# Latest **URL:** https://discuss.elastic.co/latest.md?page=1210 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1211 --- ## [Best practice for elastic server and elastic agent](https://discuss.elastic.co/t/best-practice-for-elastic-server-and-elastic-agent/300148)
**Author:** [@sevenout](https://discuss.elastic.co/u/sevenout)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 3:58am UTC](https://discuss.elastic.co/t/best-practice-for-elastic-server-and-elastic-agent/300148 "2022-03-21T03:58:24Z")
Hi guys, i just wanna ask about the best practice for elastic server and elastic agent. These are my conditions right now: I've installed Elasticsearch and kibana dashboard on a local server (only for Elasticsearch) I'… --- ## [How do I map fields with ECS if I am using my own grok filters](https://discuss.elastic.co/t/how-do-i-map-fields-with-ecs-if-i-am-using-my-own-grok-filters/300147)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 3:46am UTC](https://discuss.elastic.co/t/how-do-i-map-fields-with-ecs-if-i-am-using-my-own-grok-filters/300147 "2022-03-21T03:46:36Z")
Hi Team, Here is my grok parser match =\> { "message" =\> "(?\%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) rpz: info: client @%{WORD:data} %{IPV4:clientipaddr}#%{INT:sport} \\(%{NOTSPA CE:qdomain}\\): rpz QNAME Local-Da… --- ## [CIRCLE geo\_shape query not supported in ES 8.1](https://discuss.elastic.co/t/circle-geo-shape-query-not-supported-in-es-8-1/300024)
**Author:** [@Dat\_Le\_Tien](https://discuss.elastic.co/u/Dat_Le_Tien)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 3:04am UTC](https://discuss.elastic.co/t/circle-geo-shape-query-not-supported-in-es-8-1/300024 "2022-03-21T03:04:22Z")
we currently want to move from ES7.17 to 8.1. so far everything went fine but one application seeding the data on geolocations fails with an error currently on our test system unsupported\_operation\_exception: CIRCLE geo… --- ## [Can any one help me with this exception](https://discuss.elastic.co/t/can-any-one-help-me-with-this-exception/300101)
**Author:** [@Kandlavath\_Dasaradhi](https://discuss.elastic.co/u/Kandlavath_Dasaradhi)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 2:57am UTC](https://discuss.elastic.co/t/can-any-one-help-me-with-this-exception/300101 "2022-03-21T02:57:46Z")
C:\\Elasticsearch-7.3.2\\bin\>Elasticsearch Exception in thread "main" java.nio.file.NoSuchFileException: C:\\Elasticsearch-8.0.1\\config\\jvm.options at java.base/sun.nio.fs.WindowsException.translateToIOException(WindowsEx… --- ## [How to add metadata to an image such that it gets indexed by fscrawler?](https://discuss.elastic.co/t/how-to-add-metadata-to-an-image-such-that-it-gets-indexed-by-fscrawler/300141)
**Author:** [@thinking23487](https://discuss.elastic.co/u/thinking23487)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 2:46am UTC](https://discuss.elastic.co/t/how-to-add-metadata-to-an-image-such-that-it-gets-indexed-by-fscrawler/300141 "2022-03-21T02:46:33Z")
Hi all, using exiftool I add a custom xmp field to a jpg via exiftool -config exif.hash.conf -xmp-xmp:Test="T1" data/images/13-Moss-Mushrooms-1.jpg where exif.hash.conf contains %Image::ExifTool::UserDefined = ( … --- ## [Upgrade assistant in Kibana not showing "Start" button](https://discuss.elastic.co/t/upgrade-assistant-in-kibana-not-showing-start-button/300142)
**Author:** [@dlalex83](https://discuss.elastic.co/u/dlalex83)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 9:17pm UTC](https://discuss.elastic.co/t/upgrade-assistant-in-kibana-not-showing-start-button/300142 "2022-03-20T21:17:54Z")
Hi there, I'm on Elastic Stack 7.9.2 and when I navigate to the Upgrade Assistant page in Kibana I have no issues highlighted but no way to start the upgrade (see screenshot). Any ideas? Many thanks --- ## [How to implement language analyzers](https://discuss.elastic.co/t/how-to-implement-language-analyzers/299854)
**Author:** [@Meurling](https://discuss.elastic.co/u/Meurling)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 8:17pm UTC](https://discuss.elastic.co/t/how-to-implement-language-analyzers/299854 "2022-03-20T20:17:30Z")
Hello! I am quite lost in the documentation for how to implement a language analyzer for all documents in my app search engine. How can I do this? Best, Axel --- ## [Visibility of Data view in Space](https://discuss.elastic.co/t/visibility-of-data-view-in-space/300120)
