# Latest **URL:** https://discuss.elastic.co/latest.md?page=1206 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1207 --- ## [Filtering collection in aggregation based on document property value](https://discuss.elastic.co/t/filtering-collection-in-aggregation-based-on-document-property-value/299592)
**Author:** [@Mahendra\_Choudhary](https://discuss.elastic.co/u/Mahendra_Choudhary)\ **Replies:** 3\ **Last updated:** [March 22, 2022, 9:32pm UTC](https://discuss.elastic.co/t/filtering-collection-in-aggregation-based-on-document-property-value/299592 "2022-03-22T21:32:14Z")
Hello all, I am kind of stuck in a special case. My document looks like below. { "\_source" : { "name" : "SPIM", "spDetails" : { "isActive" : true }, "id" : "251561", "categories" : \[ "FM", "SP" \] } }, { … --- ## [Can the field type (e.g. "flattened") be specified at time of indexing?](https://discuss.elastic.co/t/can-the-field-type-e-g-flattened-be-specified-at-time-of-indexing/298671)
**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 9:24pm UTC](https://discuss.elastic.co/t/can-the-field-type-e-g-flattened-be-specified-at-time-of-indexing/298671 "2022-03-22T21:24:50Z")
I know I can specify that a specific field has the type "flattened" (Flattened field type | Elasticsearch Guide \[8.0\] | Elastic) by specifying that in the index \_mapping but is there a way to do that when indexing? I wa… --- ## [Role 'reporting\_user' is deprecated. Please use Kibana feature privileges instead](https://discuss.elastic.co/t/role-reporting-user-is-deprecated-please-use-kibana-feature-privileges-instead/294593)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 8\ **Last updated:** [March 22, 2022, 8:38pm UTC](https://discuss.elastic.co/t/role-reporting-user-is-deprecated-please-use-kibana-feature-privileges-instead/294593 "2022-03-22T20:38:19Z")
latest version 7.16.3 (forever free edition) management \> users How do I grant users reporting permissions without using the deprecated reporting\_user in the forever free edition that does not support sub-featu… --- ## [Migrating 1000's of fields from SOLR to elastic](https://discuss.elastic.co/t/migrating-1000s-of-fields-from-solr-to-elastic/300379)
**Author:** [@Jon\_Vivers](https://discuss.elastic.co/u/Jon_Vivers)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 7:34pm UTC](https://discuss.elastic.co/t/migrating-1000s-of-fields-from-solr-to-elastic/300379 "2022-03-22T19:34:44Z")
I am investigating migrating my search solution from SOLR to elastic. However the current SOLR implementation has several thousand fields which are used for aggregations. For example there could be a field 'color\_hist' w… --- ## [Ingest postfix (mail) logs to ELK](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663)
**Author:** [@Guif](https://discuss.elastic.co/u/Guif)\ **Replies:** 6\ **Last updated:** [March 22, 2022, 6:57pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663 "2022-03-22T18:57:10Z")
Hi! I would like to ingest sendmail logs (/var/log/maillog) from different servers (about 5) into Elasticsearch at the same time. I did Google search and found different and confused tutorials about this. Anybody can … --- ## [Java Client API migration: FieldValue does not accept an Object value](https://discuss.elastic.co/t/java-client-api-migration-fieldvalue-does-not-accept-an-object-value/300069)
**Author:** [@sbrunot](https://discuss.elastic.co/u/sbrunot)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 4:30pm UTC](https://discuss.elastic.co/t/java-client-api-migration-fieldvalue-does-not-accept-an-object-value/300069 "2022-03-22T16:30:43Z")
Hi, the deprecated Java High Level REST Client API allowed to specify a Term query by providing the value as an Object (see QueryBuilders (server 7.8.1 API) With the new Java Client API, it doesn't seem to be possible … --- ## [Error while creating Elasticsearch API Client(8.0.1) object using Spring Boot](https://discuss.elastic.co/t/error-while-creating-elasticsearch-api-client-8-0-1-object-using-spring-boot/300263)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 3\ **Last updated:** [March 22, 2022, 4:29pm UTC](https://discuss.elastic.co/t/error-while-creating-elasticsearch-api-client-8-0-1-object-using-spring-boot/300263 "2022-03-22T16:29:29Z")
