# Latest **URL:** https://discuss.elastic.co/latest.md?page=1310 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1311 --- ## [Filter single panel using URL parameters](https://discuss.elastic.co/t/filter-single-panel-using-url-parameters/294257)
**Author:** [@vleo](https://discuss.elastic.co/u/vleo)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 10:47am UTC](https://discuss.elastic.co/t/filter-single-panel-using-url-parameters/294257 "2022-01-13T10:47:31Z")
Hi, I'm working on a Kibana dashboard that will be build dynamically based on URL that will depend on some previous user action. The idea is to create the dashboard based on filters. I already know that we can apply fi… --- ## [Elasticsearch - Merge date histogram aggregation](https://discuss.elastic.co/t/elasticsearch-merge-date-histogram-aggregation/294228)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-merge-date-histogram-aggregation/294228 "2022-01-13T10:30:50Z")
Query GET /\_search { "size" : 0, "query" : { "ids" : { "types" : \[ \], "values" : \[ "someId1", "someId2", "someId3" ... \] } }, "aggregations" : { "how\_to\_merge" : { "date\_histogram" … --- ## [Linux(centos)+Windows Cluster](https://discuss.elastic.co/t/linux-centos-windows-cluster/294025)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 8:13am UTC](https://discuss.elastic.co/t/linux-centos-windows-cluster/294025 "2022-01-13T08:13:47Z")
Hello, Can one have an Cluster with one Windows and one Linux VM Node? I only find information about migrating from one to another. (A yes or no is sufficient, I got the following error which makes me think it may not … --- ## [How do i build spell engine for prefix based search as you type product](https://discuss.elastic.co/t/how-do-i-build-spell-engine-for-prefix-based-search-as-you-type-product/294253)
**Author:** [@Bhagwati\_Malav](https://discuss.elastic.co/u/Bhagwati_Malav)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 9:49am UTC](https://discuss.elastic.co/t/how-do-i-build-spell-engine-for-prefix-based-search-as-you-type-product/294253 "2022-01-13T09:49:07Z")
Hi Need input from community on building spell engine system for search as you type product. Currently running a search as you type product which uses edge ngram approach internally. Have turned off fuzziness setting as… --- ## [Logstash running in openshift is not sending output to NFS](https://discuss.elastic.co/t/logstash-running-in-openshift-is-not-sending-output-to-nfs/294242)
**Author:** [@Ravi\_Sehgal](https://discuss.elastic.co/u/Ravi_Sehgal)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 8:11am UTC](https://discuss.elastic.co/t/logstash-running-in-openshift-is-not-sending-output-to-nfs/294242 "2022-01-13T08:11:41Z")
I have a requirement to send docker container logs to NFS drive. Filebeat installed as daemonset sends logs to single logstash pod which shall write them to NFS. Logstatsh configuration look something like below outpu… --- ## [Return results with match\_phrase if document count is greater than 1](https://discuss.elastic.co/t/return-results-with-match-phrase-if-document-count-is-greater-than-1/294143)
**Author:** [@liam.gallagher](https://discuss.elastic.co/u/liam.gallagher)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 9:42am UTC](https://discuss.elastic.co/t/return-results-with-match-phrase-if-document-count-is-greater-than-1/294143 "2022-01-13T09:42:58Z")
Good morning, Is it possible to use match\_phrase to count the occurrence of the phrase per document and only return results if the phrase count in the document in greater than 1? { "query": { "bool": { "sho… --- ## [Pull data from another elasticsearch cluster using logstash](https://discuss.elastic.co/t/pull-data-from-another-elasticsearch-cluster-using-logstash/293946)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 9:16am UTC](https://discuss.elastic.co/t/pull-data-from-another-elasticsearch-cluster-using-logstash/293946 "2022-01-13T09:16:21Z")
Hi folks, I have a use case where I need to pull data from an external Elasticsearch cluster with the following Limitation: It is not allowed to open a conection to my internal elastic cluster (due to compliance regulat… --- ## [Outdated dynamic field mapping](https://discuss.elastic.co/t/outdated-dynamic-field-mapping/294151)