**Author:** [@Petr\_Vancl\_Hochberge](https://discuss.elastic.co/u/Petr_Vancl_Hochberge)\ **Replies:** 2\ **Last updated:** [March 20, 2022, 3:08pm UTC](https://discuss.elastic.co/t/visibility-of-data-view-in-space/300120 "2022-03-20T15:08:01Z")
Hi. I am building “workflow” in Kibana for my users. I have around 50 spaces for each department of my organization. I have one Data view created which all should have access to, but I have no idea how to achieve it wit… --- ## [Mutate or grok product/price that keep changing everyday](https://discuss.elastic.co/t/mutate-or-grok-product-price-that-keep-changing-everyday/300134)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 3:02pm UTC](https://discuss.elastic.co/t/mutate-or-grok-product-price-that-keep-changing-everyday/300134 "2022-03-20T15:02:01Z")
Hi, I have a question about logstash for CSV. My situation is, I have multiple CSV files being uploaded into logstash. the log will continue to update for product or price but the domain will remain the same. my questio… --- ## [Remove \_value in watcher output from REST call](https://discuss.elastic.co/t/remove-value-in-watcher-output-from-rest-call/300119)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 2:13pm UTC](https://discuss.elastic.co/t/remove-value-in-watcher-output-from-rest-call/300119 "2022-03-20T14:13:32Z")
I my watcher I collect a record from the rest interface, retrieve a nice Json. But in the index part of the watcher it adds \_value to the index: This means all fields in the index get "\_value." before there name. D… --- ## [Cross-cluster search](https://discuss.elastic.co/t/cross-cluster-search/300132)
**Author:** [@ufuk\_varol](https://discuss.elastic.co/u/ufuk_varol)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 1:55pm UTC](https://discuss.elastic.co/t/cross-cluster-search/300132 "2022-03-20T13:55:06Z")
Does standard version of Elasticsearch support "cross-cluster search" feature explained below link detailly? --- ## [Split json fields of similar type in logstash](https://discuss.elastic.co/t/split-json-fields-of-similar-type-in-logstash/300133)
**Author:** [@zubair\_aftab](https://discuss.elastic.co/u/zubair_aftab)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 1:48pm UTC](https://discuss.elastic.co/t/split-json-fields-of-similar-type-in-logstash/300133 "2022-03-20T13:48:40Z")
I have a json file converted from pcap using tshark. There are different layers inside the json and each layer has different fields. Some fields are repeating inside the same message for example "bicc\_bicc\_cic" as shown … --- ## [Restoration of indices from aws](https://discuss.elastic.co/t/restoration-of-indices-from-aws/300129)
**Author:** [@Mahendra\_Choudhary](https://discuss.elastic.co/u/Mahendra_Choudhary)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 1:11pm UTC](https://discuss.elastic.co/t/restoration-of-indices-from-aws/300129 "2022-03-20T13:11:03Z")
Hello all, I am new in ELK stack. Often I need to restore indices from aws. But most of time it interrupt and fails, I need to start again from beginning. Also, restoration seems to be very slow. Is there any faster … --- ## [What is the meaning of query\_string with 1~ or ~AUTO?](https://discuss.elastic.co/t/what-is-the-meaning-of-query-string-with-1-or-auto/300128)
**Author:** [@asil](https://discuss.elastic.co/u/asil)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 12:58pm UTC](https://discuss.elastic.co/t/what-is-the-meaning-of-query-string-with-1-or-auto/300128 "2022-03-20T12:58:18Z")
I read the documentation of (Query string query | Elasticsearch Guide \[8.1\] | Elastic) and still don't understand the following example: GET /\_search { "query": { "bool": { "must": \[{ "… --- ## [Master\_not\_discovered\_exception](https://discuss.elastic.co/t/master-not-discovered-exception/300125)
**Author:** [@kzltp](https://discuss.elastic.co/u/kzltp)\ **Replies:** 2\ **Last updated:** [March 20, 2022, 12:25pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception/300125 "2022-03-20T12:25:24Z")
Hello Everyone; I created elastic environment with 4 nodes. 2 nodes set master role other 2 role set data node. When all node was starting everything is okey. but when any master node down, my cluster not working. Other… --- ## [ElasticSearch Linux startup failed. Procedure](https://discuss.elastic.co/t/elasticsearch-linux-startup-failed-procedure/298799)