I am implementing Elasticsearch 8.0.1 version using Spring Boot. As mentioned in the documentation, this is the pom.xml of my project \ \ \ \co.elastic.clients\ **Author:** [@Nikhitha](https://discuss.elastic.co/u/Nikhitha)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 4:22pm UTC](https://discuss.elastic.co/t/filebeat-to-support-tls1-3/299045 "2022-03-22T16:22:19Z") Does filebeat 7.16.0 suport TLS 1.3? --- ## [Index size with elasticseach 8 increasing?](https://discuss.elastic.co/t/index-size-with-elasticseach-8-increasing/300351)
**Author:** [@rsommer](https://discuss.elastic.co/u/rsommer)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 4:19pm UTC](https://discuss.elastic.co/t/index-size-with-elasticseach-8-increasing/300351 "2022-03-22T16:19:38Z")
Hi, before filing a bug report I would like to ask if someone else is encountering increase in index sizes after the update to Elasticsearch 8? I posted the sizes of our logstash daily indices from one cluster. Size and… --- ## [Filter with more than one possible match?](https://discuss.elastic.co/t/filter-with-more-than-one-possible-match/300292)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 3:21pm UTC](https://discuss.elastic.co/t/filter-with-more-than-one-possible-match/300292 "2022-03-22T15:21:57Z")
Hi, I'm running the Elastic stack 8.1 I want to create a filter that has more than one condition and therefore avoid creating the same filter for all possibilities again and again. An example: I want the IF condition t… --- ## [APM-Server 8.1 via Elastic-Agent 8.1 unable to connect to ElasticSearch 8.1](https://discuss.elastic.co/t/apm-server-8-1-via-elastic-agent-8-1-unable-to-connect-to-elasticsearch-8-1/300362)
**Author:** [@gperdacher](https://discuss.elastic.co/u/gperdacher)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 3:15pm UTC](https://discuss.elastic.co/t/apm-server-8-1-via-elastic-agent-8-1-unable-to-connect-to-elasticsearch-8-1/300362 "2022-03-22T15:15:22Z")
Hello, I installed Elasticsearch 8.1 Kibana 8.1 Fleet-Server 8.1 on a debian 11 system with default settings. Via Fleet-Server i installed/enrolled an elastic-agent with a policy and Elastic APM Integration 8.1. Af… --- ## [Templates w/ new java-client](https://discuss.elastic.co/t/templates-w-new-java-client/300218)
**Author:** [@divadpoc](https://discuss.elastic.co/u/divadpoc)\ **Replies:** 3\ **Last updated:** [March 22, 2022, 3:05pm UTC](https://discuss.elastic.co/t/templates-w-new-java-client/300218 "2022-03-22T15:05:04Z")
Initially I was looking for a way to add component and index templates via the new java-client. Then I stumbled upon the following two methods: ElasticsearchIndicesClient.getTemplate ElasticsearchIndicesClient.getIndex… --- ## [Configure Let's Encrypt with Nginx to act as Reverse Proxy for Logstash](https://discuss.elastic.co/t/configure-lets-encrypt-with-nginx-to-act-as-reverse-proxy-for-logstash/300277)
**Author:** [@scottfred](https://discuss.elastic.co/u/scottfred)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 6:51am UTC](https://discuss.elastic.co/t/configure-lets-encrypt-with-nginx-to-act-as-reverse-proxy-for-logstash/300277 "2022-03-22T06:51:55Z")
I have Logstash running in a Docker container in a private subnet on AWS. We are able to use Logstash's HTTP Plugin to read and process Multi-line ASCII data before sending it on to Elasticsearch for storage. All of th… --- ## [Partial field value matching post Winlogbeat upgrade to 8.1](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222)
**Author:** [@Psyhil](https://discuss.elastic.co/u/Psyhil)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 1:24pm UTC](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222 "2022-03-22T13:24:07Z")
Hi All, We are using elk 7.17.1 with winlogbeat version 7.8 version with ECS version 1.5. While testing out winlogbeat 8.1.0 with ECS version 8.0.0, now my lucene queries are now doing partial matches. A simple exampl… --- ## [Index filled EC2 completely, manually deleted nodes, no longer able to start Elasticsearch](https://discuss.elastic.co/t/index-filled-ec2-completely-manually-deleted-nodes-no-longer-able-to-start-elasticsearch/300221)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 7\ **Last updated:** [March 22, 2022, 2:18pm UTC](https://discuss.elastic.co/t/index-filled-ec2-completely-manually-deleted-nodes-no-longer-able-to-start-elasticsearch/300221 "2022-03-22T14:18:02Z")