**Author:** [@fede1](https://discuss.elastic.co/u/fede1)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 8:48am UTC](https://discuss.elastic.co/t/outdated-dynamic-field-mapping/294151 "2022-01-13T08:48:41Z")
I have a dynamic field mapping of type X, and when I attempt to index a document with a different type for the same field, I get the following error with a 400 status code, as expected: "type": "mapper\_parsing\_exception… --- ## [Metricbeat error while enabling windows metrics](https://discuss.elastic.co/t/metricbeat-error-while-enabling-windows-metrics/294245)
**Author:** [@inmar](https://discuss.elastic.co/u/inmar)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 8:41am UTC](https://discuss.elastic.co/t/metricbeat-error-while-enabling-windows-metrics/294245 "2022-01-13T08:41:06Z")
Hi I am running ES stack on linux ubuntu inside windows hyper-v VM. I installed metricbeat with deb package, enabled system metrics everything worked well. I want to add windows metrics to be collected in the ES. Whe… --- ## [Cannot group using alias columns](https://discuss.elastic.co/t/cannot-group-using-alias-columns/294241)
**Author:** [@yanghao](https://discuss.elastic.co/u/yanghao)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 7:31am UTC](https://discuss.elastic.co/t/cannot-group-using-alias-columns/294241 "2022-01-13T07:31:30Z")
This sql query could get result POST /\_sql?format=txt { "query": "select dt,sum(pay\_order\_cnt\_1d) from (select dt,pay\_order\_cnt\_1d from sol\_t\_order\_home)t1 group by dt" } but when executing this sql query POST /\_sql… --- ## [How to combine prefix query with synonym filter in Elasticsearch?](https://discuss.elastic.co/t/how-to-combine-prefix-query-with-synonym-filter-in-elasticsearch/294235)
**Author:** [@learningmore](https://discuss.elastic.co/u/learningmore)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 7:26am UTC](https://discuss.elastic.co/t/how-to-combine-prefix-query-with-synonym-filter-in-elasticsearch/294235 "2022-01-13T07:26:18Z")
I'm currently using Elasticsearch 7.16 and came across an issue. Assume that we have the following data: horse mouse chicken rooster duck cow Let's assume the synonym file has the following entries (i.e. rooster and c… --- ## [Can we create a Index life cycle policy with Hot, Warm and Cold phase in a two node cluster(1 data node, 1 master)?](https://discuss.elastic.co/t/can-we-create-a-index-life-cycle-policy-with-hot-warm-and-cold-phase-in-a-two-node-cluster-1-data-node-1-master/294133)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 6:04am UTC](https://discuss.elastic.co/t/can-we-create-a-index-life-cycle-policy-with-hot-warm-and-cold-phase-in-a-two-node-cluster-1-data-node-1-master/294133 "2022-01-13T06:04:58Z")
Can we create an Index life cycle policy with Hot, Warm, and Cold phases in a two-node cluster(1 data node, 1 master)? what can be the architecture of policy and what configurations are required for both Elastic nodes? --- ## [Terrible low performance search despite enough resources](https://discuss.elastic.co/t/terrible-low-performance-search-despite-enough-resources/293992)
**Author:** [@zarmci](https://discuss.elastic.co/u/zarmci)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 5:48am UTC](https://discuss.elastic.co/t/terrible-low-performance-search-despite-enough-resources/293992 "2022-01-13T05:48:18Z")
We have two 3-nodes Elasticsearch cluster. Despite these clusters have approximately similar resources and the indices are quite similar, the speed of search in one of them is tenfold slower than another. We spent a lot … --- ## [I can't ingest time longer than 24 hours](https://discuss.elastic.co/t/i-cant-ingest-time-longer-than-24-hours/294168)
**Author:** [@Eric\_Barreto](https://discuss.elastic.co/u/Eric_Barreto)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 5:44am UTC](https://discuss.elastic.co/t/i-cant-ingest-time-longer-than-24-hours/294168 "2022-01-13T05:44:24Z")
I need to create a dashboard based on a json that will be ingested repeatedly, this json has 2 fields of type time the first field is TA and the second is TT. The value of these fields is represented by HH:mm:ss, but th… --- ## [Missing replica shards](https://discuss.elastic.co/t/missing-replica-shards/294164)
