# Latest **URL:** https://discuss.elastic.co/latest.md?page=1432 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1433 --- ## [Filebeat installed as Daemon Set in IBM Private Cloud Kubernetes Cluster don't send logs to Elastic Cloud instance](https://discuss.elastic.co/t/filebeat-installed-as-daemon-set-in-ibm-private-cloud-kubernetes-cluster-dont-send-logs-to-elastic-cloud-instance/184406)
**Author:** [@l.rava](https://discuss.elastic.co/u/l.rava)\ **Replies:** 4\ **Last updated:** [October 15, 2021, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-installed-as-daemon-set-in-ibm-private-cloud-kubernetes-cluster-dont-send-logs-to-elastic-cloud-instance/184406 "2021-10-15T13:31:20Z")
Hi I installed as Daemon Set metricBeat and fileBeat into my infrastracture: IBM Private Cloud kubernetes cluster - 2 nodes - v.1.13 following this guide. MetricBeat send data without problem. Filebeat don't send da… --- ## [Aggregation after rescore](https://discuss.elastic.co/t/aggregation-after-rescore/286833)
**Author:** [@SantaDiver](https://discuss.elastic.co/u/SantaDiver)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 12:47pm UTC](https://discuss.elastic.co/t/aggregation-after-rescore/286833 "2021-10-15T12:47:50Z")
Hello! I am trying to build ecommerce search engine with facets using Elasticsearch. I am using Elasticsearch-ltr plugin, which provides me possibility to rescore documents using machine learning formula. I want to cut … --- ## [In Vega, Filter one data table by another data table's contents](https://discuss.elastic.co/t/in-vega-filter-one-data-table-by-another-data-tables-contents/286747)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 12:16pm UTC](https://discuss.elastic.co/t/in-vega-filter-one-data-table-by-another-data-tables-contents/286747 "2021-10-15T12:16:11Z")
Hello, I am trying to determine how I could filter data tables based on another tables contents. e.g. Lets assume I have two tables; Table A that has items 1,3,5, and 7 in it. and Table B that has items 1,2,3,4,5, and… --- ## [Random node frequently removed from the cluster](https://discuss.elastic.co/t/random-node-frequently-removed-from-the-cluster/286296)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 11\ **Last updated:** [October 11, 2021, 9:58am UTC](https://discuss.elastic.co/t/random-node-frequently-removed-from-the-cluster/286296 "2021-10-11T09:58:32Z")
I found different node removed from cluster in last month, sometimes it happens 10 times a day. ES version is 7.6.2, and there are 5000+ shards, 6 data nodes with 30gb heap size, and another 3 master node in the cluster… --- ## [Elasticsearch huge CPU utilisation](https://discuss.elastic.co/t/elasticsearch-huge-cpu-utilisation/286707)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 6\ **Last updated:** [October 15, 2021, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-huge-cpu-utilisation/286707 "2021-10-15T11:10:02Z")
Hello, We have ELK Stack in our Company. Last time I had stability issues with Elasticsearch - meaning Elasticsearch was running after restart and after 3 hours was hung. Right now I see java process in Elasticsearch … --- ## [Optional field for boosting results score](https://discuss.elastic.co/t/optional-field-for-boosting-results-score/286805)
**Author:** [@Sodium](https://discuss.elastic.co/u/Sodium)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 11:01am UTC](https://discuss.elastic.co/t/optional-field-for-boosting-results-score/286805 "2021-10-15T11:01:18Z")
Hello, I currently have this request: 'query' =\> 'multi\_match' =\> \[ 'query' =\> $queryString, 'type' =\> 'bool\_prefix', 'fields' =\> \[ 'label^3', 'categories\_lis… --- ## [Threat Intel filebeat module](https://discuss.elastic.co/t/threat-intel-filebeat-module/283979)
**Author:** [@SiRVaNdO](https://discuss.elastic.co/u/SiRVaNdO)\ **Replies:** 9\ **Last updated:** [October 15, 2021, 10:50am UTC](https://discuss.elastic.co/t/threat-intel-filebeat-module/283979 "2021-10-15T10:50:08Z")
Hello everyone, I installed a filebeat with the threat intel module and it's importing threat intel data to the Elasticsearch. When I visit the feeds dashboards all is working properly. The problem comes when I tried t… --- ## [Can I update a pivot Transform's aggregation script?](https://discuss.elastic.co/t/can-i-update-a-pivot-transforms-aggregation-script/286740)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 10:34am UTC](https://discuss.elastic.co/t/can-i-update-a-pivot-transforms-aggregation-script/286740 "2021-10-15T10:34:38Z")
