# Latest **URL:** https://discuss.elastic.co/latest.md?page=1303 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1304 --- ## [Show text from index](https://discuss.elastic.co/t/show-text-from-index/294713)
**Author:** [@czxch](https://discuss.elastic.co/u/czxch)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 5:41pm UTC](https://discuss.elastic.co/t/show-text-from-index/294713 "2022-01-18T17:41:34Z")
Is it possible to show a text field in a visualization like in a Markdown but with the text coming from an index as I want this text to be updated dynamically each time it changes --- ## [Can't delete/change data in @timestamp field yielded by ingest processor](https://discuss.elastic.co/t/cant-delete-change-data-in-timestamp-field-yielded-by-ingest-processor/294497)
**Author:** [@SomeAkk](https://discuss.elastic.co/u/SomeAkk)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 5:29pm UTC](https://discuss.elastic.co/t/cant-delete-change-data-in-timestamp-field-yielded-by-ingest-processor/294497 "2022-01-18T17:29:35Z")
Hi! Today i add to my document @timestamp field (before this value was not in the document, and document no any date data.) with date data using ingest set processor: { "processors": \[ { "set": { "de… --- ## [Roll Up Index does not get populated with documents](https://discuss.elastic.co/t/roll-up-index-does-not-get-populated-with-documents/294707)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 5:04pm UTC](https://discuss.elastic.co/t/roll-up-index-does-not-get-populated-with-documents/294707 "2022-01-18T17:04:37Z")
Hi folks, my goal is to archive the document \_size of incoming logs in specific archive index, because the original document gets deleted using ILM. Example Document: { "\_index":"filebeat-live-index-01", "\_type"… --- ## [Upsert data using painless script if updated\_at is higher than previous document](https://discuss.elastic.co/t/upsert-data-using-painless-script-if-updated-at-is-higher-than-previous-document/294632)
**Author:** [@garotad508](https://discuss.elastic.co/u/garotad508)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 4:35pm UTC](https://discuss.elastic.co/t/upsert-data-using-painless-script-if-updated-at-is-higher-than-previous-document/294632 "2022-01-18T16:35:28Z")
I have a collection which gets updated frequently. We need to perform upsert operation, i.e., if document doesn't exist then create else update. Another constraint we require is timestamp of updated\_at should be higher… --- ## [Select documents with nested collection without something](https://discuss.elastic.co/t/select-documents-with-nested-collection-without-something/294714)
**Author:** [@Ivan\_Popov](https://discuss.elastic.co/u/Ivan_Popov)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 4:22pm UTC](https://discuss.elastic.co/t/select-documents-with-nested-collection-without-something/294714 "2022-01-18T16:22:38Z")
Here is my test data \[ { "id": 1, "last\_email\_sent": \[ { "letterId": 1, "timestamp": 555 }, { "letterId": 2, "timestamp": 666 } \] }, { "id": … --- ## [Elasticsearch docker environment variables prefix](https://discuss.elastic.co/t/elasticsearch-docker-environment-variables-prefix/294711)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-environment-variables-prefix/294711 "2022-01-18T16:08:58Z")
I'm trying to run ES in docker with specific env variables such as discovery.type=single-node, but my hosting provider prohibits . characters in env variable names. This is discussed here: Install Elasticsearch with Doc… --- ## [Logstash OSS 7.16.3 and Elasticsearch OSS 7.10.2](https://discuss.elastic.co/t/logstash-oss-7-16-3-and-elasticsearch-oss-7-10-2/294658)
**Author:** [@Thilak1](https://discuss.elastic.co/u/Thilak1)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 4:00pm UTC](https://discuss.elastic.co/t/logstash-oss-7-16-3-and-elasticsearch-oss-7-10-2/294658 "2022-01-18T16:00:34Z")
Hi Team , I am getting the below error when using Elasticsearch output plugin in logstash OSS 7.16.3 \[2021-04-16T05:31:15,846\]\[ERROR\]\[logstash.javapipeline \] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@linuxlion](https://discuss.elastic.co/u/linuxlion)\ **Replies:** 2\ **Last updated:** [January 17, 2022, 4:36pm UTC](https://discuss.elastic.co/t/how-to-restart-collection-after-high-disk-watermark/294605 "2022-01-17T16:36:50Z") Elasticsearch stop collection after high disk watermark. After cleanup the disk, I want to restart collection. Some years ago on version 6.8.23-1 I use: curl -X PUT "http://127.0.0.1:9200/settings?pretty" -H 'Content-… --- ## [Conditional in the output is ignored](https://discuss.elastic.co/t/conditional-in-the-output-is-ignored/294343)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 3:15pm UTC](https://discuss.elastic.co/t/conditional-in-the-output-is-ignored/294343 "2022-01-18T15:15:22Z")
