# Latest **URL:** https://discuss.elastic.co/latest.md?page=1213 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1214 --- ## [DSL Query with match phrase](https://discuss.elastic.co/t/dsl-query-with-match-phrase/299922)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 8:35am UTC](https://discuss.elastic.co/t/dsl-query-with-match-phrase/299922 "2022-03-17T08:35:49Z")
Hi, My Doc in Index. I want to query fields in the source. { "\_index" : "hi-2022.01.04", "\_type" : "\_doc", "\_id" : "-e2AIn4BnkeJqJCuSq9B", "\_version" : 16, "\_seq\_no" : 264786, "\_primary\_term" : 2, "found"… --- ## [Apm-agent-java TraceParent ratelimit?](https://discuss.elastic.co/t/apm-agent-java-traceparent-ratelimit/299381)
**Author:** [@marsblkm](https://discuss.elastic.co/u/marsblkm)\ **Replies:** 5\ **Last updated:** [March 17, 2022, 7:31am UTC](https://discuss.elastic.co/t/apm-agent-java-traceparent-ratelimit/299381 "2022-03-17T07:31:01Z")
We are working on our traceparent header to make sure the agent would not blindly trust the flags in traceparent header and we have noticed that there is an todo on TraceParent.java Just wondering/curious since this bit… --- ## [Elastic search with tokenizer](https://discuss.elastic.co/t/elastic-search-with-tokenizer/299562)
**Author:** [@fizhhh1997](https://discuss.elastic.co/u/fizhhh1997)\ **Replies:** 4\ **Last updated:** [March 17, 2022, 7:28am UTC](https://discuss.elastic.co/t/elastic-search-with-tokenizer/299562 "2022-03-17T07:28:20Z")
Hi, i am wonder about the important of tokenizer when searching with Elasticsearch ? how can i accurate search with setting tokenizer --- ## [Average for a string field in Kibana visualization](https://discuss.elastic.co/t/average-for-a-string-field-in-kibana-visualization/299819)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 6:37am UTC](https://discuss.elastic.co/t/average-for-a-string-field-in-kibana-visualization/299819 "2022-03-17T06:37:45Z")
Hi all, I'm trying to find average for a string field and I want to show in a bar chart in Kibana by date. In my dataset, Say I have hundreds of computers with a computer\_id ( string field). I have hundreds of Virus a… --- ## [Logstash mutate add\_field into all logs/data](https://discuss.elastic.co/t/logstash-mutate-add-field-into-all-logs-data/299918)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 0\ **Last updated:** [March 17, 2022, 6:28am UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-into-all-logs-data/299918 "2022-03-17T06:28:43Z")
Hi, I have a question regarding logstash.. Right now, I have a few different CSV files that are being shipped into logstash. The CSV file example is below. THE example File 1 url.com ,192.xxx.xxx.xxx,product-A urlA.c… --- ## [Question on APM architecture elk 8](https://discuss.elastic.co/t/question-on-apm-architecture-elk-8/299827)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 5\ **Last updated:** [March 17, 2022, 6:17am UTC](https://discuss.elastic.co/t/question-on-apm-architecture-elk-8/299827 "2022-03-17T06:17:02Z")
Hi, I was going through the elk 8 documentation and noticed that the previous APM server has been changed to legacy and from 8 onwards, we need to migrate it to Fleet APM integration I have few questions on the 8 model… --- ## [Is ILM (index lifecycle management) supported in Elassticsearch-OSS？](https://discuss.elastic.co/t/is-ilm-index-lifecycle-management-supported-in-elassticsearch-oss/299916)
**Author:** [@805728578](https://discuss.elastic.co/u/805728578)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 5:55am UTC](https://discuss.elastic.co/t/is-ilm-index-lifecycle-management-supported-in-elassticsearch-oss/299916 "2022-03-17T05:55:19Z")
version: 6.8.23 --- ## [Need to ship confluent cloud logs and metrics](https://discuss.elastic.co/t/need-to-ship-confluent-cloud-logs-and-metrics/297962)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 16\ **Last updated:** [March 17, 2022, 5:39am UTC](https://discuss.elastic.co/t/need-to-ship-confluent-cloud-logs-and-metrics/297962 "2022-03-17T05:39:08Z")
Hi team, Need to ship confluent cloud logs/metrics to beats that are installed on a Kubernetes cluster and eventually to Elasticsearch. Have read about Elasticsearch syn connector but can we first ship it to beats and … --- ## [How metricbeat to monitor Filebeat running in Daemonset on K8s](https://discuss.elastic.co/t/how-metricbeat-to-monitor-filebeat-running-in-daemonset-on-k8s/299397)