I recently had an issue where I was ingesting data from S3 via Logstash and the S3 Input Plugin (aka the pipeline feature) into my AWS EC2 instance running ELK 7.5.2. Overnight, the index filled up my entire EC2 storage… --- ## [検索結果のvisualize表示について](https://discuss.elastic.co/t/visualize/300279)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 2:11pm UTC](https://discuss.elastic.co/t/visualize/300279 "2022-03-22T14:11:52Z")
下記URLを参照し、Discoverの結果のとあるフィールドの集約結果をvisualizeにて表示しようとしております。 型がip型や数値型のフィールドについてはviualize表示できたのですが、テキスト型のフィールドについて、Available fieldsのフィールド名をクリックしても「visualize」ボタンが表示されず、visualize表示できません。原因及び対処法をご教示頂けないでしょうか。 --- ## [Model used in anomaly detection](https://discuss.elastic.co/t/model-used-in-anomaly-detection/300264)
**Author:** [@zanattabruno](https://discuss.elastic.co/u/zanattabruno)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 2:00pm UTC](https://discuss.elastic.co/t/model-used-in-anomaly-detection/300264 "2022-03-22T14:00:46Z")
Guys, can you let me know when I use the following options to enable anomaly detection in Elasticsearch. Analytics\>Machine Learning\>Anomaly Detection\>Create job\> Categorization Which algorithm/model would the implement… --- ## [Cummulative date sum in Kibana Console](https://discuss.elastic.co/t/cummulative-date-sum-in-kibana-console/300315)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 2:04pm UTC](https://discuss.elastic.co/t/cummulative-date-sum-in-kibana-console/300315 "2022-03-22T14:04:49Z")
I'm working with a log file,I have a field for timestamp ==\> "timestamp":"2021-12-15T16:06:27.269303Z". I want to perform a cummulative sum on this field in all the document. I have done this aggregation, but the resul… --- ## [Plugin unable to find classes in ES 7.12 and newer](https://discuss.elastic.co/t/plugin-unable-to-find-classes-in-es-7-12-and-newer/299890)
**Author:** [@brian8371](https://discuss.elastic.co/u/brian8371)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 1:41pm UTC](https://discuss.elastic.co/t/plugin-unable-to-find-classes-in-es-7-12-and-newer/299890 "2022-03-22T13:41:31Z")
I'm new to ES plugin development and I'm trying to change an ES plugin that worked with ES v7.3.0 to work with ES v7.13.4 or newer, but it seems like both index.query.QueryShardContext and index.search.MatchQuery were re… --- ## [Send GeoPoint data to elastic Search using client.index method](https://discuss.elastic.co/t/send-geopoint-data-to-elastic-search-using-client-index-method/300345)
**Author:** [@Vishnu\_Agarwal](https://discuss.elastic.co/u/Vishnu_Agarwal)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 1:25pm UTC](https://discuss.elastic.co/t/send-geopoint-data-to-elastic-search-using-client-index-method/300345 "2022-03-22T13:25:56Z")
I am trying to send geolocation as location:{"lat": 19.07, "lon": 72.87} , and i have mapped location as geo\_point in index. I am getting following error. reason: "can't merge a non object mapping \[myloc\] with an objec… --- ## [Logstatsh Conditional Filter is not working](https://discuss.elastic.co/t/logstatsh-conditional-filter-is-not-working/300248)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 1:23pm UTC](https://discuss.elastic.co/t/logstatsh-conditional-filter-is-not-working/300248 "2022-03-22T13:23:47Z")
I'm trying to apply condional filtering in logstash but it is not working. My log looks like "record": { "field1": "abc", "field2": "/value" } Filter Condition if \[re… --- ## [【Vega-lite】タイムスケール内のデータがグラフに表示されない](https://discuss.elastic.co/t/vega-lite/300342)
**Author:** [@qoopen0815](https://discuss.elastic.co/u/qoopen0815)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 1:20pm UTC](https://discuss.elastic.co/t/vega-lite/300342 "2022-03-22T13:20:42Z")
Gantt Chart (Ranged Bar Marks) | Vega-Liteを参考にしながらグラフを作成しています。 50個以上の適当なデータを投入して、下記のようなグラフを作成することはできましたが、投入したデータの個数と、グラフに表示されているデータの個数が一致しません。 開発者ツールでVEGA\_DEBUG.view.data('hoge')を使い、読み込んだデータを調べると、10個のデータしか取得できてないことが… --- ## [LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=\>"Got response code '401'](https://discuss.elastic.co/t/logstash-badresponsecodeerror-message-got-response-code-401/299780)
