# Latest **URL:** https://discuss.elastic.co/latest.md?page=1367 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1368 --- ## [How to confine geopoint aggregation bucket count](https://discuss.elastic.co/t/how-to-confine-geopoint-aggregation-bucket-count/290681)
**Author:** [@FURKAN\_KURT](https://discuss.elastic.co/u/FURKAN_KURT)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 2:45pm UTC](https://discuss.elastic.co/t/how-to-confine-geopoint-aggregation-bucket-count/290681 "2021-12-01T14:45:57Z")
Hello. I could not find how to confine coming aggregated bucket size. I want them to split into smaller pieces if they surpass 100 elements each. Thank you --- ## [Progression wheel value at the end of the wheel](https://discuss.elastic.co/t/progression-wheel-value-at-the-end-of-the-wheel/288475)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 6\ **Last updated:** [December 1, 2021, 2:37pm UTC](https://discuss.elastic.co/t/progression-wheel-value-at-the-end-of-the-wheel/288475 "2021-12-01T14:37:42Z")
Hi, I am working with canvas and was trying to find a way to show the value in a progression wheel at the end of the wheel instead of in the center. I tried some approaches using css that I used for bar plots and scatte… --- ## [When do delete policies in ILM actually get applied?](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 1:56pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563 "2021-12-01T13:56:27Z")
Hello We have a ILM policy that deletes logs older than 240 days. We also have a monitoring system that watches the mount point where the logs get stored for space. Every 1-2 months, we get a alert that it gets near i… --- ## [Filebeat messages missing under high load](https://discuss.elastic.co/t/filebeat-messages-missing-under-high-load/290194)
**Author:** [@hajeve](https://discuss.elastic.co/u/hajeve)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 1:44pm UTC](https://discuss.elastic.co/t/filebeat-messages-missing-under-high-load/290194 "2021-12-01T13:44:07Z")
We need help with the following problem: We are receiving BIG IP F5 request-logs via F5 High Speed Logging in dedicated filebeat pods (8) in our production environment in Azure cloud. These filebeat pods are connected … --- ## [Filebeat on kubernetes: cant make it work without cluster roles](https://discuss.elastic.co/t/filebeat-on-kubernetes-cant-make-it-work-without-cluster-roles/290586)
**Author:** [@Guillaume84](https://discuss.elastic.co/u/Guillaume84)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 1:39pm UTC](https://discuss.elastic.co/t/filebeat-on-kubernetes-cant-make-it-work-without-cluster-roles/290586 "2021-12-01T13:39:36Z")
Hello, I am trying to deploy a filebeat container (not daemonset) on a k8s cluster (kub 1.21) Used image: elastic/filebeat:7.8.1 Image starts correctly but i can't have the filebeat working correctly : E1130 15:47:41… --- ## [Elasticsearch write performance](https://discuss.elastic.co/t/elasticsearch-write-performance/290646)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 1:20pm UTC](https://discuss.elastic.co/t/elasticsearch-write-performance/290646 "2021-12-01T13:20:56Z")
helllo,when i write data to Elasticsearch using the bulk api,which process is flink consume the data of kafka then write to Elasticsearch.sometimes the write performance has Large fluctuations，I want to kown when the ela… --- ## [Disapearing fields during kv parsing](https://discuss.elastic.co/t/disapearing-fields-during-kv-parsing/290652)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 1:20pm UTC](https://discuss.elastic.co/t/disapearing-fields-during-kv-parsing/290652 "2021-12-01T13:20:03Z")
Hi! I'm trying to parse the following log record \_\_policy\_id\_tag:"product=APP1 & APP2\[db\_tag={ABCDEF}; mgmt=abcd; date=123456789; policy\_name=foo\]"; product:"APP1 & APP2"; mgmt:"abcd"; event:"Canceled" and when I use … --- ## [Can't turn on monitoring](https://discuss.elastic.co/t/cant-turn-on-monitoring/290356)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 11:42am UTC](https://discuss.elastic.co/t/cant-turn-on-monitoring/290356 "2021-12-01T11:42:01Z")
Hi, I have installed Kibana for the new cluster. When going to Stack Monitoring. It shows “We couldn't activate monitoring” In addition log prints “Unable to bulk upload the stats payload to the local cluster” Dev to… --- ## [Engine really slow after indexing ~50 Million documents](https://discuss.elastic.co/t/engine-really-slow-after-indexing-50-million-documents/290189)
