# Latest **URL:** https://discuss.elastic.co/latest.md?page=1468 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1469 --- ## [Missing "Elasticsearch query" alert type](https://discuss.elastic.co/t/missing-elasticsearch-query-alert-type/284704)
**Author:** [@gamblero](https://discuss.elastic.co/u/gamblero)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 6:11am UTC](https://discuss.elastic.co/t/missing-elasticsearch-query-alert-type/284704 "2021-09-22T06:11:43Z")
Hello, I want to create my first alert based on elasticsearch query but it is not listed in "create alert" modal. I have following possibilities inside stack alerts subgroup: What did I miss? I am looking for that o… --- ## [Are Elastic Beats capable enough to ingest data into Splunk?](https://discuss.elastic.co/t/are-elastic-beats-capable-enough-to-ingest-data-into-splunk/284804)
**Author:** [@spzala](https://discuss.elastic.co/u/spzala)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 6:02am UTC](https://discuss.elastic.co/t/are-elastic-beats-capable-enough-to-ingest-data-into-splunk/284804 "2021-09-22T06:02:37Z")
Hey, Currently, We are using various beats to ingest data into our Elasticsearch. But now, we also encountered a use case in which we need to ingest data into Splunk using the same beats. Is it doable? If yes then can s… --- ## [Run kibana commands from java apache Http (or other java rest client)](https://discuss.elastic.co/t/run-kibana-commands-from-java-apache-http-or-other-java-rest-client/283751)
**Author:** [@anna.kuranda](https://discuss.elastic.co/u/anna.kuranda)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 5:56am UTC](https://discuss.elastic.co/t/run-kibana-commands-from-java-apache-http-or-other-java-rest-client/283751 "2021-09-22T05:56:02Z")
Hi, is there way run kibana rest from java apache http client (or other java rest client)? what url to use ? for example run in apache http : PUT %3Cbase\_elements\_rwr-%7Bnow%2Fd%7D-000001%3E { "aliases": { "basee… --- ## [How to extract error root cause reason using Java RestHighLevelClient?](https://discuss.elastic.co/t/how-to-extract-error-root-cause-reason-using-java-resthighlevelclient/284801)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 5:15am UTC](https://discuss.elastic.co/t/how-to-extract-error-root-cause-reason-using-java-resthighlevelclient/284801 "2021-09-22T05:15:07Z")
Hi, I am trying to perform a wildcard query on date type, which is not allowed by ES, so I see an exception being thrown from ES as below: { "error": { "root\_cause": \[ { "type": "query\_shard\_excepti… --- ## [Date histogram with different Timezones with Elasticsearch v.7.13.3](https://discuss.elastic.co/t/date-histogram-with-different-timezones-with-elasticsearch-v-7-13-3/280639)
**Author:** [@scorona85](https://discuss.elastic.co/u/scorona85)\ **Replies:** 9\ **Last updated:** [September 22, 2021, 5:09am UTC](https://discuss.elastic.co/t/date-histogram-with-different-timezones-with-elasticsearch-v-7-13-3/280639 "2021-09-22T05:09:33Z")
I have to acquire datas from different part of Timezones (example New York -6.00 and Rome +2.00). In the document I have a field 'timestamp' defined as "data" and I have for example create a "date\_histogram" for example … --- ## [Vm.max\_map\_count can we have any workaround without setting this value](https://discuss.elastic.co/t/vm-max-map-count-can-we-have-any-workaround-without-setting-this-value/284798)
**Author:** [@Sammeta\_David\_Raju](https://discuss.elastic.co/u/Sammeta_David_Raju)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 4:46am UTC](https://discuss.elastic.co/t/vm-max-map-count-can-we-have-any-workaround-without-setting-this-value/284798 "2021-09-22T04:46:48Z")
Hi , I am using fargate and Elasticsearch version as 7.3.2 can i have any workaround to bypass vm.max\_map\_count issue \[65530\] is too low increase to atleast \[262144\] 1.Fargate environment is mandatory .we cannot switc… --- ## [Cannot download older versions of elastic?](https://discuss.elastic.co/t/cannot-download-older-versions-of-elastic/284787)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 22, 2021, 2:05am UTC](https://discuss.elastic.co/t/cannot-download-older-versions-of-elastic/284787 "2021-09-22T02:05:09Z")
