# Latest **URL:** https://discuss.elastic.co/latest.md?page=1371 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1372 --- ## [Doc\_count value is mismatching when size is change](https://discuss.elastic.co/t/doc-count-value-is-mismatching-when-size-is-change/290053)
**Author:** [@nishar](https://discuss.elastic.co/u/nishar)\ **Replies:** 4\ **Last updated:** [November 29, 2021, 11:34am UTC](https://discuss.elastic.co/t/doc-count-value-is-mismatching-when-size-is-change/290053 "2021-11-29T11:34:09Z")
If we change size field in aggregations, doc\_count is mismatch. --- ## [Downgrade Elastic Search](https://discuss.elastic.co/t/downgrade-elastic-search/289286)
**Author:** [@Y\_MN](https://discuss.elastic.co/u/Y_MN)\ **Replies:** 8\ **Last updated:** [November 29, 2021, 11:03am UTC](https://discuss.elastic.co/t/downgrade-elastic-search/289286 "2021-11-29T11:03:48Z")
I need to upgrade ES from 7.10.2 to 7.14.1, and if something goes wrong, can I automatically roll back to the previous version? --- ## [Disable metrics logging in Elastic Agent managed by Fleet](https://discuss.elastic.co/t/disable-metrics-logging-in-elastic-agent-managed-by-fleet/290420)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 10:28am UTC](https://discuss.elastic.co/t/disable-metrics-logging-in-elastic-agent-managed-by-fleet/290420 "2021-11-29T10:28:39Z")
Hi All, We use Fleet managed Elastic Agent and have a lot of "Non-zero metrics in the last 30s" in our log that we want to remove. Is there a way to disable that logging? I see there is a new option in standalone elas… --- ## [Different .kibana\_\* indices After upgrading](https://discuss.elastic.co/t/different-kibana-indices-after-upgrading/289912)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [November 29, 2021, 9:42am UTC](https://discuss.elastic.co/t/different-kibana-indices-after-upgrading/289912 "2021-11-29T09:42:30Z")
Upgrade ELK stack from 7.13 to 7.15 I checked /\_cat/indices/.kibana?v\* health status index uuid pri rep docs.count docs.deleted store.size pri.store.size green open .kiban… --- ## [Anomaly on specific value (0)](https://discuss.elastic.co/t/anomaly-on-specific-value-0/290400)
**Author:** [@zangero98](https://discuss.elastic.co/u/zangero98)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 9:41am UTC](https://discuss.elastic.co/t/anomaly-on-specific-value-0/290400 "2021-11-29T09:41:12Z")
hello guys, (1) I want to make alerts with machine learning when a specific log source don't send any logs for 10 minutes (availability job). I tried it with low count and custom rules but there always showed up anomali… --- ## [Elasticserach not starting](https://discuss.elastic.co/t/elasticserach-not-starting/289965)
**Author:** [@zanoob](https://discuss.elastic.co/u/zanoob)\ **Replies:** 8\ **Last updated:** [November 29, 2021, 9:38am UTC](https://discuss.elastic.co/t/elasticserach-not-starting/289965 "2021-11-29T09:38:50Z")
One of my Elasticsearch nodes stopped the service and moved the master to another node. The logs do not show much info, why but rather just say master moved to a different node. \[2021-11-23T13:57:21,216\]\[INFO \]\[o.e.n.N… --- ## [Filebeat multiline pattern](https://discuss.elastic.co/t/filebeat-multiline-pattern/290414)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 9:36am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern/290414 "2021-11-29T09:36:51Z")
There are stacktrace starting with three different pattern:- 1-\[ERROR\] 2- \[ERROR\] 3-ERROR or 2021-11-26 00:01:20.563 what should be the multiline pattern for parsing lines or stack trace starting with above different… --- ## [Elastic stack rules](https://discuss.elastic.co/t/elastic-stack-rules/290413)
**Author:** [@oliviawang](https://discuss.elastic.co/u/oliviawang)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 9:31am UTC](https://discuss.elastic.co/t/elastic-stack-rules/290413 "2021-11-29T09:31:52Z")
Hi All, According to the document, I want to receive the notification only on status change, and already setting notify field for Only on Status change , but still receive a lot of same alerts.. Does any one have some … --- ## [Two different date formats from logs. Handle with one multiline.pattern?](https://discuss.elastic.co/t/two-different-date-formats-from-logs-handle-with-one-multiline-pattern/290402)