The conditional statement in my logstash configuration is being ignored. It is being skipped over no matter what I put in it. I have 4 elasticsearch options in the output divided by an if and else statement. I've tried u… --- ## [How can I add kubernetes metadata for my cri-containerd pods](https://discuss.elastic.co/t/how-can-i-add-kubernetes-metadata-for-my-cri-containerd-pods/294706)
**Author:** [@jianwu](https://discuss.elastic.co/u/jianwu)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 2:49pm UTC](https://discuss.elastic.co/t/how-can-i-add-kubernetes-metadata-for-my-cri-containerd-pods/294706 "2022-01-18T14:49:43Z")
I am using filebeat 7.16.2 to collect containers stdout which run-time is containerd. MY kubernetes' versin v1.20.10, and containerd version is v1.19.0. Below is some of my filebeat.yaml filebeat.inputs: - type… --- ## [Create custom visualization for Kibana composed by image + text](https://discuss.elastic.co/t/create-custom-visualization-for-kibana-composed-by-image-text/294590)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 2:49pm UTC](https://discuss.elastic.co/t/create-custom-visualization-for-kibana-composed-by-image-text/294590 "2022-01-18T14:49:34Z")
Is it possible to create a visualization that is composed by an image and a test side by side? An other charateristic is that the visualization has an associated url for reaching a specific dashboard. Or is it possible… --- ## [K8s (kubernetes) sidecar considerations](https://discuss.elastic.co/t/k8s-kubernetes-sidecar-considerations/294393)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 2:29pm UTC](https://discuss.elastic.co/t/k8s-kubernetes-sidecar-considerations/294393 "2022-01-18T14:29:05Z")
Hi, At this moment we have a myriad of microservices running on-prem. However, we are preparing to move everything to tha cloud (k8s on aws). As a result I am redesigning our elastic platform since this will move to aws… --- ## [Not able to start Elasticsearch cluster after disabling security](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-cluster-after-disabling-security/294673)
**Author:** [@hallaoui](https://discuss.elastic.co/u/hallaoui)\ **Replies:** 3\ **Last updated:** [January 18, 2022, 2:17pm UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-cluster-after-disabling-security/294673 "2022-01-18T14:17:13Z")
Hi All, I disabled the security due to expiration of platinum subscription but when trying to start the cluster it is not starting. Any help will be high appreciated. Thanks --- ## [Update mapping to support an additional date format (without reindexing)](https://discuss.elastic.co/t/update-mapping-to-support-an-additional-date-format-without-reindexing/294704)
**Author:** [@Lee\_Tonks](https://discuss.elastic.co/u/Lee_Tonks)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 2:13pm UTC](https://discuss.elastic.co/t/update-mapping-to-support-an-additional-date-format-without-reindexing/294704 "2022-01-18T14:13:59Z")
Is it possible to update my document mapping to support an additional date/time format without having to reindex? ie my current format is: {"type": "date", "format": "yyyy-MM-dd HH:mm:ss"} and the format I want to set… --- ## [How do you manage large filebeat installations?](https://discuss.elastic.co/t/how-do-you-manage-large-filebeat-installations/293755)
**Author:** [@mybyte](https://discuss.elastic.co/u/mybyte)\ **Replies:** 11\ **Last updated:** [January 18, 2022, 2:00pm UTC](https://discuss.elastic.co/t/how-do-you-manage-large-filebeat-installations/293755 "2022-01-18T14:00:17Z")
Elastic has made huge leaps in the direction of centralized management recently. Fleet and agent seem to be coming along. But while they seem to work well for metrics, syslog etc. I'm still struggling a bit with a useabl… --- ## [Unable to use filters with grok expression](https://discuss.elastic.co/t/unable-to-use-filters-with-grok-expression/294662)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 8:02am UTC](https://discuss.elastic.co/t/unable-to-use-filters-with-grok-expression/294662 "2022-01-18T08:02:04Z")