I'm trying to download an older version of Elasticsearch here: https://www.elastic.co/downloads/past-releases/elasticsearch-7-10-0 But it's not working, instead throwing a 504 timeout. Is there another way to download … --- ## [What is the difference between boost and weight](https://discuss.elastic.co/t/what-is-the-difference-between-boost-and-weight/284714)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 5\ **Last updated:** [September 22, 2021, 1:54am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-boost-and-weight/284714 "2021-09-22T01:54:08Z")
Boost parameter is used in the below example wildcard": { "City": { "wildcard": "M", "boost": 10 } Can I use similar query for weight? --- ## [How to make doc which has more different words score higher?](https://discuss.elastic.co/t/how-to-make-doc-which-has-more-different-words-score-higher/284546)
**Author:** [@Bowen\_Liu](https://discuss.elastic.co/u/Bowen_Liu)\ **Replies:** 1\ **Last updated:** [September 22, 2021, 12:58am UTC](https://discuss.elastic.co/t/how-to-make-doc-which-has-more-different-words-score-higher/284546 "2021-09-22T00:58:39Z")
Hi everyone, I have a problem about scoring in es. The thing is that I use multi\_match to do full text search in muti-fields and use the type "best\_fields", say, user\_name, biz\_type, account\_name, content... When I use,… --- ## [Extracting values from text messages and summing them in real time queries](https://discuss.elastic.co/t/extracting-values-from-text-messages-and-summing-them-in-real-time-queries/284699)
**Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 10:06am UTC](https://discuss.elastic.co/t/extracting-values-from-text-messages-and-summing-them-in-real-time-queries/284699 "2021-09-21T10:06:36Z")
Hi, I have event description fields that look this way: "User1 have executed 3 actions" "User2 have executed 5 actions" .... And then many unnstructured message descriptions around. I'm trying to select only mess… --- ## [Nest path is not nested, but definition says it is](https://discuss.elastic.co/t/nest-path-is-not-nested-but-definition-says-it-is/284775)
**Author:** [@James.Gray](https://discuss.elastic.co/u/James.Gray)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 11:05pm UTC](https://discuss.elastic.co/t/nest-path-is-not-nested-but-definition-says-it-is/284775 "2021-09-21T23:05:32Z")
I'm getting an aggregation\_execution\_exception from a query with elasticsearch server 7.x with a reason of: \[nested\] nested path \[productCategories\] is not nested. The equivalent code previously worked in server 5.5.1 wi… --- ## [Check version of Nest?](https://discuss.elastic.co/t/check-version-of-nest/284776)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 11:06pm UTC](https://discuss.elastic.co/t/check-version-of-nest/284776 "2021-09-21T23:06:40Z")
I'd like to check was version of the Nest client I am using, and if possible, downgrade it to version 7.13. Is this possible? --- ## [Translate doesnt work when key in yml dictionary is a number](https://discuss.elastic.co/t/translate-doesnt-work-when-key-in-yml-dictionary-is-a-number/284767)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 10:53pm UTC](https://discuss.elastic.co/t/translate-doesnt-work-when-key-in-yml-dictionary-is-a-number/284767 "2021-09-21T22:53:09Z")
Hi, I have this yml dictionary 1967345056 : "VISACI nodata IIS" and this is the translate: translate { field =\> "\[monitorgroup\]" destination =\> "\[nuevo\_campo\]" dictionary\_path =\> "/etc/logs… --- ## [Directly query ES cluster through .NET without using Client?](https://discuss.elastic.co/t/directly-query-es-cluster-through-net-without-using-client/284772)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:42pm UTC](https://discuss.elastic.co/t/directly-query-es-cluster-through-net-without-using-client/284772 "2021-09-21T22:42:35Z")
I'm trying to run some ElasticSearch queries from my C# code. Is it possible to do this without the low-level or high-level clients? --- ## [Settings for logging.files for reading from dir then delete files once read](https://discuss.elastic.co/t/settings-for-logging-files-for-reading-from-dir-then-delete-files-once-read/284737)