**Author:** [@cmy214](https://discuss.elastic.co/u/cmy214)\ **Replies:** 5\ **Last updated:** [March 17, 2022, 5:23am UTC](https://discuss.elastic.co/t/how-metricbeat-to-monitor-filebeat-running-in-daemonset-on-k8s/299397 "2022-03-17T05:23:42Z")
Hi all, My filebeat is in Daemonset on K8s cluster. In 7.17 internal monitoring of beats is removed and requires a separate metricbeat for achieving monitoring. So I'm setting up metricbeat as Daemonset to monitor my … --- ## [ERROR: Failed to determine the health of the cluster. Unexpected http status \[403\]](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-unexpected-http-status-403/299836)
**Author:** [@ArunKumarC](https://discuss.elastic.co/u/ArunKumarC)\ **Replies:** 3\ **Last updated:** [March 17, 2022, 5:14am UTC](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-unexpected-http-status-403/299836 "2022-03-17T05:14:10Z")
ERROR: Failed to determine the health of the cluster. Unexpected http status \[403\] not able to get the enrollment token getting above error. please help me on this issue --- ## [Does BULK API returns results before task is completed?](https://discuss.elastic.co/t/does-bulk-api-returns-results-before-task-is-completed/299911)
**Author:** [@lonewolf](https://discuss.elastic.co/u/lonewolf)\ **Replies:** 3\ **Last updated:** [March 17, 2022, 4:33am UTC](https://discuss.elastic.co/t/does-bulk-api-returns-results-before-task-is-completed/299911 "2022-03-17T04:33:07Z")
I am using Elasticsearch-python bulk helpers to update a index and run a search query with a script. The query executes successfully only if add some timeout (say 10s) between bulk update and script. Is this because bulk… --- ## [Elastic search Add additional condition if type is different](https://discuss.elastic.co/t/elastic-search-add-additional-condition-if-type-is-different/299706)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 3\ **Last updated:** [March 17, 2022, 2:32am UTC](https://discuss.elastic.co/t/elastic-search-add-additional-condition-if-type-is-different/299706 "2022-03-17T02:32:05Z")
I have 2 sets of documents, which are joined by fragmentId . I have written a query that pulls both documents, but I am thinking is there any other way to write it. Parent Document - There could be only 1 such document … --- ## [Limpeza de index](https://discuss.elastic.co/t/limpeza-de-index/270056)
**Author:** [@Fernando\_Oliveira](https://discuss.elastic.co/u/Fernando_Oliveira)\ **Replies:** 18\ **Last updated:** [March 17, 2022, 1:59am UTC](https://discuss.elastic.co/t/limpeza-de-index/270056 "2022-03-17T01:59:47Z")
Bom dia, sou novo no elastic e utilizo a versão instalada em um servidor linux, tenho a necessidade de liberar espaço em disco consumindo pelo elastic, os arquivos estão sendo gerados em /var/lib/elasticsearch/nodes/0/i… --- ## [What is the difference between force merge and freeze index on ILM actions?](https://discuss.elastic.co/t/what-is-the-difference-between-force-merge-and-freeze-index-on-ilm-actions/299811)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 1:28am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-force-merge-and-freeze-index-on-ilm-actions/299811 "2022-03-17T01:28:31Z")
Is there any difference between force merge and freeze index action in ILM? My entire ILM is under below. In warm phase, the index is merged to a single segment which makes the index read only. { "policy": { "ph… --- ## [\[metricbeat\]Error fetching data for metricset logstash.node: Could not find field 'id' in Logstash API response](https://discuss.elastic.co/t/metricbeat-error-fetching-data-for-metricset-logstash-node-could-not-find-field-id-in-logstash-api-response/299418)
**Author:** [@Yos](https://discuss.elastic.co/u/Yos)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 1:10am UTC](https://discuss.elastic.co/t/metricbeat-error-fetching-data-for-metricset-logstash-node-could-not-find-field-id-in-logstash-api-response/299418 "2022-03-17T01:10:33Z")
metricbeatでelastic stack監視をしようと logstash-xpackを有効化し、metricbeatを起動したところ、 以下のエラーが出力されます。 Kibana上ではLogstashのMonitoringはできているようですが、 /var/log/messagesにエラーが出続けます。 このエラーの原因で思い当たること等ございましたら、ご教授ください。 ■/etc/metricbeat/module… --- ## [How can I sign out of Kibana v7.7.0](https://discuss.elastic.co/t/how-can-i-sign-out-of-kibana-v7-7-0/299883)
