# Latest **URL:** https://discuss.elastic.co/latest.md?page=1237 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1238 --- ## [Elasticsearch enrichment, join best practice](https://discuss.elastic.co/t/elasticsearch-enrichment-join-best-practice/298535)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 3:57pm UTC](https://discuss.elastic.co/t/elasticsearch-enrichment-join-best-practice/298535 "2022-03-01T15:57:10Z")
Hi, how would you handle the situation I have a large data source of 1000tis events/sec, which I need to enrich with data so that I can do analytics on it. The data source has a small amount of data (i.e. 100bytes) bu… --- ## [Correct usage of write indices for rolling over](https://discuss.elastic.co/t/correct-usage-of-write-indices-for-rolling-over/298050)
**Author:** [@whisperingstone](https://discuss.elastic.co/u/whisperingstone)\ **Replies:** 8\ **Last updated:** [March 1, 2022, 3:28pm UTC](https://discuss.elastic.co/t/correct-usage-of-write-indices-for-rolling-over/298050 "2022-03-01T15:28:56Z")
Hello. I collect logs from 10 components on dev, stage & prod envs. I don't write to the same index, the indexes are created every day for every component and environment, like this: componentname\_envYY.MM.DD or backen… --- ## [How to deploy and setup a Fleet cluster?](https://discuss.elastic.co/t/how-to-deploy-and-setup-a-fleet-cluster/298285)
**Author:** [@Danny\_Dumenigo](https://discuss.elastic.co/u/Danny_Dumenigo)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 3:07pm UTC](https://discuss.elastic.co/t/how-to-deploy-and-setup-a-fleet-cluster/298285 "2022-03-01T15:07:07Z")
Hello community! I have two environments of ELK v7.17 deployed on-prem (test and prod), so I decided to try Fleet. Im still testing things, so, In my test env I was able to setup a Fleet server (with certificates genera… --- ## [Fleet managed Elastic Agent - Wrong ES output configuration for Filebeat/Metricbeat](https://discuss.elastic.co/t/fleet-managed-elastic-agent-wrong-es-output-configuration-for-filebeat-metricbeat/297925)
**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 3:03pm UTC](https://discuss.elastic.co/t/fleet-managed-elastic-agent-wrong-es-output-configuration-for-filebeat-metricbeat/297925 "2022-03-01T15:03:33Z")
Hi! I successfully set up a fleet server and 2 more elastic agents on different hosts. They all show up as "healthy" and seem fine in Kibana. I recognized after trying a few integrations, that only the Fleet server i… --- ## [Kibana 7.1x always resets colors when editing visualization](https://discuss.elastic.co/t/kibana-7-1x-always-resets-colors-when-editing-visualization/297599)
**Author:** [@xchess64](https://discuss.elastic.co/u/xchess64)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 3:01pm UTC](https://discuss.elastic.co/t/kibana-7-1x-always-resets-colors-when-editing-visualization/297599 "2022-03-01T15:01:04Z")
Hi all, When I edit a vertical bar vizualisation in kibana, the histogram colors reset to the default value each time I edit the visualization. Before I click on the edit button (from the dashboard view) After the … --- ## [Username in auditbeat file\_integrity module](https://discuss.elastic.co/t/username-in-auditbeat-file-integrity-module/298530)
**Author:** [@sadux](https://discuss.elastic.co/u/sadux)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 2:56pm UTC](https://discuss.elastic.co/t/username-in-auditbeat-file-integrity-module/298530 "2022-03-01T14:56:32Z")
Hello! We track file creation/deletion/change in Kibana with auditbeat file\_integrity module. Is there a way to see information about user, who create/change/delete file? --- ## [Metricbeat docker compose environment variables](https://discuss.elastic.co/t/metricbeat-docker-compose-environment-variables/298009)
**Author:** [@TobiasSackmann](https://discuss.elastic.co/u/TobiasSackmann)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 2:52pm UTC](https://discuss.elastic.co/t/metricbeat-docker-compose-environment-variables/298009 "2022-03-01T14:52:52Z")
Hi all, I am trying to set up stack monitoring using docker via docker compose. Here is a sample I found on the Internet that uses the ELASTICSEARCH\_HOSTS variable. I'd like to define more in this section like the modu… --- ## [Can we update to 8.0 without enabling securitys](https://discuss.elastic.co/t/can-we-update-to-8-0-without-enabling-securitys/298275)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 1\ **Last updated:** [February 25, 2022, 12:09pm UTC](https://discuss.elastic.co/t/can-we-update-to-8-0-without-enabling-securitys/298275 "2022-02-25T12:09:23Z")