**Author:** [@ammarhaider](https://discuss.elastic.co/u/ammarhaider)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 10:35am UTC](https://discuss.elastic.co/t/engine-really-slow-after-indexing-50-million-documents/290189 "2021-12-01T10:35:31Z")
After indexing 50M documents, I am experiencing really slow search response. And when I query with some facet fields I get internal server error after waiting for 30+ seconds. I increased the memory allocated to appsear… --- ## [ElasticSearch does not allow IPv6-mapped IPv4 address in field of type ip\_range](https://discuss.elastic.co/t/elasticsearch-does-not-allow-ipv6-mapped-ipv4-address-in-field-of-type-ip-range/290656)
**Author:** [@swapnil\_vaidya](https://discuss.elastic.co/u/swapnil_vaidya)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 11:17am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-allow-ipv6-mapped-ipv4-address-in-field-of-type-ip-range/290656 "2021-12-01T11:17:08Z")
Hi All, I am trying to index the document with field having value as IPV6 mapped IPV4 address in the field with type as ip\_range. However ES throws following error: CIDR notation is not allowed with IPv6-mapped IPv4 a… --- ## [How to fetch environment varibles in kibana plugin](https://discuss.elastic.co/t/how-to-fetch-environment-varibles-in-kibana-plugin/290431)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 10:51am UTC](https://discuss.elastic.co/t/how-to-fetch-environment-varibles-in-kibana-plugin/290431 "2021-12-01T10:51:12Z")
Hi We are testing kibana plugin in 7.10.2. When we tried to used process.env.TEST\_VALUE in our code and run yarn build on kibana plugin and after unzip when we search for the TEST\_VALUE we get it in the below format in… --- ## [Fast vector highlighter (fvh) making searches slower](https://discuss.elastic.co/t/fast-vector-highlighter-fvh-making-searches-slower/290634)
**Author:** [@Pyppe](https://discuss.elastic.co/u/Pyppe)\ **Replies:** 6\ **Last updated:** [December 1, 2021, 10:45am UTC](https://discuss.elastic.co/t/fast-vector-highlighter-fvh-making-searches-slower/290634 "2021-12-01T10:45:04Z")
Hi! We recently improved our hit highlighting by utilizing fvh (Lucene Fast Vector Highlighter). The highlighting is done as follows: { "query": {...}, "highlight": { "fields": { "searchableName": { … --- ## [Kibana Reports Hammering CPU](https://discuss.elastic.co/t/kibana-reports-hammering-cpu/290546)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 10:20am UTC](https://discuss.elastic.co/t/kibana-reports-hammering-cpu/290546 "2021-12-01T10:20:37Z")
Hi, We recently upgraded our Elastic stack from 6.8 to 7.15 and one thing we've noticed is a pretty noticeable degradation in the performance of CSV reporting in Kibana; reports we were usually generating successfully i… --- ## [Does kibana generate report of sonarqube analysis?](https://discuss.elastic.co/t/does-kibana-generate-report-of-sonarqube-analysis/289256)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 10:15am UTC](https://discuss.elastic.co/t/does-kibana-generate-report-of-sonarqube-analysis/289256 "2021-12-01T10:15:04Z")
if i configure sonarqube with Elasticsearch. --- ## [Dec 1st, 2021: \[en\] The impact of Elasticsearch source filtering on performance](https://discuss.elastic.co/t/dec-1st-2021-en-the-impact-of-elasticsearch-source-filtering-on-performance/289181)
**Author:** [@Quentin\_Pradet](https://discuss.elastic.co/u/Quentin_Pradet)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-1st-2021-en-the-impact-of-elasticsearch-source-filtering-on-performance/289181 "2021-12-01T08:00:43Z")
:information\_source: Ce billet est aussi disponible en français : Dec 1st, 2021: \[fr\] L'impact du filtrage de champs sur les performances d'Elasticsearch A few years ago, I needed to retrieve many documents from Elastic… --- ## [Dec 1st, 2021: \[fr\] L'impact du filtrage de champs sur les performances d'Elasticsearch](https://discuss.elastic.co/t/dec-1st-2021-fr-limpact-du-filtrage-de-champs-sur-les-performances-delasticsearch/290560)