**Author:** [@Latifa\_MASMOUDI](https://discuss.elastic.co/u/Latifa_MASMOUDI)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 5:34am UTC](https://discuss.elastic.co/t/missing-replica-shards/294164 "2022-01-13T05:34:46Z")
hi community i'm a beginner in ELK, so i can't resolve this problem. the Elasticsearch overview show me that are Missing replica shards, also the health is yellow. Also, i uploaded a file to kibana, but it can't vis… --- ## [Data Integration between Hadoop - Hive and Elastic Search](https://discuss.elastic.co/t/data-integration-between-hadoop-hive-and-elastic-search/294037)
**Author:** [@Kishanu\_Bhattacharya](https://discuss.elastic.co/u/Kishanu_Bhattacharya)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:41am UTC](https://discuss.elastic.co/t/data-integration-between-hadoop-hive-and-elastic-search/294037 "2022-01-13T04:41:56Z")
There are a few questions about a use case in which I am presently working, This is related to establishing a data pipeline(Data Integration) from Hadoop to Elasticsearch. I did a few quick POCs by creating the indices … --- ## [Percentage in Kibana visualization](https://discuss.elastic.co/t/percentage-in-kibana-visualization/294015)
**Author:** [@Tzlil](https://discuss.elastic.co/u/Tzlil)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:19am UTC](https://discuss.elastic.co/t/percentage-in-kibana-visualization/294015 "2022-01-13T04:19:12Z")
i want to calculate the percentage of "pass" tests i have a scripted filed that return 1 when a test is "pass" at the moment i have a graph that shows the number of tests that ran( pass/fail/warning) how can i change … --- ## [Error initializing beat: could not initialize the keystore](https://discuss.elastic.co/t/error-initializing-beat-could-not-initialize-the-keystore/293847)
**Author:** [@ramilbermejo](https://discuss.elastic.co/u/ramilbermejo)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:10am UTC](https://discuss.elastic.co/t/error-initializing-beat-could-not-initialize-the-keystore/293847 "2022-01-13T04:10:49Z")
Hi All, Need some help on how I can make apm-server keystore work. For some reason it will fail to initialize the file if is not owned by root. root@apm-server:~# apm-server keystore list error initializing beat: cou… --- ## [How to calculate the percentage of a metric through JSON?](https://discuss.elastic.co/t/how-to-calculate-the-percentage-of-a-metric-through-json/294157)
**Author:** [@rcmv](https://discuss.elastic.co/u/rcmv)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:09am UTC](https://discuss.elastic.co/t/how-to-calculate-the-percentage-of-a-metric-through-json/294157 "2022-01-13T04:09:47Z")
Hi! I'm new with Elastic so this is most probably an easy question but I would appreciate some help here. I have a dashboard on Kibana where I want to add a vertical bar chart which presents me the results of the tests… --- ## ["Azure Data Explorer" output plugin error](https://discuss.elastic.co/t/azure-data-explorer-output-plugin-error/294197)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 2:45am UTC](https://discuss.elastic.co/t/azure-data-explorer-output-plugin-error/294197 "2022-01-13T02:45:11Z")
Hello All, Using the kusto output plugin for Azure Data explorer I did a successful test with the example as per the documentation below References: Ingest data from Logstash to Azure Data Explorer | Microsoft Docs G… --- ## [How to run script query on logstash](https://discuss.elastic.co/t/how-to-run-script-query-on-logstash/294227)
**Author:** [@mzinboy](https://discuss.elastic.co/u/mzinboy)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 2:24am UTC](https://discuss.elastic.co/t/how-to-run-script-query-on-logstash/294227 "2022-01-13T02:24:13Z")
It doesn't work(logstash 7.15.1). I can't escape single quotes in query field. Elasticsearch input value : input { elasticsearch { hosts =\> \["..."\] index =\> "..." query =\> '{ "query": { "bool": { "… --- ## [Data stream vs index](https://discuss.elastic.co/t/data-stream-vs-index/294202)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 10:40pm UTC](https://discuss.elastic.co/t/data-stream-vs-index/294202 "2022-01-12T22:40:45Z")
What are the benefits of using data stream instead of using index for storing data in Elasticsearch. I would like to store continuously generated data. --- ## [Log4j security vulnerability for logstash 6.2.2](https://discuss.elastic.co/t/log4j-security-vulnerability-for-logstash-6-2-2/294205)