Hello Team, I need to use grok expression for ELK to filter the message data I have elk configured using docker compose and filebeat on client server using docker container. I have following files configured for filte… --- ## [How to add personnal aggs in Kibana](https://discuss.elastic.co/t/how-to-add-personnal-aggs-in-kibana/294691)
**Author:** [@Scorfly](https://discuss.elastic.co/u/Scorfly)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 1:28pm UTC](https://discuss.elastic.co/t/how-to-add-personnal-aggs-in-kibana/294691 "2022-01-18T13:28:01Z")
Hello ! I have doc for each of my product. My product have serviceCreationDate and serviceTerminationDate field. i try to have the diff between service created and terminated. However i dont find a solution with Kiban… --- ## [Duplicate error logs](https://discuss.elastic.co/t/duplicate-error-logs/294696)
**Author:** [@Petersson](https://discuss.elastic.co/u/Petersson)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 1:24pm UTC](https://discuss.elastic.co/t/duplicate-error-logs/294696 "2022-01-18T13:24:28Z")
Hello, I have recently started using Elasticsearch in combination with the Kibana presentation layer. My problem now is that in the log analysis all logs are shown to me individually, so there are many identical error … --- ## [Elasticsearch x-paxk error](https://discuss.elastic.co/t/elasticsearch-x-paxk-error/294661)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 1:19pm UTC](https://discuss.elastic.co/t/elasticsearch-x-paxk-error/294661 "2022-01-18T13:19:37Z")
When i run ./Elasticsearch it's gives an error how do i reconfiugure keystore or else ? uncaught exception in thread \[main\] java.lang.IllegalArgumentException: unknown secure setting \[xpack.security.transport.ssl.keysto… --- ## [I'm unable to create fields and unable to parse the below logs with split filter please suggest me the correct logstash input](https://discuss.elastic.co/t/im-unable-to-create-fields-and-unable-to-parse-the-below-logs-with-split-filter-please-suggest-me-the-correct-logstash-input/294682)
**Author:** [@aravindpatel](https://discuss.elastic.co/u/aravindpatel)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 10:45am UTC](https://discuss.elastic.co/t/im-unable-to-create-fields-and-unable-to-parse-the-below-logs-with-split-filter-please-suggest-me-the-correct-logstash-input/294682 "2022-01-18T10:45:29Z")
log file { "id": "AAA", "num": "-17.3595", "num": "-145.494", "name": "Anaa", "author": "Anaaauthor", "place": "Tuamotu-Gambier", "landmark": "French Polynesia", "spcid": "12512819", "target": "Pacific/Midway", … --- ## [PATTERN ERROR WHEN ADDING IN INGEST PIPELINE GROK PROCESSOR](https://discuss.elastic.co/t/pattern-error-when-adding-in-ingest-pipeline-grok-processor/294667)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 8:36am UTC](https://discuss.elastic.co/t/pattern-error-when-adding-in-ingest-pipeline-grok-processor/294667 "2022-01-18T08:36:53Z")
Hi all, I am stucked in one thing and want to ask in community that I am trying to create a grok pattern for a log and in dev tools grok tester I am successfull in writing up a pattern as the below screenshow indicates … --- ## [Curator failing with 'curator.exceptions.FailedExecution'\>: Unable to get snapshot information from repository: elkbackup. Error: NotFoundError(404, 'snapshot\_missing\_exception',](https://discuss.elastic.co/t/curator-failing-with-curator-exceptions-failedexecution-unable-to-get-snapshot-information-from-repository-elkbackup-error-notfounderror-404-snapshot-missing-exception/294660)
**Author:** [@jashwanth](https://discuss.elastic.co/u/jashwanth)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 7:50am UTC](https://discuss.elastic.co/t/curator-failing-with-curator-exceptions-failedexecution-unable-to-get-snapshot-information-from-repository-elkbackup-error-notfounderror-404-snapshot-missing-exception/294660 "2022-01-18T07:50:40Z")
Hi Team, We're facing an issue with Curator and it is failing with below error. The Curator is searching a snapshot which is not present in S3. How can we fix this error for delete\_snapshots to work properly. One of th… --- ## [Cant install jdbc plugin](https://discuss.elastic.co/t/cant-install-jdbc-plugin/294665)