**Author:** [@Quentin\_Pradet](https://discuss.elastic.co/u/Quentin_Pradet)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-1st-2021-fr-limpact-du-filtrage-de-champs-sur-les-performances-delasticsearch/290560 "2021-12-01T08:00:43Z")
:information\_source: This post is also available in English: Dec 1st, 2021: \[en\] The impact of Elasticsearch source filtering on performance Il y a quelques années, je voulais récupérer de nombreux documents d'Elasticse… --- ## [How can i find document where the value of a field It is not repeated](https://discuss.elastic.co/t/how-can-i-find-document-where-the-value-of-a-field-it-is-not-repeated/290426)
**Author:** [@Alejandro\_Chaves](https://discuss.elastic.co/u/Alejandro_Chaves)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 8:36am UTC](https://discuss.elastic.co/t/how-can-i-find-document-where-the-value-of-a-field-it-is-not-repeated/290426 "2021-12-01T08:36:18Z")
Hello, im new in ELK and dont know how to find only the documents where the value of serviceName It is not repeated, just show me the document with the serviceName SLA\_D\_CARGA\_MODELO\_ACTIVO\_SSII\_testemail with the devtoo… --- ## [Visualize the last value](https://discuss.elastic.co/t/visualize-the-last-value/290641)
**Author:** [@carlos\_gomez\_gomez](https://discuss.elastic.co/u/carlos_gomez_gomez)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 9:57am UTC](https://discuss.elastic.co/t/visualize-the-last-value/290641 "2021-12-01T09:57:09Z")
Hi. I'm trying to make a visualitzacion of an scripted field. The value of the scripted field only can be 1 or 0 is like a boolean. I want to visualice a line graph. I have two questions about that. It its possible t… --- ## [Problem to create a TermsQuery using list of integers](https://discuss.elastic.co/t/problem-to-create-a-termsquery-using-list-of-integers/290644)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 9:40am UTC](https://discuss.elastic.co/t/problem-to-create-a-termsquery-using-list-of-integers/290644 "2021-12-01T09:40:02Z")
Good morning, I'm using the library nest in C# to write bool queries but I would like create a termsquery with a list of integers, like when I use strings: List\ hiValues = new List\(); … --- ## [\`kubernetes.volume.fs.used.pct\` has incorrect type in index template](https://discuss.elastic.co/t/kubernetes-volume-fs-used-pct-has-incorrect-type-in-index-template/290440)
**Author:** [@lepouletsuisse](https://discuss.elastic.co/u/lepouletsuisse)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 9:26am UTC](https://discuss.elastic.co/t/kubernetes-volume-fs-used-pct-has-incorrect-type-in-index-template/290440 "2021-12-01T09:26:28Z")
It seems that field kubernetes.volume.fs.used.pct has an incorrect type in the index template metrics-kubernetes.volume (automatically generated by metricbeat or fleet). The type specified by the template's mapping is l… --- ## [Filebeat incompatibility when upgrading elasticsearch](https://discuss.elastic.co/t/filebeat-incompatibility-when-upgrading-elasticsearch/290607)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 8:28am UTC](https://discuss.elastic.co/t/filebeat-incompatibility-when-upgrading-elasticsearch/290607 "2021-12-01T08:28:38Z")
Hi. We're currently testing an upgrade from Elasticsearch 6.8 to 7.15 and we noticed that when we upgrade the cluster, the Filebeat agents on some of our hosts can no longer write to the indices and we see the errors li… --- ## [Gpg: no valid OpenPGP data found](https://discuss.elastic.co/t/gpg-no-valid-openpgp-data-found/290633)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 7:23am UTC](https://discuss.elastic.co/t/gpg-no-valid-openpgp-data-found/290633 "2021-12-01T07:23:00Z")
Hi, I already have an ELK environment running at version 7.13, I'm trying to update to 7.15. But when trying to use the below command: wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - … --- ## [What is a good number of fields to have in an index?](https://discuss.elastic.co/t/what-is-a-good-number-of-fields-to-have-in-an-index/290618)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 7:53am UTC](https://discuss.elastic.co/t/what-is-a-good-number-of-fields-to-have-in-an-index/290618 "2021-12-01T07:53:19Z")
I am trying to manage the index and I would like to know how many fields must be present inside an index for it to have good performance. Currently, I have 6000 fields in my index but not all documents have 6000 fields i… --- ## [Cannot get Cisco Filebeat module to work](https://discuss.elastic.co/t/cannot-get-cisco-filebeat-module-to-work/289903)