**Author:** [@ellje](https://discuss.elastic.co/u/ellje)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 8:46pm UTC](https://discuss.elastic.co/t/log4j-security-vulnerability-for-logstash-6-2-2/294205 "2022-01-12T20:46:46Z")
Hi, I'm using an older version of Logstash (6.2.2) and I cannot migrate it just yet. In the meantime, I read that to remediate the log4j issue, we should be removing the jndi class as noted in Apache Log4j2 Remote Code … --- ## [Can you manually curl geoip.elastic.co to get geo data?](https://discuss.elastic.co/t/can-you-manually-curl-geoip-elastic-co-to-get-geo-data/294206)
**Author:** [@spuder](https://discuss.elastic.co/u/spuder)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 10:07pm UTC](https://discuss.elastic.co/t/can-you-manually-curl-geoip-elastic-co-to-get-geo-data/294206 "2022-01-12T22:07:15Z")
I have an Elasticsearch cluster that does not have internet access for security. According to the documentaiton it is possible to mirror your own geoip endpoint I have a mirror setup, however I'm unable to test if the… --- ## [Logstash with log4j 2.17.1 patch release](https://discuss.elastic.co/t/logstash-with-log4j-2-17-1-patch-release/294195)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 9:09pm UTC](https://discuss.elastic.co/t/logstash-with-log4j-2-17-1-patch-release/294195 "2022-01-12T21:09:49Z")
Hi Logstash team, The current latest logstash version 7.16.2 is bundled with log4j 2.17.0. Are there any plans to release a new patch version with log4j 2.17.1? Many thanks, --- ## [(another) Custome Index Name for Filebeat](https://discuss.elastic.co/t/another-custome-index-name-for-filebeat/293283)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 8:44pm UTC](https://discuss.elastic.co/t/another-custome-index-name-for-filebeat/293283 "2022-01-12T20:44:44Z")
First: Happy New Year! Second: I have seen various other posts on this topic, but they always seem to timeout before getting to an answer. I an running ELK 7.13.4 I have an Elasticsearch that ingests data from multipl… --- ## [Does Heartbeat have feature like Logstash pipeline?](https://discuss.elastic.co/t/does-heartbeat-have-feature-like-logstash-pipeline/292793)
**Author:** [@Ray\_Lin](https://discuss.elastic.co/u/Ray_Lin)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 8:30pm UTC](https://discuss.elastic.co/t/does-heartbeat-have-feature-like-logstash-pipeline/292793 "2022-01-12T20:30:19Z")
Hi, I am trying to monitor a healthcheck url but it has to first call a token API to get the token then pass the token value to the next healthcheck API which I actually want to monitor. In the past, I'm using Logstash… --- ## [Wrong response code sent by heartbeat](https://discuss.elastic.co/t/wrong-response-code-sent-by-heartbeat/294132)
**Author:** [@Fosco](https://discuss.elastic.co/u/Fosco)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 8:29pm UTC](https://discuss.elastic.co/t/wrong-response-code-sent-by-heartbeat/294132 "2022-01-12T20:29:03Z")
Hello, I am using heartbeat to retrieve the code 200 from a website, but for the moment the website is returning a 500 code. But heartbeat is returning 200.. I am using the 7.10.2 version of heartbeat (on the 7.9.2 it'… --- ## [Create Parent-Child relationship with Logstash](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 8:22pm UTC](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198 "2022-01-12T20:22:19Z")
Hi Everyone; I need to create a Parent-Chield relationship with Logstash. I created index like this. Here is the mapping I try to create relationship using filter mutate as below picture But I am getting this… --- ## [Auto Refresh Kibana Dashboards](https://discuss.elastic.co/t/auto-refresh-kibana-dashboards/294185)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 7:11pm UTC](https://discuss.elastic.co/t/auto-refresh-kibana-dashboards/294185 "2022-01-12T19:11:17Z")
We have 30-40 Dashboard in Kibana which we use to monitor different applications. The problem is we have to refresh the dashboard frequently to see the latest results. Is there any global settings through which we can au… [Previous page](https://discuss.elastic.co/latest.md?page=1309) [Next page](https://discuss.elastic.co/latest.md?page=1311)