**Author:** [@danny007](https://discuss.elastic.co/u/danny007)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 12:33am UTC](https://discuss.elastic.co/t/how-can-i-sign-out-of-kibana-v7-7-0/299883 "2022-03-17T00:33:38Z")
I'm new to Kibana, I logged into kibana v7.7.0 but cannot find the sign out button. Do I simply close my browser ? That's kind of a strange way to log out of an application, at least to me... Pls enlighten me guys. --- ## [Special character error in fallback of result setting function in App Search](https://discuss.elastic.co/t/special-character-error-in-fallback-of-result-setting-function-in-app-search/299511)
**Author:** [@Junyoung\_Kim2](https://discuss.elastic.co/u/Junyoung_Kim2)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 12:06am UTC](https://discuss.elastic.co/t/special-character-error-in-fallback-of-result-setting-function-in-app-search/299511 "2022-03-17T00:06:48Z")
In the fallback function in the result setting, if a special character is included, there is a problem that the special character is cut off in the result value (snippetset). What should I do to solve this? "title\_en": … --- ## [During a rolling restart sometimes all replicas of a single shard go into PRIMARY\_FAILED](https://discuss.elastic.co/t/during-a-rolling-restart-sometimes-all-replicas-of-a-single-shard-go-into-primary-failed/299269)
**Author:** [@rmb938](https://discuss.elastic.co/u/rmb938)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 11:43pm UTC](https://discuss.elastic.co/t/during-a-rolling-restart-sometimes-all-replicas-of-a-single-shard-go-into-primary-failed/299269 "2022-03-16T23:43:28Z")
I have an issue where sometimes during a rolling restart when it gets to a node that has a primary replica once the node is offline the replica shards go into a PRIMARY\_FAILED state. i.e my-index 11 p UNA… --- ## [The Network Adapter could not establish the connection](https://discuss.elastic.co/t/the-network-adapter-could-not-establish-the-connection/299885)
**Author:** [@felipeneto04](https://discuss.elastic.co/u/felipeneto04)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 10:58pm UTC](https://discuss.elastic.co/t/the-network-adapter-could-not-establish-the-connection/299885 "2022-03-16T22:58:36Z")
I'm new here and also to logstash. I'm having trouble trying to connect. I have several branches spread across Brazil, I get data from each one through a VPN connection, and I use a .sh scheduled in CRON to call the sc… --- ## [Kibana stack monitoring dashboard not showing data](https://discuss.elastic.co/t/kibana-stack-monitoring-dashboard-not-showing-data/299902)
**Author:** [@Satya\_Graha](https://discuss.elastic.co/u/Satya_Graha)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 9:24pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-dashboard-not-showing-data/299902 "2022-03-16T21:24:42Z")
We are using Elasticsearch 7.9.3 and have enabled monitoring data collection locally. This is our cluster's setting "xpack" : { "monitoring" : { "elasticsearch" : { "collection" : { … --- ## [Fleet agent](https://discuss.elastic.co/t/fleet-agent/296349)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 6\ **Last updated:** [March 16, 2022, 8:36pm UTC](https://discuss.elastic.co/t/fleet-agent/296349 "2022-03-16T20:36:36Z")
Hello, I have a question about the fleet agent once it is deployed to a device. I have a self signed cert so I use this command to enroll .\\elastic-agent.exe install --url=https://192.168.131.155:8220 --enrollment-tok… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/299872)
**Author:** [@juliano.maciel](https://discuss.elastic.co/u/juliano.maciel)\ **Replies:** 6\ **Last updated:** [March 16, 2022, 8:10pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/299872 "2022-03-16T20:10:15Z")
Hi, i'am tring to conifg Elastic Stack 7.16.2 with a windows server. My configs: Elasticsearch APM-server Kibana When i try to acess Kibana, is show the message at the browser --- ## [Vega select box aggregations](https://discuss.elastic.co/t/vega-select-box-aggregations/299028)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 5\ **Last updated:** [March 16, 2022, 8:06pm UTC](https://discuss.elastic.co/t/vega-select-box-aggregations/299028 "2022-03-16T20:06:56Z")