**Author:** [@Diego\_T](https://discuss.elastic.co/u/Diego_T)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 1:20pm UTC](https://discuss.elastic.co/t/logstash-badresponsecodeerror-message-got-response-code-401/299780 "2022-03-22T13:20:15Z")
when I run logstash on my local windows pointing to my remote elastic account I get the following error Using LS\_JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-17.0.2 WARNING: Using LS\_JAVA\_HOME while Logstash distri… --- ## [Config pipeline logstash with module cisco](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044)
**Author:** [@jojodd](https://discuss.elastic.co/u/jojodd)\ **Replies:** 6\ **Last updated:** [March 22, 2022, 1:08pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044 "2022-03-22T13:08:53Z")
Hello, I would like to know if it is possible to use at the same time cisco-asa and cisco-ios in a single pipeline? Is there a method to create several indexes with one for cisco-ios and the other for cisco-asa? --- ## [Environment variable from secrets empty in pipeline](https://discuss.elastic.co/t/environment-variable-from-secrets-empty-in-pipeline/300340)
**Author:** [@pfennema](https://discuss.elastic.co/u/pfennema)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 1:07pm UTC](https://discuss.elastic.co/t/environment-variable-from-secrets-empty-in-pipeline/300340 "2022-03-22T13:07:05Z")
Hi All, I'm trying to use an environment variable in one of my pipeline configs which is defined in a secrets file in kubernetes. When I login into the container and do an 'env' commend, the environment variable is def… --- ## [Unable to see ESquery while creating Rules and Connectors](https://discuss.elastic.co/t/unable-to-see-esquery-while-creating-rules-and-connectors/300195)
**Author:** [@Ankur\_Jain1](https://discuss.elastic.co/u/Ankur_Jain1)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:54pm UTC](https://discuss.elastic.co/t/unable-to-see-esquery-while-creating-rules-and-connectors/300195 "2022-03-22T12:54:30Z")
Hello, I have created a user in Kibana with some limited permissions. When I am trying to create Rules using that user I cannot see ESquery option. This option is available for superuser account. The user role have fol… --- ## [Query a specific IP address in Elastic](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318)
**Author:** [@ianrobo](https://discuss.elastic.co/u/ianrobo)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 12:34pm UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318 "2022-03-22T12:34:26Z")
Hi there, I am relatively new to elastic and expanding our ES daily. We are ingesting logs from various network devices but come across a problem in Cisco. They do not send the hostname in their syslog and therefore al… --- ## [Elasticsearch 7.16 installing error](https://discuss.elastic.co/t/elasticsearch-7-16-installing-error/300209)
**Author:** [@Kailas](https://discuss.elastic.co/u/Kailas)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:26pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-installing-error/300209 "2022-03-22T12:26:31Z")
Hi, I am trying to install Elasticsarch 7.16.1 on 3 nodes by following Install Elasticsearch from archive on Linux or MacOS | Elasticsearch Guide \[7.16\] | Elastic . The ES installation needs to be done on Linux. Howeve… --- ## [Elastic Security Rule exception](https://discuss.elastic.co/t/elastic-security-rule-exception/300273)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:20pm UTC](https://discuss.elastic.co/t/elastic-security-rule-exception/300273 "2022-03-22T12:20:25Z")
Hi, I have been using elastic security as a SIEM for my organization for some time. Due to insufficient space, I had deleted one index. Thereafter I saw failures of the detection rules which was not the case before. Be… --- ## [Rename fields names with logstash](https://discuss.elastic.co/t/rename-fields-names-with-logstash/300321)
**Author:** [@Paf](https://discuss.elastic.co/u/Paf)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 11:53am UTC](https://discuss.elastic.co/t/rename-fields-names-with-logstash/300321 "2022-03-22T11:53:54Z")
Hello, I want to rename the field name "identity.claims.http://schemas.microsoft.com/claims/authnclassreference" to "identity\_claims\_authnclassreference". For this, i use mutate filter with rename as follwing: filter… [Previous page](https://discuss.elastic.co/latest.md?page=1205) [Next page](https://discuss.elastic.co/latest.md?page=1207)