**Author:** [@robnew](https://discuss.elastic.co/u/robnew)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:28pm UTC](https://discuss.elastic.co/t/settings-for-logging-files-for-reading-from-dir-then-delete-files-once-read/284737 "2021-09-21T22:28:54Z")
I want to use Filebeat to read from a directory to ingest the log files, then to delete (sinkhole) the files once read and ingested into Elasticsearch. Is this achievable with Filebeat? --- ## [Downgrade ElasticSearch Nest version?](https://discuss.elastic.co/t/downgrade-elasticsearch-nest-version/284771)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:22pm UTC](https://discuss.elastic.co/t/downgrade-elasticsearch-nest-version/284771 "2021-09-21T22:22:53Z")
I am currently using the Nest client that comes with ElasticSearch. My ES version is 7.14.1. I would like to downgrade to an older version of ElasticSearch so that I can continue to use the client with other ElasticSearc… --- ## [Failed to create snapshot](https://discuss.elastic.co/t/failed-to-create-snapshot/284754)
**Author:** [@X\_T](https://discuss.elastic.co/u/X_T)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 10:20pm UTC](https://discuss.elastic.co/t/failed-to-create-snapshot/284754 "2021-09-21T22:20:08Z")
Hi team, I'm trying to create a snapshot from the cluster and i am getting some errors. ELK Stack: 7.14.1 Elasticsearch Nodes: 4 First i created the snapshot repository: PUT /\_snapshot/backup\_1 { "type": "fs", "… --- ## [Where I can find Journalbeat in Kibana?](https://discuss.elastic.co/t/where-i-can-find-journalbeat-in-kibana/284544)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 8\ **Last updated:** [September 21, 2021, 9:34pm UTC](https://discuss.elastic.co/t/where-i-can-find-journalbeat-in-kibana/284544 "2021-09-21T21:34:38Z")
Hello, I'm trying to identify journalbeat in Kibana. Where I'll get journalbeat information in Kibana dashboard? Can anyone help me ? --- ## [APM java agent](https://discuss.elastic.co/t/apm-java-agent/284643)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 8:45pm UTC](https://discuss.elastic.co/t/apm-java-agent/284643 "2021-09-21T20:45:35Z")
I am having so much trouble getting data from java process to my apm server apm server 7.14, elk version 7.14 I have attached elastic-apm-agent-1.24.0.jar to my java process but nothing shows up in my apm server ps -e… --- ## [Filebeats does not create custom-named indices and hangs if ILM is disabled](https://discuss.elastic.co/t/filebeats-does-not-create-custom-named-indices-and-hangs-if-ilm-is-disabled/283894)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 8:40pm UTC](https://discuss.elastic.co/t/filebeats-does-not-create-custom-named-indices-and-hangs-if-ilm-is-disabled/283894 "2021-09-21T20:40:51Z")
All details and code snippets are included into the SO post: elasticsearch - Elastic Filebeat does not index into custom indices with mappings - Stack Overflow Below is the summary with the latest updates: I am trying … --- ## [Nested documents Sorting & faceting](https://discuss.elastic.co/t/nested-documents-sorting-faceting/284757)
**Author:** [@jai\_H](https://discuss.elastic.co/u/jai_H)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 6:33pm UTC](https://discuss.elastic.co/t/nested-documents-sorting-faceting/284757 "2021-09-21T18:33:35Z")
I am working on an E-Commerce application. Catalog Data is being served by Elastic Search. I have document's for Product which is already indexed in Elastic Search. Document Looks something like this (Excluded few fiel… --- ## [ES 6.4.0 repository S3 issue](https://discuss.elastic.co/t/es-6-4-0-repository-s3-issue/284238)
**Author:** [@theMike](https://discuss.elastic.co/u/theMike)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 6:32pm UTC](https://discuss.elastic.co/t/es-6-4-0-repository-s3-issue/284238 "2021-09-21T18:32:55Z")
Hi, I'm trying to use repository-s3 to snapshot a single node ELK instance to our StorageGrid via S3 api. { "type": "s3", "settings": { "endpoint": "objectstore.xxxx.xxx:xxxx", "bucket": "our-elk-backup" } } … --- ## [Invalid NEST response built from a unsuccessful () low level call on POST using .NET Nest](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-post-using-net-nest/284583)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 5:16pm UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-post-using-net-nest/284583 "2021-09-21T17:16:47Z")
