# Latest **URL:** https://discuss.elastic.co/latest.md?page=1410 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1411 --- ## [Не работает алертинг](https://discuss.elastic.co/t/topic/287589)
**Author:** [@Dalador](https://discuss.elastic.co/u/Dalador)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 1:54pm UTC](https://discuss.elastic.co/t/topic/287589 "2021-10-29T13:54:32Z")
Всем привет. Столкнулся с проблемой. Поднял ELK на Docker, настроил SSL на TLS, http. Алерты не приходят, хотя когда делаю предпросмотр результатов - хиты отображает. (Когда пытаюсь воссоздать алерт, алерт не приходит н… --- ## [Elasticsearch SIEM is not working, but EQL query is ok](https://discuss.elastic.co/t/elasticsearch-siem-is-not-working-but-eql-query-is-ok/287590)
**Author:** [@Dalador](https://discuss.elastic.co/u/Dalador)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-siem-is-not-working-but-eql-query-is-ok/287590 "2021-10-29T13:54:11Z")
I got some problems with my ELK running on docker. I made ssl on tls and http and tryied to make simple EQL-query: sequence by winlog.computer\_name \[iam where event.code == "4720"\] \[iam where event.code == "4726"\] Wh… --- ## [Transform API update documents already inserted](https://discuss.elastic.co/t/transform-api-update-documents-already-inserted/288006)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 0\ **Last updated:** [October 29, 2021, 1:40pm UTC](https://discuss.elastic.co/t/transform-api-update-documents-already-inserted/288006 "2021-10-29T13:40:56Z")
Hey I am facing a big issue as we are going to production using Transform API. What we are facing is the aggregation calculated with a transform API are updated once a term aggregation already exist in the destination in… --- ## [How to boost results on the basis of fields values](https://discuss.elastic.co/t/how-to-boost-results-on-the-basis-of-fields-values/287826)
**Author:** [@Ashutosh\_Dwivedi](https://discuss.elastic.co/u/Ashutosh_Dwivedi)\ **Replies:** 7\ **Last updated:** [October 29, 2021, 1:10pm UTC](https://discuss.elastic.co/t/how-to-boost-results-on-the-basis-of-fields-values/287826 "2021-10-29T13:10:12Z")
Hi Everyone, I have stuck into creating query for a specific problem. Can anyone please help me ? I have these list of products \[ { "name":"pro", "clickCount":110, "bookingCount":57, "isPromoted":0 }, { "na… --- ## [Distance\_feature and optimal pagination?](https://discuss.elastic.co/t/distance-feature-and-optimal-pagination/287949)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 5:44pm UTC](https://discuss.elastic.co/t/distance-feature-and-optimal-pagination/287949 "2021-10-28T17:44:52Z")
I want to implement pagination over a search query that uses the distance\_feature using location and time and implement pagination. Now because each request is unique in terms of it's location and time the sorting will … --- ## [Store time lapsed between two events](https://discuss.elastic.co/t/store-time-lapsed-between-two-events/287991)
**Author:** [@Frederick\_Faria](https://discuss.elastic.co/u/Frederick_Faria)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:15pm UTC](https://discuss.elastic.co/t/store-time-lapsed-between-two-events/287991 "2021-10-29T12:15:24Z")
I need to store a time duration two events and have as in HH:mm:ss.SSS. I tried using Date type with basic\_time format but it do now allows me to save more than 23 hours. How would you recommend to proceed in this case? … --- ## [Multi\_match to return exact results for single word criteria](https://discuss.elastic.co/t/multi-match-to-return-exact-results-for-single-word-criteria/287995)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 0\ **Last updated:** [October 29, 2021, 11:59am UTC](https://discuss.elastic.co/t/multi-match-to-return-exact-results-for-single-word-criteria/287995 "2021-10-29T11:59:36Z")
Hello, have simple use-case: find certain word in any field of a document (through whole index). However, getting back (many!) false positive documents, also? Documents don't contain the word submitted in multi\_match cr… --- ## [Bulk Upsert isn't Importing All Records](https://discuss.elastic.co/t/bulk-upsert-isnt-importing-all-records/287011)
