## [\]\[INFO \]\[o.e.x.s.a.AuthenAuthentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/info-o-e-x-s-a-authenauthentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/300860)
**Author:** [@aman.nagi2210](https://discuss.elastic.co/u/aman.nagi2210)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 2:52pm UTC](https://discuss.elastic.co/t/info-o-e-x-s-a-authenauthentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/300860 "2022-03-28T14:52:10Z")
History: Recently moved to SSL.(xpack enabled) Cluster infra: 3 master nodes, 8 data nodes M1,M2,M3 and D1,----- D8 In elastinsearch.yml discovery.zen.ping.unicast.hosts: \[M1,M2,M3,D1\] Issue: We have generated the e… --- ## [Docker Logstash Default(Bulit-in) plugins](https://discuss.elastic.co/t/docker-logstash-default-bulit-in-plugins/301451)
**Author:** [@leeseojune53](https://discuss.elastic.co/u/leeseojune53)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 6:07am UTC](https://discuss.elastic.co/t/docker-logstash-default-bulit-in-plugins/301451 "2022-04-04T06:07:38Z")
I want know Logstash's default plugins Below is the list of plugins for logstash. Do you have any instructions on the basic plug-in? logstash-codec-avro logstash-codec-cef logstash-codec-collectd logstash-codec-dots l… --- ## [Indexing a Circle (geoshape) Using NEST](https://discuss.elastic.co/t/indexing-a-circle-geoshape-using-nest/301421)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 10\ **Last updated:** [April 4, 2022, 5:33am UTC](https://discuss.elastic.co/t/indexing-a-circle-geoshape-using-nest/301421 "2022-04-04T05:33:02Z")
Is there anyway of Indexing a Circle i.e. just have the lat/lng and a radius without first having to create a geojson polygon that represents it. i.e. just using its center lat/lng and its radius. Thanks. [Previous page](https://discuss.elastic.co/latest.md?page=1186) [Next page](https://discuss.elastic.co/latest.md?page=1188)