We have our filebeat-logstash-Elasticsearch-kibana ecosystem on a private subnet within our organization network. Due to the placement of all components on a fenced subnet, we don't need any security features such as rol… --- ## [Lock date range in dashboards](https://discuss.elastic.co/t/lock-date-range-in-dashboards/298504)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 2:10pm UTC](https://discuss.elastic.co/t/lock-date-range-in-dashboards/298504 "2022-03-01T14:10:03Z")
Hi i have multiple dashboards i want to lock the date range in one of them so it can't be change when i change the other dashboards for example dashboard 1 date range last 1 min dashboard 2,3 it's ok to be anything --- ## [Iterat list on watcher elasticsearch](https://discuss.elastic.co/t/iterat-list-on-watcher-elasticsearch/298100)
**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 2:07pm UTC](https://discuss.elastic.co/t/iterat-list-on-watcher-elasticsearch/298100 "2022-03-01T14:07:43Z")
hi guys i want to iterat list of indices to add them to e-mail alert and to send for every index one -e-mail alert. action : "send\_email": { "foreach" : "ctx.payload.list", "email": { "profile": "standard", "prior… --- ## [Elastic 8.0.0 - Stack Monitoring - All nodes are listed as Master Nodes](https://discuss.elastic.co/t/elastic-8-0-0-stack-monitoring-all-nodes-are-listed-as-master-nodes/298260)
**Author:** [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\ **Replies:** 6\ **Last updated:** [March 1, 2022, 1:52pm UTC](https://discuss.elastic.co/t/elastic-8-0-0-stack-monitoring-all-nodes-are-listed-as-master-nodes/298260 "2022-03-01T13:52:26Z")
I just set Stack Monitoring with Metricbeat for an Elasticsearch 8.0 cluster and I noticed a weird thing: all nodes are reported as Master Nodes (see the star icon in the screenshot below). Any idea what I did wrong? --- ## [2nd Level Nested aggregation incorrect doc\_count](https://discuss.elastic.co/t/2nd-level-nested-aggregation-incorrect-doc-count/298515)
**Author:** [@Adam\_Whittaker](https://discuss.elastic.co/u/Adam_Whittaker)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:38pm UTC](https://discuss.elastic.co/t/2nd-level-nested-aggregation-incorrect-doc-count/298515 "2022-03-01T13:38:16Z")
Hello, Can anyone point me to why the doc\_count on my 2nd nested aggregation is not correct? The count on the first aggregation is accurate but the 2nd isnt. { "size": 0, "\_source": false, "query": { "match\_… --- ## [What is the best way to manage an index for exact search and normal search](https://discuss.elastic.co/t/what-is-the-best-way-to-manage-an-index-for-exact-search-and-normal-search/298513)
**Author:** [@Leo\_Baby\_Jacob](https://discuss.elastic.co/u/Leo_Baby_Jacob)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:28pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-manage-an-index-for-exact-search-and-normal-search/298513 "2022-03-01T13:28:36Z")
I have a use case where I need normal match\_all search i.e it shows me related documents with fuzzy results also, however I need a specific search which needs to do a term query. My mappings are mostly text type: "proj… --- ## [Using top\_hits in sql](https://discuss.elastic.co/t/using-top-hits-in-sql/298517)
**Author:** [@Nirf8](https://discuss.elastic.co/u/Nirf8)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:42pm UTC](https://discuss.elastic.co/t/using-top-hits-in-sql/298517 "2022-03-01T13:42:54Z")
Hello, im using Elasticsearch sql to run aggregations on my data. What im trying to do is devide my data into buckets of time (using histogram) and then get the top docs of each bucket (using somthing similar to top\_hi… --- ## [Unable to install Fleet Server](https://discuss.elastic.co/t/unable-to-install-fleet-server/298516)
**Author:** [@Adrian\_Palka](https://discuss.elastic.co/u/Adrian_Palka)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:39pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-server/298516 "2022-03-01T13:39:15Z")
Hi, I've got a problem with installing fleet server. Fleet server enrolls with no errors, but kibana it's stuck in "updating" state. I was trying to install it with my own ssl (in pem format), with quick start (insecur… --- ## [Problem with Kibana & Elasticsearch communication (TLS/SSL)](https://discuss.elastic.co/t/problem-with-kibana-elasticsearch-communication-tls-ssl/298509)