I have a transform with a scripted metric aggregation. I need to change how some fields are being calculated and I need to drop a few fields. However, the update API doesn't appear to support updating the transform's agg… --- ## [.startsWith Implementation](https://discuss.elastic.co/t/startswith-implementation/286489)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 9:33am UTC](https://discuss.elastic.co/t/startswith-implementation/286489 "2021-10-15T09:33:47Z")
Need to know proper implementation of startsWith for the url for the script to run in all the 4 cases of document. Error comes for startsWith when runnned. SCRIPT:- POST \_ingest/pipeline/\_simulate { "pipeline": { … --- ## [Help needed using a column of results returned in a second query (Chained input)](https://discuss.elastic.co/t/help-needed-using-a-column-of-results-returned-in-a-second-query-chained-input/286809)
**Author:** [@SamHunt](https://discuss.elastic.co/u/SamHunt)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 9:00am UTC](https://discuss.elastic.co/t/help-needed-using-a-column-of-results-returned-in-a-second-query-chained-input/286809 "2021-10-15T09:00:52Z")
Help needed using a column of results returned in a second query (Chained input). I'm aware of an example in the docs showing chained input but it does not seem to work or be suitable for adaptation. I would like the f… --- ## [Strange results in score calculation App Search](https://discuss.elastic.co/t/strange-results-in-score-calculation-app-search/286350)
**Author:** [@sanderunive](https://discuss.elastic.co/u/sanderunive)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 8:58am UTC](https://discuss.elastic.co/t/strange-results-in-score-calculation-app-search/286350 "2021-10-15T08:58:25Z")
Hi all, thanks for taking the time to read my question. Quite new to the App Search, our Dutch insurance company just went live with the 7.14.1 version. We are checking search terms and desired results and in that proce… --- ## [onQueryPhase listener org.elasticsearch.index.SearchSlowLog fails with NullpointerException](https://discuss.elastic.co/t/onqueryphase-listener-org-elasticsearch-index-searchslowlog-fails-with-nullpointerexception/286726)
**Author:** [@Harald\_Bittermann](https://discuss.elastic.co/u/Harald_Bittermann)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 8:13am UTC](https://discuss.elastic.co/t/onqueryphase-listener-org-elasticsearch-index-searchslowlog-fails-with-nullpointerexception/286726 "2021-10-15T08:13:34Z")
Within the last month we are seeing the following exceptions like the one below more and more often on one of our clusters. \[2021-10-12T12:38:45,944 UTC\]\[WARN \]\[o.e.i.s.IndexShard \] \[10.180.253.11\] \[visit-global-l… --- ## [What happens if 2 of 5 data nodes are down?](https://discuss.elastic.co/t/what-happens-if-2-of-5-data-nodes-are-down/286019)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 7:04am UTC](https://discuss.elastic.co/t/what-happens-if-2-of-5-data-nodes-are-down/286019 "2021-10-15T07:04:32Z")
Dear community, what does happen if in an Elasticsearch cluster 2 of 5 data nodes are down, data is still incoming via logstash and daily indices are used (cluster version 7.8.1)? For example the nodes are down for max … --- ## [Elsticsearch, do POST, GET Requests between custom plugins with the nodeClient](https://discuss.elastic.co/t/elsticsearch-do-post-get-requests-between-custom-plugins-with-the-nodeclient/286795)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 6:30am UTC](https://discuss.elastic.co/t/elsticsearch-do-post-get-requests-between-custom-plugins-with-the-nodeclient/286795 "2021-10-15T06:30:05Z")
I have two plugins in ES, and I want one of them to send GET/POST requests to the other using the nodeCLient, how can I do that? --- ## [No cached mapping for this field!](https://discuss.elastic.co/t/no-cached-mapping-for-this-field/286684)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 5\ **Last updated:** [October 15, 2021, 5:39am UTC](https://discuss.elastic.co/t/no-cached-mapping-for-this-field/286684 "2021-10-15T05:39:44Z")
I tried the management -\> index pattern and hit refreshed button still I am not getting these fields. In the discover window, I am seeing these fields with warning tags but I am not getting these fields while using in… --- ## [Cluster returns 200 to queries even if entire shards are unavailable](https://discuss.elastic.co/t/cluster-returns-200-to-queries-even-if-entire-shards-are-unavailable/286432)