**Author:** [@titan\_tm](https://discuss.elastic.co/u/titan_tm)\ **Replies:** 13\ **Last updated:** [December 1, 2021, 6:56am UTC](https://discuss.elastic.co/t/cannot-get-cisco-filebeat-module-to-work/289903 "2021-12-01T06:56:46Z")
Hello Team, I'm running on ELK 7.14.0 and I'm facing an issue with kibana dashboard and need your help. I have an ELK stack which gets logs from filebeat (cisco module) and sends them directly to Elasticsearch. It work… --- ## [Winlogbeat 7.15.1 with sysmon missing fields task and message on Windows Server 2022](https://discuss.elastic.co/t/winlogbeat-7-15-1-with-sysmon-missing-fields-task-and-message-on-windows-server-2022/289675)
**Author:** [@sytser](https://discuss.elastic.co/u/sytser)\ **Replies:** 9\ **Last updated:** [December 1, 2021, 6:55am UTC](https://discuss.elastic.co/t/winlogbeat-7-15-1-with-sysmon-missing-fields-task-and-message-on-windows-server-2022/289675 "2021-12-01T06:55:39Z")
The issue is that on a Windows Server 2022 version with Winlogbeat v7.15.1 and Sysmon v13.24. Some how on Windows Server 2022 Winlogbeat doesn't send the fields task and message to Logstash v7.15.2. If we use the same … --- ## [How to parse xml log inside of the json format in Logstash](https://discuss.elastic.co/t/how-to-parse-xml-log-inside-of-the-json-format-in-logstash/290006)
**Author:** [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\ **Replies:** 15\ **Last updated:** [December 1, 2021, 6:28am UTC](https://discuss.elastic.co/t/how-to-parse-xml-log-inside-of-the-json-format-in-logstash/290006 "2021-12-01T06:28:09Z")
I will receive a log that contained JSON and XML format I configurated the Logstash to receive TCP in JSON and used the filter when shown dateparsefailure in tags. The JSON part is able to extract, but the xml part can… --- ## [Elasticsearch wont run](https://discuss.elastic.co/t/elasticsearch-wont-run/290395)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 6:20am UTC](https://discuss.elastic.co/t/elasticsearch-wont-run/290395 "2021-12-01T06:20:27Z")
Hi dears I have upgraded the Elasticsearch and removed old version and copy all the new Elasticsearch parts in the same directory (upgrading ES 7.6.2 to 7.15.2) Unfortunately when I want to start the service with sysV … --- ## [Kibana Dashboard PDF and PNG reporting options missing](https://discuss.elastic.co/t/kibana-dashboard-pdf-and-png-reporting-options-missing/290407)
**Author:** [@Petteri](https://discuss.elastic.co/u/Petteri)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 6:15am UTC](https://discuss.elastic.co/t/kibana-dashboard-pdf-and-png-reporting-options-missing/290407 "2021-12-01T06:15:17Z")
Hi! We just updated our Elastic to 7.14 version and enabled reporting for users by this guide: Configure reporting in Kibana | Kibana Guide \[7.14\] | Elastic After update the PDF and PNG reporting options are not availa… --- ## ["environment: - xpack.security.enabled=true" does not work with docker-compose](https://discuss.elastic.co/t/environment-xpack-security-enabled-true-does-not-work-with-docker-compose/290389)
**Author:** [@tadashi.oya](https://discuss.elastic.co/u/tadashi.oya)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 5:20am UTC](https://discuss.elastic.co/t/environment-xpack-security-enabled-true-does-not-work-with-docker-compose/290389 "2021-12-01T05:20:49Z")
Hi, I'm trying to specify xpack.security.enabled as an environment variable for the Elasticsearch container in the docker-compose configuration of T-Pot, a honeypot framework. However, the following statement does not w… --- ## [Filebeat.yml can not convert String into Object](https://discuss.elastic.co/t/filebeat-yml-can-not-convert-string-into-object/290622)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 4:29am UTC](https://discuss.elastic.co/t/filebeat-yml-can-not-convert-string-into-object/290622 "2021-12-01T04:29:40Z")
Hello team, I am getting below error in filebeat.yml. I have commented all other lines and just added output.Elasticsearch Can anyone please help me here. output.elasticsearch: hosts =\> \["10.115.6.288:9200"\] [Previous page](https://discuss.elastic.co/latest.md?page=1366) [Next page](https://discuss.elastic.co/latest.md?page=1368)