# Latest **URL:** https://discuss.elastic.co/latest.md?page=1470 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1471 --- ## [Targeting elasticsearch](https://discuss.elastic.co/t/targeting-elasticsearch/284684)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 4\ **Last updated:** [September 21, 2021, 7:14am UTC](https://discuss.elastic.co/t/targeting-elasticsearch/284684 "2021-09-21T07:14:36Z")
Hi, We run a small cluster, 2 x master, 4 x data, 2 x ingest in addition to a number of logstash servers. Can someone confirm that we are targeting the correct elasticsearch nodes from kibana and beats. From kibana (e… --- ## [Configure Charset used by Elasticsearch to minimize storage and boost searches](https://discuss.elastic.co/t/configure-charset-used-by-elasticsearch-to-minimize-storage-and-boost-searches/284679)
**Author:** [@FloFire](https://discuss.elastic.co/u/FloFire)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 7:03am UTC](https://discuss.elastic.co/t/configure-charset-used-by-elasticsearch-to-minimize-storage-and-boost-searches/284679 "2021-09-21T07:03:34Z")
Hi all, I'am currently try to use elastic to store a huge amount of text. I do not need UTF things I'am would be fine with ASCII. Also I would be fine if all chars are lower case because I dont care about uppercase and … --- ## [Dropdown in canvas does not filter visualization from 'Add from Kibana"](https://discuss.elastic.co/t/dropdown-in-canvas-does-not-filter-visualization-from-add-from-kibana/284631)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 7:01am UTC](https://discuss.elastic.co/t/dropdown-in-canvas-does-not-filter-visualization-from-add-from-kibana/284631 "2021-09-21T07:01:49Z")
Hi, I am working with canvas where I have several visualizations and a dropdown. I imported a treemap from lens to canvas but the treemap is not being filtered by the canvas dropdown. Am I missing something, or is this … --- ## [Kibana - strange behavior using search on long field](https://discuss.elastic.co/t/kibana-strange-behavior-using-search-on-long-field/284628)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 8\ **Last updated:** [September 21, 2021, 6:53am UTC](https://discuss.elastic.co/t/kibana-strange-behavior-using-search-on-long-field/284628 "2021-09-21T06:53:44Z")
Hi, I am using an Elastic+Logstash+kibana 7.12 stack. And I get a very strange behavior. I send log files using filebeat to logstash. Log files contain lines in json format. logstash parses them using the std json f… --- ## [How to Convert array fields from beats to compatible array fields of Splunk HEC input viai Logstash](https://discuss.elastic.co/t/how-to-convert-array-fields-from-beats-to-compatible-array-fields-of-splunk-hec-input-viai-logstash/284683)
**Author:** [@sibiv196](https://discuss.elastic.co/u/sibiv196)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 6:33am UTC](https://discuss.elastic.co/t/how-to-convert-array-fields-from-beats-to-compatible-array-fields-of-splunk-hec-input-viai-logstash/284683 "2021-09-21T06:33:46Z")
This is the logstash output to splunk HEC input event endpoint. "fields":"{\\"netcool\_fields\_community\\":\\"AGENT\_HB\\",\\"metric\_name:status\\":1}"}" I am not sure what is failing . Events are not getting indexed to metric… --- ## [What is the best way to represent a data using grok when an emailid is inside a quoted string?](https://discuss.elastic.co/t/what-is-the-best-way-to-represent-a-data-using-grok-when-an-emailid-is-inside-a-quoted-string/284673)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 6:19am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-represent-a-data-using-grok-when-an-emailid-is-inside-a-quoted-string/284673 "2021-09-21T06:19:07Z")