**Author:** [@Mon48](https://discuss.elastic.co/u/Mon48)\ **Replies:** 11\ **Last updated:** [October 15, 2021, 5:16am UTC](https://discuss.elastic.co/t/cluster-returns-200-to-queries-even-if-entire-shards-are-unavailable/286432 "2021-10-15T05:16:31Z")
I'm working with about 80 instances, and a index of 2TB and 50 shards with 1 replica However for some reason from time to time the cluster collapses (still root causing this) As you can see from the image, instances… --- ## [CountAsync can't consume descriptor like SearchAsync](https://discuss.elastic.co/t/countasync-cant-consume-descriptor-like-searchasync/286794)
**Author:** [@puksigon](https://discuss.elastic.co/u/puksigon)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 5:14am UTC](https://discuss.elastic.co/t/countasync-cant-consume-descriptor-like-searchasync/286794 "2021-10-15T05:14:02Z")
I use Nest lib in my project. I try to use repository pattern with base repository class. For search method, is work fine with "SearchDescriptor", but for count method, is't work with "CountDescriptor" like search me… --- ## [Kibana docker setup](https://discuss.elastic.co/t/kibana-docker-setup/285612)
**Author:** [@alpine\_f1](https://discuss.elastic.co/u/alpine_f1)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 3:56am UTC](https://discuss.elastic.co/t/kibana-docker-setup/285612 "2021-10-15T03:56:34Z")
I am running Elasticsearch cluster (2 master, 2 data and 1 voter) as docker containers behind a load balanced setup. F5 URL for that looks like https://myelastic.mycompany.com. I am also running Kibana container that con… --- ## [Kibana-visualization Data Table not allow choose a source with index pattern type](https://discuss.elastic.co/t/kibana-visualization-data-table-not-allow-choose-a-source-with-index-pattern-type/286516)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 4\ **Last updated:** [October 15, 2021, 2:52am UTC](https://discuss.elastic.co/t/kibana-visualization-data-table-not-allow-choose-a-source-with-index-pattern-type/286516 "2021-10-15T02:52:28Z")
When I tried to create a new visualization type Data Table in kibana can\`t select a index pattern. I have others spaces in my kibana and in the others if I can. What is the reason for this behavior? --- ## [Elapsed time filter calculating negative time](https://discuss.elastic.co/t/elapsed-time-filter-calculating-negative-time/286786)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 1:58am UTC](https://discuss.elastic.co/t/elapsed-time-filter-calculating-negative-time/286786 "2021-10-15T01:58:53Z")
Hi I am loading offline logs and using elapsed plugin to calculate delay between 2 events, but the time calculating is not always correct sometimes it doesn't display the value in correct second sometimes it shows negat… --- ## [Use Kibana current user to send request to Elasticsearch plugin](https://discuss.elastic.co/t/use-kibana-current-user-to-send-request-to-elasticsearch-plugin/286732)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 1:37am UTC](https://discuss.elastic.co/t/use-kibana-current-user-to-send-request-to-elasticsearch-plugin/286732 "2021-10-15T01:37:39Z")
I have an ES ActionPlugin that has an API, and I created a Kibana plugin, I want the Kibana plugin to send a post request to the ES plugin using context.core.Elasticsearch.legacy.client.callAsInternalUser or context.c… --- ## [No index pattern match of enterprise search in Kibana](https://discuss.elastic.co/t/no-index-pattern-match-of-enterprise-search-in-kibana/260531)
**Author:** [@chen.lu](https://discuss.elastic.co/u/chen.lu)\ **Replies:** 10\ **Last updated:** [October 15, 2021, 1:26am UTC](https://discuss.elastic.co/t/no-index-pattern-match-of-enterprise-search-in-kibana/260531 "2021-10-15T01:26:43Z")
Hello, I am using workplace search and it is connected with elasticsearch and kibana. For example, I can login to workplace search from kibana. Recently I read this blog: Analyzing Elastic Workplace Search usage in a K… --- ## [Vega: Datasource external to elasticsearch](https://discuss.elastic.co/t/vega-datasource-external-to-elasticsearch/286742)
**Author:** [@Vishal\_Patil](https://discuss.elastic.co/u/Vishal_Patil)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 1:11am UTC](https://discuss.elastic.co/t/vega-datasource-external-to-elasticsearch/286742 "2021-10-15T01:11:51Z")
Is it possible to create a Vega/Vega-lite chart in Kibana with an external API endpoint that returns json data ? --- ## [Can not upgrade 7.11.1 -\> 7.15.0 (docker-compose. dev.env)](https://discuss.elastic.co/t/can-not-upgrade-7-11-1-7-15-0-docker-compose-dev-env/286676)