**Author:** [@peledev](https://discuss.elastic.co/u/peledev)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 8:33am UTC](https://discuss.elastic.co/t/cant-install-jdbc-plugin/294665 "2022-01-18T08:33:12Z")
hi i cant install plugin in my server is get error : \[claudede@server logstash\]$ sudo bin/logstash-plugin install logstash-input-jdbc Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option … --- ## [Would the search performance be very slow if a data stream consists of too many or too large cold backing indices?](https://discuss.elastic.co/t/would-the-search-performance-be-very-slow-if-a-data-stream-consists-of-too-many-or-too-large-cold-backing-indices/294376)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 6\ **Last updated:** [January 18, 2022, 8:16am UTC](https://discuss.elastic.co/t/would-the-search-performance-be-very-slow-if-a-data-stream-consists-of-too-many-or-too-large-cold-backing-indices/294376 "2022-01-18T08:16:45Z")
Hi, I'm moving from es 6.x to 7.x, find the new feature data stream and would like to have a try. But I'm a bit worried of the search performace for the docs explains When you submit a read request to a data stream, the… --- ## [How to remove Kibana "Add Integrations" button](https://discuss.elastic.co/t/how-to-remove-kibana-add-integrations-button/293098)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [January 18, 2022, 7:40am UTC](https://discuss.elastic.co/t/how-to-remove-kibana-add-integrations-button/293098 "2022-01-18T07:40:01Z")
Hello, We updated to 7.16.2 today. Seems like there is now a huge "Add Integrations' button in the main Kibana menu.... :frowning: Is there a way to remove this button please? As this results in all kinds of unwanted… --- ## [How to fix \[logstash.filters.geoip.databasemanager\] Connection reset](https://discuss.elastic.co/t/how-to-fix-logstash-filters-geoip-databasemanager-connection-reset/294237)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 7:03am UTC](https://discuss.elastic.co/t/how-to-fix-logstash-filters-geoip-databasemanager-connection-reset/294237 "2022-01-18T07:03:21Z")
hi guys, I meet the issue and I don't know why? Does anybody know the reason? Jan 14 10:23:18 OANWELKL1 logstash\[4874\]: \[2022-01-14T10:23:18,644\]\[WARN \]\[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]\[main\] … --- ## [What is the point of using EQL to correlate log?](https://discuss.elastic.co/t/what-is-the-point-of-using-eql-to-correlate-log/294542)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 6:57am UTC](https://discuss.elastic.co/t/what-is-the-point-of-using-eql-to-correlate-log/294542 "2022-01-18T06:57:48Z")
Hi all I am trying to understand how the eql is difference from the normal search api that we are already using in elastic. For example GET /winlogbeat-\*/\_eql/search { "query": """ process where event.type == "s… --- ## [Can I add a sub "term" "aggregation" for a x-axis filters aggregation?](https://discuss.elastic.co/t/can-i-add-a-sub-term-aggregation-for-a-x-axis-filters-aggregation/294533)
**Author:** [@rogerlee](https://discuss.elastic.co/u/rogerlee)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 5:50am UTC](https://discuss.elastic.co/t/can-i-add-a-sub-term-aggregation-for-a-x-axis-filters-aggregation/294533 "2022-01-18T05:50:18Z")
Hello, experts. I am trying to customize an aggregation via "Json Input" for a horizontal bar chart, and the data I am using is the flight demo data. The purpose is that I want to specify aggregations for every filter on… --- ## [How to aggregate alerts?](https://discuss.elastic.co/t/how-to-aggregate-alerts/294654)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 5:27am UTC](https://discuss.elastic.co/t/how-to-aggregate-alerts/294654 "2022-01-18T05:27:38Z")
So i have many alerts with the same cause (some maware send messages to C2) with the same source IP address. Can i aggregate such alerts in one (aggregation by source IP address)? --- ## [After ES Cluster docker container restart on 7.5.0 could not elect master node with same configuration as old](https://discuss.elastic.co/t/after-es-cluster-docker-container-restart-on-7-5-0-could-not-elect-master-node-with-same-configuration-as-old/294615)
**Author:** [@shubham1121](https://discuss.elastic.co/u/shubham1121)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 4:48am UTC](https://discuss.elastic.co/t/after-es-cluster-docker-container-restart-on-7-5-0-could-not-elect-master-node-with-same-configuration-as-old/294615 "2022-01-18T04:48:18Z")
On physical server container restarts and then could not elect master anymore from 3 node ES cluster [Previous page](https://discuss.elastic.co/latest.md?page=1302) [Next page](https://discuss.elastic.co/latest.md?page=1304)