**Author:** [@selectedpixel](https://discuss.elastic.co/u/selectedpixel)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 11:44am UTC](https://discuss.elastic.co/t/bulk-upsert-isnt-importing-all-records/287011 "2021-10-29T11:44:17Z")
I'm doing a bulk upsert using the Elasticsearch NodeJS library Helper classes. const response = await ELSClient.helpers.bulk({ concurrency: 20, datasource: data, onDocument (doc) { return \[{ up… --- ## [Aggregate filter plugin - timeout function bug](https://discuss.elastic.co/t/aggregate-filter-plugin-timeout-function-bug/286383)
**Author:** [@MarcelOs](https://discuss.elastic.co/u/MarcelOs)\ **Replies:** 6\ **Last updated:** [October 29, 2021, 7:22am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-timeout-function-bug/286383 "2021-10-29T07:22:44Z")
Hello everyone, I have some problems with the Timeout command from the aggregate filter plugin. I want to create a script that calculates the meantime between two log entries. There are examples of such a function (http… --- ## [Java OutOfMemory when synchronizing initially huge resultsets from Oracle via logstash jdbc to Elastic](https://discuss.elastic.co/t/java-outofmemory-when-synchronizing-initially-huge-resultsets-from-oracle-via-logstash-jdbc-to-elastic/287984)
**Author:** [@di.loh](https://discuss.elastic.co/u/di.loh)\ **Replies:** 0\ **Last updated:** [October 29, 2021, 9:40am UTC](https://discuss.elastic.co/t/java-outofmemory-when-synchronizing-initially-huge-resultsets-from-oracle-via-logstash-jdbc-to-elastic/287984 "2021-10-29T09:40:54Z")
We are getting Java OutOfMemory during initial loading a huge dataset of ~70 Mio records with Logstash and jdbc into Elastic. It seems, the problem starts when using use\_prepared\_statements =\> true. Java Heapsize is 4GB… --- ## [Failed to initialize SSL TrustManager](https://discuss.elastic.co/t/failed-to-initialize-ssl-trustmanager/287667)
**Author:** [@porscheme](https://discuss.elastic.co/u/porscheme)\ **Replies:** 2\ **Last updated:** [October 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/failed-to-initialize-ssl-trustmanager/287667 "2021-10-29T09:52:48Z")
ES Version 7.12 AKS: 1:20.7 Certificate passwords added elastic keystore and value verified xpack.security.transport.ssl.keystore.secure\_password xpack.security.transport.ssl.truststore.secure\_password xpack settings … --- ## [CircuitBreakingException (Heap size issue)](https://discuss.elastic.co/t/circuitbreakingexception-heap-size-issue/287985)
**Author:** [@Balaji\_Arun](https://discuss.elastic.co/u/Balaji_Arun)\ **Replies:** 0\ **Last updated:** [October 29, 2021, 9:43am UTC](https://discuss.elastic.co/t/circuitbreakingexception-heap-size-issue/287985 "2021-10-29T09:43:10Z")
Hi everyone, I'm facing a issue with heap size don't know how to increase it tried changing the env var in the kube config (using Kubernetes for deployment ) but it struck at applying changes phase thanks in advance … --- ## [JDBC Logstash with SystemD](https://discuss.elastic.co/t/jdbc-logstash-with-systemd/287979)
**Author:** [@sastorsl](https://discuss.elastic.co/u/sastorsl)\ **Replies:** 2\ **Last updated:** [October 29, 2021, 8:52am UTC](https://discuss.elastic.co/t/jdbc-logstash-with-systemd/287979 "2021-10-29T08:52:35Z")
Setup logstash jdbc-input, and wanted to use the default Oracle TNS Names lookup instead of storing the JDBC connect string directly in the logstash configuration. Basically the JDBC connect string can be very long, and… --- ## [How to scale up the cache file size when we scale up the disk size?](https://discuss.elastic.co/t/how-to-scale-up-the-cache-file-size-when-we-scale-up-the-disk-size/287747)
**Author:** [@gaobinlong](https://discuss.elastic.co/u/gaobinlong)\ **Replies:** 5\ **Last updated:** [October 29, 2021, 8:40am UTC](https://discuss.elastic.co/t/how-to-scale-up-the-cache-file-size-when-we-scale-up-the-disk-size/287747 "2021-10-29T08:40:09Z")
Our es clusters are deployed in cloud, and the cloud disk is very easy to scale up it's size. We found that the size of the local cache file shared\_snapshot\_cache on the dedicated frozen node didn't change when we scale… --- ## [Not able to generate fields.yml files](https://discuss.elastic.co/t/not-able-to-generate-fields-yml-files/287970)