**Author:** [@zpsx](https://discuss.elastic.co/u/zpsx)\ **Replies:** 6\ **Last updated:** [October 15, 2021, 12:54am UTC](https://discuss.elastic.co/t/can-not-upgrade-7-11-1-7-15-0-docker-compose-dev-env/286676 "2021-10-15T00:54:44Z")
I am currently using the elastic stack in my development environment. I'm using a single elastic stack system with docker compose. The version used is 7.11.1. I found out that 7.15.0 was released recently. Change onl… --- ## [How to create ELK user in Bitnami ELK instance (AWS)](https://discuss.elastic.co/t/how-to-create-elk-user-in-bitnami-elk-instance-aws/286723)
**Author:** [@Swarup\_Mukherjee](https://discuss.elastic.co/u/Swarup_Mukherjee)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 12:29am UTC](https://discuss.elastic.co/t/how-to-create-elk-user-in-bitnami-elk-instance-aws/286723 "2021-10-15T00:29:14Z")
Hi Team, How to create ELK user in Bitnami ELK instance (AWS) like we have “USER” Please share the steps. --- ## [JVM spikes over 85% and baseline doesn't drop back down](https://discuss.elastic.co/t/jvm-spikes-over-85-and-baseline-doesnt-drop-back-down/286730)
**Author:** [@cshawler](https://discuss.elastic.co/u/cshawler)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 12:27am UTC](https://discuss.elastic.co/t/jvm-spikes-over-85-and-baseline-doesnt-drop-back-down/286730 "2021-10-15T00:27:16Z")
We have watchers setup to notify when our JVM increases over 85% we have noticed that once the watcher is triggered the alerts keep firing and the jvm usage never drops back down. Is this normal behavior? We have … --- ## [Securing Elastic Stack: Logstash](https://discuss.elastic.co/t/securing-elastic-stack-logstash/286782)
**Author:** [@jceddy](https://discuss.elastic.co/u/jceddy)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 12:09am UTC](https://discuss.elastic.co/t/securing-elastic-stack-logstash/286782 "2021-10-15T00:09:53Z")
I have been working on securing my elastic stack, and am now stuck on getting Logstash to communicate with Elasticsearch securely. I have a cluster with three nodes (call them elk1, elk2, and elk3), each running an Elas… --- ## [Multiple Synonym lists for the same field controlled by other field in Elastic Search](https://discuss.elastic.co/t/multiple-synonym-lists-for-the-same-field-controlled-by-other-field-in-elastic-search/286784)
**Author:** [@twisha](https://discuss.elastic.co/u/twisha)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 11:48pm UTC](https://discuss.elastic.co/t/multiple-synonym-lists-for-the-same-field-controlled-by-other-field-in-elastic-search/286784 "2021-10-14T23:48:58Z")
Is there a way to define multiple synonym lists in Elasticsearch 7 based on languages and some specific field in the Elasticsearch document? The use case is, I have a field "A" with possible values "Y" and "Z". Now, depe… --- ## [Elasticsearch cluster data nodes are being removed from cluster by timeout](https://discuss.elastic.co/t/elasticsearch-cluster-data-nodes-are-being-removed-from-cluster-by-timeout/285635)
**Author:** [@Vadym](https://discuss.elastic.co/u/Vadym)\ **Replies:** 17\ **Last updated:** [October 14, 2021, 10:43pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-data-nodes-are-being-removed-from-cluster-by-timeout/285635 "2021-10-14T22:43:52Z")
Hi everyone, I have an issue while deleting rather big 800Gb Elasticsearch index. Shortly after index deletion data nodes are getting disconnected, cluster loses all data nodes and switches into "red" state for ~10 minu… --- ## [Fleet Call to action - osquerybeat-7.15.0-linux-arm64.tar.gz' returned unsuccessful status code: 404](https://discuss.elastic.co/t/fleet-call-to-action-osquerybeat-7-15-0-linux-arm64-tar-gz-returned-unsuccessful-status-code-404/285065)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 6\ **Last updated:** [October 14, 2021, 10:27pm UTC](https://discuss.elastic.co/t/fleet-call-to-action-osquerybeat-7-15-0-linux-arm64-tar-gz-returned-unsuccessful-status-code-404/285065 "2021-10-14T22:27:11Z")
When adding the Osquery Manager to a policy, I get the following error and the Elastic-Agent remains on UNHEALTHY until i remove the integration from the policy. The file doesn't exist on the repository, is it missing ? … [Previous page](https://discuss.elastic.co/latest.md?page=1431) [Next page](https://discuss.elastic.co/latest.md?page=1433)