**Author:** [@alexander.jansson](https://discuss.elastic.co/u/alexander.jansson)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 8:19am UTC](https://discuss.elastic.co/t/two-different-date-formats-from-logs-handle-with-one-multiline-pattern/290402 "2021-11-29T08:19:01Z")
Hi, I'm trying to match two different time formats within different application logs (two out of five use ISO8601, the other three DD-MM-YYYY HH:mm:ss,mmm. I figured I'd be able to solve it like this: multiline.patt… --- ## [Can we use elastic Java apm agent with azure functions?](https://discuss.elastic.co/t/can-we-use-elastic-java-apm-agent-with-azure-functions/289891)
**Author:** [@vipinbit](https://discuss.elastic.co/u/vipinbit)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 8:12am UTC](https://discuss.elastic.co/t/can-we-use-elastic-java-apm-agent-with-azure-functions/289891 "2021-11-29T08:12:13Z")
Can we use elastic Java apm agent with Java based azure functions? If yes can you please point to right documentation for this, how to configure elastic Java apm agent for azure functions or some other cloud based servic… --- ## [Template mapping with one field](https://discuss.elastic.co/t/template-mapping-with-one-field/290311)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 7:18am UTC](https://discuss.elastic.co/t/template-mapping-with-one-field/290311 "2021-11-29T07:18:41Z")
Hi Experts, We are using multi fields Template mapping for some fields. example:- we are using attribute1 to attribute15 fields...for this we are set mapping for all individual fields with same property and data type. N… --- ## [Icinga integration with ELK](https://discuss.elastic.co/t/icinga-integration-with-elk/290397)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 7:10am UTC](https://discuss.elastic.co/t/icinga-integration-with-elk/290397 "2021-11-29T07:10:58Z")
Hello All / @widhalm\_t I need your suggestion/assistance here to send the logstash logs to Icinga for monitoring purpose. Let me explain you my environment and scenario. We are using ubuntu 20.4 I have ELK stack runn… --- ## [Bulk vs Single operations for 1 document](https://discuss.elastic.co/t/bulk-vs-single-operations-for-1-document/289522)
**Author:** [@LinHuiqing](https://discuss.elastic.co/u/LinHuiqing)\ **Replies:** 4\ **Last updated:** [November 29, 2021, 6:45am UTC](https://discuss.elastic.co/t/bulk-vs-single-operations-for-1-document/289522 "2021-11-29T06:45:09Z")
Hi, I understand that using bulk operations when there are many operations to be made brings performance benefits based on forums and documentation. However, how does a bulk operation with a single operation compare to s… --- ## ["include\_in\_root" option with wildcard field causes "illegal\_argument\_exception"](https://discuss.elastic.co/t/include-in-root-option-with-wildcard-field-causes-illegal-argument-exception/290353)
**Author:** [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 6:11am UTC](https://discuss.elastic.co/t/include-in-root-option-with-wildcard-field-causes-illegal-argument-exception/290353 "2021-11-29T06:11:43Z")
Hello, I tried to use "include\_in\_root" option with nesting wildcard field but got error. The Elasticsearch version is as follows: "version" : { "number" : "7.15.2", "build\_flavor" : "default", "build\_type… --- ## [Synonyms relevance help](https://discuss.elastic.co/t/synonyms-relevance-help/290172)
**Author:** [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\ **Replies:** 6\ **Last updated:** [November 29, 2021, 5:38am UTC](https://discuss.elastic.co/t/synonyms-relevance-help/290172 "2021-11-29T05:38:40Z")
HI, I am trying to configured synonyms in Elasticsearch and done the sample configuration as well. But not getting expected relevancy when i am searching data. Below is index Mapping configuration: PUT /test\_index { … --- ## [Rally Benchmark - Which race/benchmark to use for performance testing](https://discuss.elastic.co/t/rally-benchmark-which-race-benchmark-to-use-for-performance-testing/289994)