**Author:** [@Paurav\_Thakkar](https://discuss.elastic.co/u/Paurav_Thakkar)\ **Replies:** 0\ **Last updated:** [October 29, 2021, 5:32am UTC](https://discuss.elastic.co/t/not-able-to-generate-fields-yml-files/287970 "2021-10-29T05:32:16Z")
Hi, I am trying to create a new custom module and I have created a input file that is taking input from an api in json format and in the pipeline.json file I have added the processors that I think are necessary. But when… --- ## [Logstashで複数の種類のログを一つのパイプラインで処理したい](https://discuss.elastic.co/t/logstash/287869)
**Author:** [@kapibara824](https://discuss.elastic.co/u/kapibara824)\ **Replies:** 2\ **Last updated:** [October 29, 2021, 4:51am UTC](https://discuss.elastic.co/t/logstash/287869 "2021-10-29T04:51:25Z")
同一パイプラインで複数の種類のログを処理したいです。 具体的に言うと同じfilebeatでタグ等で分けずにlogstashに送信し、 grokを書いてAのパターンにマッチするログはそこで処理し、AにマッチせずBパターンにマッチするログはそこで処理し...みたいな感じでやりたいです ログの配置上フォーマットごとにタグ分けやfilebeatを分けると言ったことが難しいので上記のやり方もしくは別のやり方でいい方法があれば教えていただきた… --- ## [Elasticsearch CPU utilization problem with Logstash](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-problem-with-logstash/287903)
**Author:** [@Hur](https://discuss.elastic.co/u/Hur)\ **Replies:** 2\ **Last updated:** [October 29, 2021, 2:34am UTC](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-problem-with-logstash/287903 "2021-10-29T02:34:19Z")
I have trouble with using Elasticsearch with Logstash. When inserting data to ES through Logstash (not using Filebeat. Elasticsearch & Logstash only), CPU utilization of ES is over 90%. Also, I expected if I use multip… --- ## [Date型を文字列型に変換する方法について](https://discuss.elastic.co/t/date/287866)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 2\ **Last updated:** [October 29, 2021, 1:26am UTC](https://discuss.elastic.co/t/date/287866 "2021-10-29T01:26:46Z")
とあるdate型のフィールドについて、date型のフィールドは保持しつつ、同じ値を文字列型のフィールドにも保持したいです。 ■logstashのconfファイル input { ～省略～ } filter { json { source =\> "message" } date { match =\> \["timestamp", "UNIX\_MS"\] target =\> "timestamp\_cloudwatch"… --- ## [What could cause this error following enterprise-search restart?](https://discuss.elastic.co/t/what-could-cause-this-error-following-enterprise-search-restart/287966)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 1:03am UTC](https://discuss.elastic.co/t/what-could-cause-this-error-following-enterprise-search-restart/287966 "2021-10-29T01:03:33Z")
I followed these steps for the installation. Copying and pasting these lines into Elasticsearch, kibana and enterprise-search yaml files Changed the permissions of var/log/enterprise-search folder and contents (see … --- ## [Geo Coordinate Mapping](https://discuss.elastic.co/t/geo-coordinate-mapping/287956)
**Author:** [@workenehg](https://discuss.elastic.co/u/workenehg)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 1:02am UTC](https://discuss.elastic.co/t/geo-coordinate-mapping/287956 "2021-10-29T01:02:41Z")
Currently in the process of indexing data from Oracle and one of the properties is a "Coordinate" . we would like to be able to do a geo search on the field but since it is currently added as "long" as shown below , we … --- ## [Kibana log](https://discuss.elastic.co/t/kibana-log/287896)
**Author:** [@li\_li](https://discuss.elastic.co/u/li_li)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:35am UTC](https://discuss.elastic.co/t/kibana-log/287896 "2021-10-29T00:35:18Z")
Hello, I am new to Kibana. I would like to know how long this log can be stored and what is the maximum capacity of the Kibana container? --- ## [Elasticsearch slowness and frequently nodes are restarting](https://discuss.elastic.co/t/elasticsearch-slowness-and-frequently-nodes-are-restarting/287909)
**Author:** [@muralikri](https://discuss.elastic.co/u/muralikri)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:34am UTC](https://discuss.elastic.co/t/elasticsearch-slowness-and-frequently-nodes-are-restarting/287909 "2021-10-29T00:34:57Z")
Hi Team, We have recently upgraded Elasticsearch from 6.6.1 to 7.13.2 with platinum licence. After upgraded all looks fine and when 3-4 users try to search logs parallelly we getting 504 error and when i check cluster s… --- ## [Adding new documents to production cluster](https://discuss.elastic.co/t/adding-new-documents-to-production-cluster/287910)