**Author:** [@WhenHeWhenHeAtThe](https://discuss.elastic.co/u/WhenHeWhenHeAtThe)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:03pm UTC](https://discuss.elastic.co/t/problem-with-kibana-elasticsearch-communication-tls-ssl/298509 "2022-03-01T13:03:19Z")
Hello, I am trying to set up Elastic stack (Elasticsearch, Kibana, Logstash) to communicate with each other via SSL/TLS. I have installed Elasticsearch but I can't get Kibana to connect to it. I am getting following er… --- ## [User Permission Synchronization in Workspace Search](https://discuss.elastic.co/t/user-permission-synchronization-in-workspace-search/296806)
**Author:** [@Dineshbabu\_Sekar](https://discuss.elastic.co/u/Dineshbabu_Sekar)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 1:13pm UTC](https://discuss.elastic.co/t/user-permission-synchronization-in-workspace-search/296806 "2022-03-01T13:13:25Z")
How Users in Workspace are managed ..Does it managed through Active directory and by another source? and How frequent are user permission are synced up and gets reflected --- ## [ILM increasing number of replicas - suboptimal behavior?](https://discuss.elastic.co/t/ilm-increasing-number-of-replicas-suboptimal-behavior/297516)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 4\ **Last updated:** [March 1, 2022, 1:12pm UTC](https://discuss.elastic.co/t/ilm-increasing-number-of-replicas-suboptimal-behavior/297516 "2022-03-01T13:12:43Z")
Hello nice elastic people. I am currently toying with ILM (7.x, not yet upgraded to 8.0) and ran into a surprising behavior. I have configured ILM to increase the number of replicas when transitioning from hot to cold. … --- ## [Weekly chart label mismatched?](https://discuss.elastic.co/t/weekly-chart-label-mismatched/298269)
**Author:** [@howai](https://discuss.elastic.co/u/howai)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 1:03pm UTC](https://discuss.elastic.co/t/weekly-chart-label-mismatched/298269 "2022-03-01T13:03:25Z")
I noticed that weekly chart (pic3) is use “First day of week” as date label and “End day of week” as data value. May I know is there any way that I can change the date label as “End day of week” in weekly chart (i.e. … --- ## [Unable to use of beats (here journalbeat) with AWS ElasticSearch 7.x](https://discuss.elastic.co/t/unable-to-use-of-beats-here-journalbeat-with-aws-elasticsearch-7-x/298506)
**Author:** [@obourdon](https://discuss.elastic.co/u/obourdon)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 12:24pm UTC](https://discuss.elastic.co/t/unable-to-use-of-beats-here-journalbeat-with-aws-elasticsearch-7-x/298506 "2022-03-01T12:24:11Z")
As detailed in https://github.com/elastic/beats/issues/30192 I used to have a perfectly working AWS ES 6.8 + journalbeat OSS 7.12.1 setup I also know about the breaking change of beats 7.13.0 which prevented me from up… --- ## [\_delete\_by\_query not removes messages from another index created in same date](https://discuss.elastic.co/t/delete-by-query-not-removes-messages-from-another-index-created-in-same-date/298503)
**Author:** [@mkobzev](https://discuss.elastic.co/u/mkobzev)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 12:10pm UTC](https://discuss.elastic.co/t/delete-by-query-not-removes-messages-from-another-index-created-in-same-date/298503 "2022-03-01T12:10:51Z")
Hello, I am removing messages from nonprod kubernetes namespaces using next query --query=app-\*/\_delete\_by\_query -XPOST -d'{ "query": {"bool": {"must": \[{"regexp": {"kubernetes.namespace\_name": {"value": ".\*nonprod"}}}… --- ## [Null Values Ignred by Elasticsearch](https://discuss.elastic.co/t/null-values-ignred-by-elasticsearch/298456)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 11:44am UTC](https://discuss.elastic.co/t/null-values-ignred-by-elasticsearch/298456 "2022-03-01T11:44:43Z")
We are using the NEST library with Elasticsearch versions 7.14. Lets say we have assigned a field a value of "hello World". The filed is mapped as a Keyword type and Not Indexed. If you update that document using the … --- ## [Error during make update while creating custom filebeat module](https://discuss.elastic.co/t/error-during-make-update-while-creating-custom-filebeat-module/298407)