We have got the predefined grok expressions EMAILADDRESS and QUOTEDSTRING available in elasticsearch/kibana In my log I have the pattern fromemailid="shi@gmail.com" toemailid="ela@gmail.com" What is the best way to r… --- ## [Multi - term aggregation with Flat field and nested aggregation](https://discuss.elastic.co/t/multi-term-aggregation-with-flat-field-and-nested-aggregation/284601)
**Author:** [@Balaji\_Arun](https://discuss.elastic.co/u/Balaji_Arun)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 8:20am UTC](https://discuss.elastic.co/t/multi-term-aggregation-with-flat-field-and-nested-aggregation/284601 "2021-09-20T08:20:11Z")
Hi Guys, I just need a multi-term aggregation that has two fields "field1" and "nestedField" doc structure - { field1:"", field:{ nestedField:"" } } But don't know how to construct a query, need your help Thanks in … --- ## [Mapping geo\_shape dynamically](https://discuss.elastic.co/t/mapping-geo-shape-dynamically/284483)
**Author:** [@dersmon](https://discuss.elastic.co/u/dersmon)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 6:04am UTC](https://discuss.elastic.co/t/mapping-geo-shape-dynamically/284483 "2021-09-21T06:04:26Z")
I struggle to find a generic mapping for my GeoJSON data in 7.14.0. My documents are created using a composition pattern. This results in a collection document types that may have a field "geometry" containing GeoJSON G… --- ## [Getting Error 502,{"ok":false,"message":"backend closed connection"} for enriching fields to another index](https://discuss.elastic.co/t/getting-error-502-ok-false-message-backend-closed-connection-for-enriching-fields-to-another-index/284637)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 5:31am UTC](https://discuss.elastic.co/t/getting-error-502-ok-false-message-backend-closed-connection-for-enriching-fields-to-another-index/284637 "2021-09-21T05:31:42Z")
Hi, I have two index 1.ther 2.part. "ther" index has 24 fields, ''part" index has 19 fields. I have to enrich "ther" index with "part" index fields. Field "user\_id" is common between two indexes. Using enrich process… --- ## [Moving fields to root](https://discuss.elastic.co/t/moving-fields-to-root/283663)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 5:14am UTC](https://discuss.elastic.co/t/moving-fields-to-root/283663 "2021-09-21T05:14:33Z")
i have metricbeat installed and for desupported version RHEL 4 we collect it via custom script we ingest them with type name devbeat and in elk it is showing all fields prefixed with devbeat. how to avoid prefixing … --- ## [Deploy ELK platinum in on-prem server](https://discuss.elastic.co/t/deploy-elk-platinum-in-on-prem-server/284452)
**Author:** [@EdisonDevadoss](https://discuss.elastic.co/u/EdisonDevadoss)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 5:00am UTC](https://discuss.elastic.co/t/deploy-elk-platinum-in-on-prem-server/284452 "2021-09-21T05:00:01Z")
Hi Team, If we go for platinum subscription for ELK stack, can we deploy it on-prem server? I need your help. --- ## [Configuration of OpenID connect for Elasticsearch 7.14.1 is getting failed with trial version](https://discuss.elastic.co/t/configuration-of-openid-connect-for-elasticsearch-7-14-1-is-getting-failed-with-trial-version/284477)
**Author:** [@hari97](https://discuss.elastic.co/u/hari97)\ **Replies:** 9\ **Last updated:** [September 21, 2021, 4:54am UTC](https://discuss.elastic.co/t/configuration-of-openid-connect-for-elasticsearch-7-14-1-is-getting-failed-with-trial-version/284477 "2021-09-21T04:54:33Z")
I have installed latest elasticsearch and kibana (7.14.1) version using docker images. My setup is single-node elasticsearch. Initiated trial version for 30 days and enabled https for elasticsearch using ssl certificate… --- ## [Load Balancing and ECE](https://discuss.elastic.co/t/load-balancing-and-ece/283691)