**Author:** [@lacerated](https://discuss.elastic.co/u/lacerated)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:34am UTC](https://discuss.elastic.co/t/adding-new-documents-to-production-cluster/287910 "2021-10-29T00:34:32Z")
I have constantly used Elasticsearch cluster with search queries. Once a week i get a batch of new documents i need to add to index. If i add them to index it will greatly slower search speeds while indexing and merging … --- ## [Get log not in right time](https://discuss.elastic.co/t/get-log-not-in-right-time/287916)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:32am UTC](https://discuss.elastic.co/t/get-log-not-in-right-time/287916 "2021-10-29T00:32:38Z")
I got log of Apache (access.log). But I never get it at the right time. Example like this pic. The time in the Elastic with the time in Apache server I set up the same timezone. And Apache has log at that time too. W… --- ## [Startup script?](https://discuss.elastic.co/t/startup-script/287923)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:32am UTC](https://discuss.elastic.co/t/startup-script/287923 "2021-10-29T00:32:18Z")
Is there some way to create startup scripts? I'm using monstache to connect mongodb and Elasticsearch and I need to add an index template before monstache starts syncing data. --- ## [Sudden High CPU with GC](https://discuss.elastic.co/t/sudden-high-cpu-with-gc/287908)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:31am UTC](https://discuss.elastic.co/t/sudden-high-cpu-with-gc/287908 "2021-10-29T00:31:42Z")
Hi Team Please refer to the screenshot and we observe high CPU spikes with the GC. Please help us resolve this. ELS v 7.5.2 RAM: Total 32 GB, 16GB allocated to ES It's a 7 node cluster --- ## [Killing pending tasks](https://discuss.elastic.co/t/killing-pending-tasks/287795)
**Author:** [@lucien.guillermin](https://discuss.elastic.co/u/lucien.guillermin)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:29am UTC](https://discuss.elastic.co/t/killing-pending-tasks/287795 "2021-10-29T00:29:33Z")
Hi everyone, We work on an Elasticsearch cluster which seems locked. We found out that we have critical tasks we launched a few days ago : curl -X GET 10.129.28.194:9200/\_cluster/pending\_tasks?pretty { "tasks" : \[ … --- ## [Additing Conditions to API Results](https://discuss.elastic.co/t/additing-conditions-to-api-results/287594)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:28am UTC](https://discuss.elastic.co/t/additing-conditions-to-api-results/287594 "2021-10-29T00:28:15Z")
I was wondering if there is any way to filter API results in Dev Tools to show conditions. For example, instead of this: GET \_cat/shards?v=true&h=index,shard,prirep,state,docs,store,node,segments.count,unassigned.detail… --- ## [Api\_key does not work behind reverse ssl proxy](https://discuss.elastic.co/t/api-key-does-not-work-behind-reverse-ssl-proxy/287945)
**Author:** [@gkiesecker](https://discuss.elastic.co/u/gkiesecker)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:08am UTC](https://discuss.elastic.co/t/api-key-does-not-work-behind-reverse-ssl-proxy/287945 "2021-10-29T00:08:08Z")
This is my first time using ELK stack, and I have found it very useful. I wanted to deploy it behind a reverse ssl proxy using nginx, and have most of the features working fine. However, I am unable to get the xpack.sec… --- ## [ADVICE For loadbalance](https://discuss.elastic.co/t/advice-for-loadbalance/287957)
**Author:** [@Tombal](https://discuss.elastic.co/u/Tombal)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 10:24pm UTC](https://discuss.elastic.co/t/advice-for-loadbalance/287957 "2021-10-28T22:24:35Z")
Hello there , I will get syslog messages from firewall devices and send them to kafka as a producer. Because there may be several consumers which will consume events so they may be on different offsets. Now my questio… [Previous page](https://discuss.elastic.co/latest.md?page=1409) [Next page](https://discuss.elastic.co/latest.md?page=1411)