**Author:** [@zx\_emo](https://discuss.elastic.co/u/zx_emo)\ **Replies:** 10\ **Last updated:** [March 20, 2022, 9:47am UTC](https://discuss.elastic.co/t/elasticsearch-linux-startup-failed-procedure/298799 "2022-03-20T09:47:30Z")
Elasticsearch has been deployed to Linux and I have encountered a problem with the certificate signing. After following the steps to resolve these problems, I get an exception when I start Elasticsearch. How do I resolve… --- ## [How can make sub aggregation code in elasticsearch-java:7.17.1](https://discuss.elastic.co/t/how-can-make-sub-aggregation-code-in-elasticsearch-java-7-17-1/300001)
**Author:** [@mzinboy](https://discuss.elastic.co/u/mzinboy)\ **Replies:** 2\ **Last updated:** [March 20, 2022, 8:57am UTC](https://discuss.elastic.co/t/how-can-make-sub-aggregation-code-in-elasticsearch-java-7-17-1/300001 "2022-03-20T08:57:54Z")
Hi, I can't make code to aggregation with sub aggregation using "Elasticsearch-java:7.17.1" Java library. There is no subAggregation method in TermsAggregation.Builder class. How to complete the code that has with su… --- ## [Elasticsear 8.X TLS question](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521)
**Author:** [@qq350162199](https://discuss.elastic.co/u/qq350162199)\ **Replies:** 8\ **Last updated:** [March 20, 2022, 12:51am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521 "2022-03-20T00:51:46Z")
I'm a beginner, and the latest release of elastic 8.x is a great product that automatically configures TLS security, solves previous complex deployments, and is perfect for a little white like me. But I'm also having pr… --- ## [Undocumented behaviour: Term query on date field becomes a range query](https://discuss.elastic.co/t/undocumented-behaviour-term-query-on-date-field-becomes-a-range-query/300113)
**Author:** [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\ **Replies:** 0\ **Last updated:** [March 19, 2022, 9:36pm UTC](https://discuss.elastic.co/t/undocumented-behaviour-term-query-on-date-field-becomes-a-range-query/300113 "2022-03-19T21:36:40Z")
I was speaking with a colleague recently and I mentioned I use a term query over a date field to find matches on a certain day, like this: { "query": { "term": { "@timestamp": { "value": "2021-10-08"… --- ## [7.16.2 - ILM - max primary shard size not working](https://discuss.elastic.co/t/7-16-2-ilm-max-primary-shard-size-not-working/299975)
**Author:** [@SteveParker](https://discuss.elastic.co/u/SteveParker)\ **Replies:** 2\ **Last updated:** [March 19, 2022, 5:14pm UTC](https://discuss.elastic.co/t/7-16-2-ilm-max-primary-shard-size-not-working/299975 "2022-03-19T17:14:04Z")
My ILM policy has a max shard size of 50gb but my indexes are growing to 100gb+, I must have missed something, help required please --- ## [ELK 8.1: loading std. dashboards failing w/error 403](https://discuss.elastic.co/t/elk-8-1-loading-std-dashboards-failing-w-error-403/300093)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [March 19, 2022, 2:00am UTC](https://discuss.elastic.co/t/elk-8-1-loading-std-dashboards-failing-w-error-403/300093 "2022-03-19T02:00:31Z")
On a PoC v.8.1 single elastic node + kibana + grafana, I'm trying to load std. metricbeat dashboards etc. into kibana like below only it returns an 403 error: $ metricbeat setup dashboards -c /etc/metricbeat/metricbeat.… --- ## [Elastic and Kibana 8.1.0 via Docker Compose](https://discuss.elastic.co/t/elastic-and-kibana-8-1-0-via-docker-compose/299907)
**Author:** [@st11x](https://discuss.elastic.co/u/st11x)\ **Replies:** 5\ **Last updated:** [March 19, 2022, 1:45am UTC](https://discuss.elastic.co/t/elastic-and-kibana-8-1-0-via-docker-compose/299907 "2022-03-19T01:45:05Z")
With 8.1.0, security is enabled by default and a SSL certificate is generated for localhost. I have this docker compose file. elastic: image: elasticsearch:8.1.0 ports: - 9200:9200 - 9300:9300 e… --- ## [The issue with Elasticsearch 6.8 & repository-s3](https://discuss.elastic.co/t/the-issue-with-elasticsearch-6-8-repository-s3/299984)
**Author:** [@jtsunne](https://discuss.elastic.co/u/jtsunne)\ **Replies:** 2\ **Last updated:** [March 18, 2022, 11:24pm UTC](https://discuss.elastic.co/t/the-issue-with-elasticsearch-6-8-repository-s3/299984 "2022-03-18T23:24:05Z")
I'm facing a strange issue. It was working 6 months ago. Elasticsearch version 6.8.12 was created based on the CentOS Linux release 7.9.2009 (Core) from RPM (we are using Puppet) { "name": "az-es68-master-1", "cluster… --- ## [Elastic PHP APM Agent does not report](https://discuss.elastic.co/t/elastic-php-apm-agent-does-not-report/300090)