Hello, I need to create a chart where Y axis can be changed based on a select box. I saw this example in Vega, but not sure how to replicate in Elasticsearch. Link to visualization: Vega Editor thanks --- ## [Pattern not defined](https://discuss.elastic.co/t/pattern-not-defined/299893)
**Author:** [@Guif](https://discuss.elastic.co/u/Guif)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 7:48pm UTC](https://discuss.elastic.co/t/pattern-not-defined/299893 "2022-03-16T19:48:30Z")
Hi, I try to ingest the logs /var/log/maillog with the following pattern via logstash: POSTFIX\_QUEUEID (\[0-9A-F\]{6,}|\[0-9a-zA-Z\]{15,}) POSTFIX\_STATUS (?\<=status=)(.\*)(?= \\() POSTFIX\_PROCESS (?=postfix\\/)(.\*?\\\[)(.\*?)(?=… --- ## [Sum of values from Nested field as per the Global filter for Currency unit in Bar chart](https://discuss.elastic.co/t/sum-of-values-from-nested-field-as-per-the-global-filter-for-currency-unit-in-bar-chart/299892)
**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 6:39pm UTC](https://discuss.elastic.co/t/sum-of-values-from-nested-field-as-per-the-global-filter-for-currency-unit-in-bar-chart/299892 "2022-03-16T18:39:35Z")
I have different types of currency values in each record as per user selects the Currency\_unit, Bar chart should make sum of Currency\_value. How to acheive this. PFB for the result. If the index data type needs to me mod… --- ## [Upgrading 6.2.4 to 8.1](https://discuss.elastic.co/t/upgrading-6-2-4-to-8-1/299887)
**Author:** [@Foggie](https://discuss.elastic.co/u/Foggie)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 6:26pm UTC](https://discuss.elastic.co/t/upgrading-6-2-4-to-8-1/299887 "2022-03-16T18:26:31Z")
We have developed an application based on Elasticsearch. The data held is currently relatively small and the user interaction is very low. The application was first developed a few years ago based on Elasticsearch 6.2.4.… --- ## [Azure Filebeats Module](https://discuss.elastic.co/t/azure-filebeats-module/299878)
**Author:** [@tman5](https://discuss.elastic.co/u/tman5)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 6:06pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878 "2022-03-16T18:06:44Z")
We're looking to configure Azure module | Filebeat Reference \[7.17\] | Elastic and I had a question. Our filebeats is outputing to logstash which then in turn writes out to Graylog. I have filebeat setup to gather logs f… --- ## [Help with Fleet setup](https://discuss.elastic.co/t/help-with-fleet-setup/299759)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 4:55pm UTC](https://discuss.elastic.co/t/help-with-fleet-setup/299759 "2022-03-16T16:55:22Z")
I got a fleet server to connect to my sandbox cluster to test and setup this framework. I am trying to get an agent to connect with my fleet server. I am trying to just get the quickstart going so useing the --insecur… --- ## [I want synthetic Monitoring for my webapp which is login based url](https://discuss.elastic.co/t/i-want-synthetic-monitoring-for-my-webapp-which-is-login-based-url/299871)
**Author:** [@loka89](https://discuss.elastic.co/u/loka89)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 4:54pm UTC](https://discuss.elastic.co/t/i-want-synthetic-monitoring-for-my-webapp-which-is-login-based-url/299871 "2022-03-16T16:54:49Z")
How can I do that because I setup the agent in my host machine which is linux based --- ## [How to Configure FileBeat to be used with an Existing Index while deploying in Kubernetes as DaemonSet](https://discuss.elastic.co/t/how-to-configure-filebeat-to-be-used-with-an-existing-index-while-deploying-in-kubernetes-as-daemonset/299601)
**Author:** [@roy3861](https://discuss.elastic.co/u/roy3861)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 4:20pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-to-be-used-with-an-existing-index-while-deploying-in-kubernetes-as-daemonset/299601 "2022-03-16T16:20:24Z")
Hi, We are trying to deploy filebeat in our Kuberenets cluster following: Running Filebeat on Kubernetes | Filebeat Reference \[6.8\] | Elastic However we want the Pod logs to go to a pre defined Index in Elastic. How to… [Previous page](https://discuss.elastic.co/latest.md?page=1212) [Next page](https://discuss.elastic.co/latest.md?page=1214)