**Author:** [@mmadhana](https://discuss.elastic.co/u/mmadhana)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 4:55am UTC](https://discuss.elastic.co/t/rally-benchmark-which-race-benchmark-to-use-for-performance-testing/289994 "2021-11-29T04:55:57Z")
Hi, I am using Rally on ECK to test the performance of my hardware - CPU cores/memory, storage, and network usage. Which benchmark/race is compute-intensive and has a mix of indexing and concurrent search workload? I use… --- ## [Reading data from MS-SQL](https://discuss.elastic.co/t/reading-data-from-ms-sql/290391)
**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 4:49am UTC](https://discuss.elastic.co/t/reading-data-from-ms-sql/290391 "2021-11-29T04:49:11Z")
Dear All, Good morning I am trying to configure ES Kibana to read the data from MS-SQL to the Kibana dashboard, on the option of "adding data", we can see the option of "Microsoft SQL Server Metrics " , this option gi… --- ## [Human Readable Duration - Remove Day Format](https://discuss.elastic.co/t/human-readable-duration-remove-day-format/290108)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 10\ **Last updated:** [November 29, 2021, 4:48am UTC](https://discuss.elastic.co/t/human-readable-duration-remove-day-format/290108 "2021-11-29T04:48:39Z")
Hi, I would like to use the human-readable duration but report seconds, minutes and hours only. For example, I want to see 24 hours instead of 1 day. Is this possible? Thanks in advance, Matt --- ## [Elastic support diagnostics, Scrub.bat -c parameter](https://discuss.elastic.co/t/elastic-support-diagnostics-scrub-bat-c-parameter/290254)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 4:46am UTC](https://discuss.elastic.co/t/elastic-support-diagnostics-scrub-bat-c-parameter/290254 "2021-11-29T04:46:54Z")
Contains an example /scrub.sh -i '/Users/adminuser/diagnostic output/diagnostics-20180621-161231.zip' -o /home/adminuser/sanitized-diags -c /home/adminuser/sanitized-diags/scrub.yml What is the -c parameter? scrub.b… --- ## [Logstash doc has same breaking changes across multiple versions](https://discuss.elastic.co/t/logstash-doc-has-same-breaking-changes-across-multiple-versions/290259)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 2:52am UTC](https://discuss.elastic.co/t/logstash-doc-has-same-breaking-changes-across-multiple-versions/290259 "2021-11-29T02:52:35Z")
Hello. I was reviewing breaking changes on doc for my upgrade but realized all the changes are same from 7.13 to 7.15 . Should I interpret as "these changes should be aware between ANY version" or something else ? … --- ## [Only showing Postgres START and COMMIT but not Query (Node/Express/Postgresql)](https://discuss.elastic.co/t/only-showing-postgres-start-and-commit-but-not-query-node-express-postgresql/290378)
**Author:** [@Jeremy\_Gillick](https://discuss.elastic.co/u/Jeremy_Gillick)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 10:57pm UTC](https://discuss.elastic.co/t/only-showing-postgres-start-and-commit-but-not-query-node-express-postgresql/290378 "2021-11-28T22:57:40Z")
I'm setting up Cloud Elastic APM with a node/express/postgres server. The web requests are coming in as expected, however, only the postgresql START and COMMIT commands from the transactions are being shown but not the q… --- ## [Mutiple - files in tmp](https://discuss.elastic.co/t/mutiple-files-in-tmp/290358)
**Author:** [@msalem](https://discuss.elastic.co/u/msalem)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 11:03pm UTC](https://discuss.elastic.co/t/mutiple-files-in-tmp/290358 "2021-11-28T23:03:32Z")
Hello support, I have a folder with mutiple files generated there. -folder1 ---- tmp1 ---- tmp2 ---- etc. each file like tmp1, will have mutiple lines. how do Load each file as a message instead of reading each li… --- ## [Looking for a way to ingest a file and remove it](https://discuss.elastic.co/t/looking-for-a-way-to-ingest-a-file-and-remove-it/290343)
**Author:** [@hagaluly](https://discuss.elastic.co/u/hagaluly)\ **Replies:** 3\ **Last updated:** [November 28, 2021, 10:38pm UTC](https://discuss.elastic.co/t/looking-for-a-way-to-ingest-a-file-and-remove-it/290343 "2021-11-28T22:38:40Z")
i created a logstash conf file while back and it ingest the filr and removed it. back at the time i did not wanted this behavior but now i do... i only forgot how to do it :slight\_smile: can someone direct me to the c… --- ## [How to check the user details who delete the pipeline from Kibana or elasticseach](https://discuss.elastic.co/t/how-to-check-the-user-details-who-delete-the-pipeline-from-kibana-or-elasticseach/290276)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 9:43pm UTC](https://discuss.elastic.co/t/how-to-check-the-user-details-who-delete-the-pipeline-from-kibana-or-elasticseach/290276 "2021-11-28T21:43:01Z")