**Author:** [@eddimull](https://discuss.elastic.co/u/eddimull)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 10:10pm UTC](https://discuss.elastic.co/t/elastic-php-apm-agent-does-not-report/300090 "2022-03-18T22:10:47Z")
Hello, I am trying out elastic APM for monitoring a php application. So apologies if I am asking a dumb question. The APM server is running on elastic cloud. So that's solved there, but the problem lies in the PHP Agen… --- ## [Is there a way to have visulisation's use the most recent event even if its outside of the specified time range?](https://discuss.elastic.co/t/is-there-a-way-to-have-visulisations-use-the-most-recent-event-even-if-its-outside-of-the-specified-time-range/300067)
**Author:** [@Tooty-Fruity](https://discuss.elastic.co/u/Tooty-Fruity)\ **Replies:** 1\ **Last updated:** [March 18, 2022, 8:30pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-have-visulisations-use-the-most-recent-event-even-if-its-outside-of-the-specified-time-range/300067 "2022-03-18T20:30:36Z")
Hi there, I have a Kibana dashboard where new events are continuously pushed into Elasticsearch. If I were to use the time range filter and set it to lets say 15 mins, my dashboard would only show me events that have ar… --- ## [Vector Tile API response id: (integer) Unique ID for the feature within the layer not found in hits or aggs layer](https://discuss.elastic.co/t/vector-tile-api-response-id-integer-unique-id-for-the-feature-within-the-layer-not-found-in-hits-or-aggs-layer/299952)
**Author:** [@Joseph\_Parish](https://discuss.elastic.co/u/Joseph_Parish)\ **Replies:** 6\ **Last updated:** [March 18, 2022, 8:26pm UTC](https://discuss.elastic.co/t/vector-tile-api-response-id-integer-unique-id-for-the-feature-within-the-layer-not-found-in-hits-or-aggs-layer/299952 "2022-03-18T20:26:32Z")
Hi I am testing the Vector Tile API using this repo which is an excellent tool. I would like to use the feature-id within the hits layer of a polygon, but get this: Error: The feature id parameter must be provided. I … --- ## [Pivot Transform Count of documents](https://discuss.elastic.co/t/pivot-transform-count-of-documents/300082)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 1\ **Last updated:** [March 18, 2022, 7:14pm UTC](https://discuss.elastic.co/t/pivot-transform-count-of-documents/300082 "2022-03-18T19:14:20Z")
This seems to work, is it the best way? In a pivot transform, I want a count of the documents included in the aggregation. I tried this and it seemed to work. However feeling uneasy without a vote of confidence from t… --- ## [How Do I Add A Location Header To My Kibana App?](https://discuss.elastic.co/t/how-do-i-add-a-location-header-to-my-kibana-app/300003)
**Author:** [@hyattc](https://discuss.elastic.co/u/hyattc)\ **Replies:** 2\ **Last updated:** [March 18, 2022, 5:34pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-location-header-to-my-kibana-app/300003 "2022-03-18T17:34:03Z")
I've created a custom app plugin for Kibana 7.16.3. I'd like to add a header similar to other apps in Kibana. For example... Dev Tools has a header that works like a link. I'd like to do something similar for my ap… --- ## [Logstash concatenate two field values from metricbeat](https://discuss.elastic.co/t/logstash-concatenate-two-field-values-from-metricbeat/300060)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 3\ **Last updated:** [March 18, 2022, 5:11pm UTC](https://discuss.elastic.co/t/logstash-concatenate-two-field-values-from-metricbeat/300060 "2022-03-18T17:11:10Z")
Hello All, Can someone help with this,I need to concatenate two fileds from metricbeat and create other filed with this concatenated value.Tried to use mutate filter didn't worked. filter{ mutate { add\_field =\> { "moun… --- ## [Cisco ASA Integration not working (Kibana version 8.1)](https://discuss.elastic.co/t/cisco-asa-integration-not-working-kibana-version-8-1/300066)
**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 4:17pm UTC](https://discuss.elastic.co/t/cisco-asa-integration-not-working-kibana-version-8-1/300066 "2022-03-18T16:17:42Z")
Hello, im quite new to Elasticsearch /ELK-Stack and ran into a problem with monitoring my logfiles from a Cisco ASA 5520. The problem seems to be the logfile format of my ASA and therefore they dont get parsed correctl… [Previous page](https://discuss.elastic.co/latest.md?page=1209) [Next page](https://discuss.elastic.co/latest.md?page=1211)