**Author:** [@netjammr](https://discuss.elastic.co/u/netjammr)\ **Replies:** 4\ **Last updated:** [September 21, 2021, 3:50am UTC](https://discuss.elastic.co/t/load-balancing-and-ece/283691 "2021-09-21T03:50:32Z")
Hello, I've reviewed the ECE installation documentation and while it is clear that load balancing is recommended/required for traffic to the deployment endpoints (via the proxies) is load balancing required or recommend… --- ## [Default Nginx access log pipeline does not process all user-agents from Logs](https://discuss.elastic.co/t/default-nginx-access-log-pipeline-does-not-process-all-user-agents-from-logs/284488)
**Author:** [@Nishad\_Angre](https://discuss.elastic.co/u/Nishad_Angre)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 1:47pm UTC](https://discuss.elastic.co/t/default-nginx-access-log-pipeline-does-not-process-all-user-agents-from-logs/284488 "2021-09-17T13:47:10Z")
Hi, I have configured a Nginx access log with filebeat using default pipeline. I am using elasticsearch version 7.14.1 This pipeline however does not parse all the user-agents which come from nginx logs. PFB few examp… --- ## [Is there a way to visualize the scoring (for a non coder guy)?](https://discuss.elastic.co/t/is-there-a-way-to-visualize-the-scoring-for-a-non-coder-guy/284621)
**Author:** [@Smyken](https://discuss.elastic.co/u/Smyken)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 1:27am UTC](https://discuss.elastic.co/t/is-there-a-way-to-visualize-the-scoring-for-a-non-coder-guy/284621 "2021-09-21T01:27:42Z")
Hi all As a non coder (but responsible for our site) I am curios what scores our elastic search are using when ranking search terms (is that the correct wording?). I often get questions from my colleges why a specific … --- ## [How to handle different spellings of names?](https://discuss.elastic.co/t/how-to-handle-different-spellings-of-names/284622)
**Author:** [@Smyken](https://discuss.elastic.co/u/Smyken)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 1:17am UTC](https://discuss.elastic.co/t/how-to-handle-different-spellings-of-names/284622 "2021-09-21T01:17:17Z")
As a no coding person I´m trying to figure out which approach that is the best to handle person names with different spellings. Like my name that can be spelled Michael, Mickael, or Mikael. Or names like Desiré that peo… --- ## [Understanding HTTP\_Poller](https://discuss.elastic.co/t/understanding-http-poller/284639)
**Author:** [@tofubeats](https://discuss.elastic.co/u/tofubeats)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 1:13am UTC](https://discuss.elastic.co/t/understanding-http-poller/284639 "2021-09-21T01:13:06Z")
Hi, if I were to use HTTP\_Poller plugin on a logstash instance to query an ES API on another machine, would it hit the transport interface or the HTTP interface? Thank you! --- ## [Best practice for JSON logging (e.g. timestamp processing)](https://discuss.elastic.co/t/best-practice-for-json-logging-e-g-timestamp-processing/284472)
**Author:** [@crazylogging](https://discuss.elastic.co/u/crazylogging)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:04am UTC](https://discuss.elastic.co/t/best-practice-for-json-logging-e-g-timestamp-processing/284472 "2021-09-21T01:04:59Z")
Hi, I'm quite new to the elastic stack so please excuse the question if it doesn't make any sense. I've got an application (let's call it JBoss) which runs in a docker container (all components in my scenario do so) an… --- ## [Kibana pod lost index pattern and dashboards after deleting pod](https://discuss.elastic.co/t/kibana-pod-lost-index-pattern-and-dashboards-after-deleting-pod/284449)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 12:55am UTC](https://discuss.elastic.co/t/kibana-pod-lost-index-pattern-and-dashboards-after-deleting-pod/284449 "2021-09-21T00:55:48Z")
Hi, I just delete the kibana pod that I build with eck and I lost all the dashboards and index patterns that I've created. I thought that that info was loaded in the .kibana index. Its theres a way that I can recover th… --- ## [Frequency of a field with python elasticsearch module](https://discuss.elastic.co/t/frequency-of-a-field-with-python-elasticsearch-module/284644)