Hello Everyone, We have situation that someone has deleted one of our Logstash pipeline from kibana (centrally managing from kibana) around 30 days back but we have noticed recently. Is there a possibility to check the… --- ## [How to get service status information from kafka connectors](https://discuss.elastic.co/t/how-to-get-service-status-information-from-kafka-connectors/290289)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 1:13pm UTC](https://discuss.elastic.co/t/how-to-get-service-status-information-from-kafka-connectors/290289 "2021-11-26T13:13:16Z")
Hello, I have three kafka brokers take/ write data from everywhere into topics, after that filebeat kafka-connectors index all topics data into Elasticsearch indexes. My question is, are there any easy ways to get logs … --- ## [Indexing large number of transcripts](https://discuss.elastic.co/t/indexing-large-number-of-transcripts/290373)
**Author:** [@Chris\_Schutte](https://discuss.elastic.co/u/Chris_Schutte)\ **Replies:** 0\ **Last updated:** [November 28, 2021, 8:07pm UTC](https://discuss.elastic.co/t/indexing-large-number-of-transcripts/290373 "2021-11-28T20:07:13Z")
Hi all, I am new to elastic and have a modelling question. We have a large number of conversation transcripts and would like to index those using elastic. We have the identity of the speaker for each paragraph of the … --- ## [Docker swarm deployment: master\_not\_discovered\_exception](https://discuss.elastic.co/t/docker-swarm-deployment-master-not-discovered-exception/290348)
**Author:** [@AlanSBN](https://discuss.elastic.co/u/AlanSBN)\ **Replies:** 4\ **Last updated:** [November 28, 2021, 7:24pm UTC](https://discuss.elastic.co/t/docker-swarm-deployment-master-not-discovered-exception/290348 "2021-11-28T19:24:14Z")
I am basing my deployment off of the docker-compose.yml file found here. My modified yml file is pasted below. The docker swarm gets all three services running (only one replicated container per service) but the logs … --- ## [Curator Space filter not working correctly on small indexes](https://discuss.elastic.co/t/curator-space-filter-not-working-correctly-on-small-indexes/290370)
**Author:** [@Greg12](https://discuss.elastic.co/u/Greg12)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 5:55pm UTC](https://discuss.elastic.co/t/curator-space-filter-not-working-correctly-on-small-indexes/290370 "2021-11-28T17:55:49Z")
I am trying to avoid reindexing larger indexes but the curator space filter seems to not see the space properly. I think it may have issues with indexes that are less than 1GB. What calls does curator make to get index … --- ## [Why my @timestamp shows wrong hour when overwritten?](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368)
**Author:** [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\ **Replies:** 2\ **Last updated:** [November 28, 2021, 5:32pm UTC](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368 "2021-11-28T17:32:01Z")
echo "Nov 25 11:12:15 test message goes here" | /usr/share/logstash/bin/logstash -e 'input { stdin {} } filter { grok { keep\_empty\_captures =\> true match =\> { "message" =\> "^(?\%{SYSLOGTIMESTAMP:t… --- ## [Query OK in JDBC\_Stream But Not In JDBC\_Static?](https://discuss.elastic.co/t/query-ok-in-jdbc-stream-but-not-in-jdbc-static/290362)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 3\ **Last updated:** [November 28, 2021, 5:29pm UTC](https://discuss.elastic.co/t/query-ok-in-jdbc-stream-but-not-in-jdbc-static/290362 "2021-11-28T17:29:40Z")
Hey, I have a query which works fine while using the JDBC steam "statement" but it does not seem to work while using JDBC static. Here's my JDBC\_Stream configuration: filter { jdbc\_streaming { jdbc\_driver\_class =\>… [Previous page](https://discuss.elastic.co/latest.md?page=1370) [Next page](https://discuss.elastic.co/latest.md?page=1372)