New to ElasticSearch. I've seen a couple posts with similar titles but didn't seem to apply to me. I'm having trouble querying my ES cluster for the first time. Someone else creaed the cluster and gave me login info. My… --- ## ["Result window is too large" http response depends on the presence of the sort field](https://discuss.elastic.co/t/result-window-is-too-large-http-response-depends-on-the-presence-of-the-sort-field/284738)
**Author:** [@franck.valentin](https://discuss.elastic.co/u/franck.valentin)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 5:14pm UTC](https://discuss.elastic.co/t/result-window-is-too-large-http-response-depends-on-the-presence-of-the-sort-field/284738 "2021-09-21T17:14:04Z")
Hi, I'm facing a strange behaviour on Elasticsearch 7.7 when I perform a search on several indexes and the result window is too large. If the query is: GET /\_search { "size": 500, "from": 10000, "query": { "… --- ## [Reinstall Fleet Integrations](https://discuss.elastic.co/t/reinstall-fleet-integrations/284652)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [September 21, 2021, 4:42pm UTC](https://discuss.elastic.co/t/reinstall-fleet-integrations/284652 "2021-09-21T16:42:35Z")
Elastic/Kibana 7.14.1 How do you forcibly reinstall a system integration? System integration is missing several dashboards and searches so the easy was for most would be to just uninstall reinstall it. Due to system n… --- ## [Correlating Documents Based On Unique Field](https://discuss.elastic.co/t/correlating-documents-based-on-unique-field/283571)
**Author:** [@Nico\_Pampaloni](https://discuss.elastic.co/u/Nico_Pampaloni)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 4:12pm UTC](https://discuss.elastic.co/t/correlating-documents-based-on-unique-field/283571 "2021-09-21T16:12:07Z")
Good Afternoon, I have a question about correlating documents based on a search term that only exists in some of the results. Our data has two unique identifiers. The first one (X) exists throughout the lifetime of the … --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/284747)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 4\ **Last updated:** [September 21, 2021, 3:59pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/284747 "2021-09-21T15:59:29Z")
we upgraded a cluster from 6.8.8 to 7.8.1. ever since this, we are having elastic nodes die with the below error. everything was working fine before the upgrade. i've googled and haven't found anything to really point… --- ## [How to calculate the difference between two web sessions in seconds](https://discuss.elastic.co/t/how-to-calculate-the-difference-between-two-web-sessions-in-seconds/284624)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 3:57pm UTC](https://discuss.elastic.co/t/how-to-calculate-the-difference-between-two-web-sessions-in-seconds/284624 "2021-09-21T15:57:21Z")
Hey I am trying to understand how this transformation work: Getting duration by using bucket script. Before applying it to my use-case I am trying to know how to get the difference between two sessions in seconds? and th… --- ## [TSVB don't work only on Count Aggregation](https://discuss.elastic.co/t/tsvb-dont-work-only-on-count-aggregation/283457)
**Author:** [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\ **Replies:** 17\ **Last updated:** [September 21, 2021, 3:51pm UTC](https://discuss.elastic.co/t/tsvb-dont-work-only-on-count-aggregation/283457 "2021-09-21T15:51:35Z")
I don't know why the TSVB suddenly don't work anymore only for "Count" Aggregation. it show "The request for this panel failed. Failed to compile inline script \[count \*1\] using lang \[expression\]. " But when i use the oth… --- ## [Kibana - Query difficulties in Canvas](https://discuss.elastic.co/t/kibana-query-difficulties-in-canvas/283563)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 14\ **Last updated:** [September 21, 2021, 3:47pm UTC](https://discuss.elastic.co/t/kibana-query-difficulties-in-canvas/283563 "2021-09-21T15:47:08Z")
Hello, Right now I'm facing an issue creating a vertical bar element. The values I'm looking to use are quite simple to obtain through Dev Tools by making a query, however Canvas doesn't allow to query that way, which I… [Previous page](https://discuss.elastic.co/latest.md?page=1467) [Next page](https://discuss.elastic.co/latest.md?page=1469)