**Author:** [@kkouramenos](https://discuss.elastic.co/u/kkouramenos)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 10:31am UTC](https://discuss.elastic.co/t/error-during-make-update-while-creating-custom-filebeat-module/298407 "2022-03-01T10:31:55Z")
Trying to create a custom module for filebeat. I passed successfully the make create-module, make create-fileset, create and test the pipeline, make create-fields. When running make update I get the following mage upda… --- ## [\[error\]\[data\]\[elasticsearch\] \[status\_exception\]: error while executing search](https://discuss.elastic.co/t/error-data-elasticsearch-status-exception-error-while-executing-search/298492)
**Author:** [@linuxxin](https://discuss.elastic.co/u/linuxxin)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 10:23am UTC](https://discuss.elastic.co/t/error-data-elasticsearch-status-exception-error-while-executing-search/298492 "2022-03-01T10:23:42Z")
\[error\]\[data\]\[Elasticsearch\] \[status\_exception\]: error while executing search --- ## [Set processor isn't working after another Set processor - Injest Pipeline](https://discuss.elastic.co/t/set-processor-isnt-working-after-another-set-processor-injest-pipeline/298478)
**Author:** [@shivani\_singh](https://discuss.elastic.co/u/shivani_singh)\ **Replies:** 10\ **Last updated:** [March 1, 2022, 10:22am UTC](https://discuss.elastic.co/t/set-processor-isnt-working-after-another-set-processor-injest-pipeline/298478 "2022-03-01T10:22:11Z")
Hi, I'm copying value of responseBody.results into embedded\_original\_value\_obj both are object type fields. This is my defined pipeline - PUT \_ingest/pipeline/apiproxy-embedded-copy { "processors": \[ { "se… --- ## [Ruby filter to whitelist nested fields](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424)
**Author:** [@lordcosmos1978](https://discuss.elastic.co/u/lordcosmos1978)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 9:48am UTC](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424 "2022-03-01T09:48:27Z")
I am trying to whitelist a number of nested fields. I first tried it using the prune filter but it seems that one does not support nested fields only top level fields. I saw in this topic Logstash prune nested fields t… --- ## [@timestamp vs timestamp date field](https://discuss.elastic.co/t/timestamp-vs-timestamp-date-field/298483)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 9:02am UTC](https://discuss.elastic.co/t/timestamp-vs-timestamp-date-field/298483 "2022-03-01T09:02:52Z")
Is there any difference between using "@timestamp" and "timestamp" date fields? Does elastic optimize search using those fields across multiple daily indices, perhaps if it knows min and max timestamp for each index? Cu… --- ## [Watcher & sentinl](https://discuss.elastic.co/t/watcher-sentinl/298477)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 8:25am UTC](https://discuss.elastic.co/t/watcher-sentinl/298477 "2022-03-01T08:25:06Z")
Hi i have 2 ELK clusters the first one have kibana v6.6.1 and i already installed sentinl v2 and working perfect but , the other clusters i have kibana 7.15.x and sentinl is incompatible with 7.x my question is can i u… --- ## [File Structure Cannot Be Determined](https://discuss.elastic.co/t/file-structure-cannot-be-determined/298464)
**Author:** [@mchtower](https://discuss.elastic.co/u/mchtower)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 8:03am UTC](https://discuss.elastic.co/t/file-structure-cannot-be-determined/298464 "2022-03-01T08:03:38Z")
Hello, is there a quick and easy way to import the blogs.json file outside of strigo? I had to set up my own lab environment. When I try to import the blogs.json file I'm getting this message: "File structure cannot be d… --- ## [Update partial fields failure, but update all success](https://discuss.elastic.co/t/update-partial-fields-failure-but-update-all-success/298472)
**Author:** [@yanllearnn](https://discuss.elastic.co/u/yanllearnn)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 7:19am UTC](https://discuss.elastic.co/t/update-partial-fields-failure-but-update-all-success/298472 "2022-03-01T07:19:34Z")
Hi, when I update the doc by some fields using updateRequest, it is not working. and no anyt errors. But when I update the doc all fields using updateRequest, it is working. How to update partial fields? Thanks. [Previous page](https://discuss.elastic.co/latest.md?page=1236) [Next page](https://discuss.elastic.co/latest.md?page=1238)