**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 5:36pm UTC](https://discuss.elastic.co/t/frequency-of-a-field-with-python-elasticsearch-module/284644 "2021-09-20T17:36:35Z")
I need to count the frequency of a field, how can I do this?, I tried with aggs, but the module only says: raise HTTP\_EXCEPTIONS.get(status\_code, TransportError)( elasticsearch.exceptions.RequestError: RequestError(… --- ## [RestHighLevelClient Request cannot be executed I/O reactor status: STOPPED](https://discuss.elastic.co/t/resthighlevelclient-request-cannot-be-executed-i-o-reactor-status-stopped/284630)
**Author:** [@Wondwosen\_Eshetu](https://discuss.elastic.co/u/Wondwosen_Eshetu)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 2:30pm UTC](https://discuss.elastic.co/t/resthighlevelclient-request-cannot-be-executed-i-o-reactor-status-stopped/284630 "2021-09-20T14:30:56Z")
I am getting the below error while executing the search requests. We are using ElasticSearch 6.8.6 and the same version of RestHighLevel client java.lang.RuntimeException: Request cannot be executed; I/O reactor status:… --- ## [Kibana is on a remote server](https://discuss.elastic.co/t/kibana-is-on-a-remote-server/284497)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 4\ **Last updated:** [September 20, 2021, 9:46pm UTC](https://discuss.elastic.co/t/kibana-is-on-a-remote-server/284497 "2021-09-20T21:46:46Z")
I built an Elasticsearch cluster on server1(master) and server2(second), and a Kibana on server3. After I set up basic security for HTTP to encrypt communication between Kibana and Elasticsearch, I cannot restart Kibana.… --- ## [Copy field value from one index to another index](https://discuss.elastic.co/t/copy-field-value-from-one-index-to-another-index/284661)
**Author:** [@dnnxl](https://discuss.elastic.co/u/dnnxl)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 9:33pm UTC](https://discuss.elastic.co/t/copy-field-value-from-one-index-to-another-index/284661 "2021-09-20T21:33:47Z")
Hello, I would like to know what is the best way to copy field value from one index to another existing index, base on a matching criteria. For example. I have index "indexOne" and target "indexTwo", here is an example… --- ## [Unable to add remote cluster for CCS](https://discuss.elastic.co/t/unable-to-add-remote-cluster-for-ccs/284519)
**Author:** [@Tosh](https://discuss.elastic.co/u/Tosh)\ **Replies:** 3\ **Last updated:** [September 20, 2021, 8:27pm UTC](https://discuss.elastic.co/t/unable-to-add-remote-cluster-for-ccs/284519 "2021-09-20T20:27:24Z")
Hi , I have configured the remote cluster using configure the remote cluster GET /\_cluster/settings {"persistent":{"cluster":{"remote":{"cluster\_one":{"seeds":\["127.0.0.1:9300"\]}}}},"transient":{}} But when i do get … --- ## [Kibana - неправильная сортировка по полю с датой](https://discuss.elastic.co/t/kibana/284655)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 6\ **Last updated:** [September 20, 2021, 8:03pm UTC](https://discuss.elastic.co/t/kibana/284655 "2021-09-20T20:03:43Z")
Добрый день! Заметил, что Kibana иногда неправильно сортирует по полю с датой - подчеркнутое на картинке значение больше значения и из предыдущей, и из следующей строки. Индекс-паттерн создан на основе поля из документа… --- ## [Calculate Percentage of utilization](https://discuss.elastic.co/t/calculate-percentage-of-utilization/283689)
**Author:** [@mericaforrestgumpsun](https://discuss.elastic.co/u/mericaforrestgumpsun)\ **Replies:** 9\ **Last updated:** [September 20, 2021, 6:25pm UTC](https://discuss.elastic.co/t/calculate-percentage-of-utilization/283689 "2021-09-20T18:25:28Z")
Hello, I am wanting to make a Kibana visualization that will give me the percentage of time that a task is running. I have a field called totalExecuationTimeInSeconds, that I would like to divide into the amount of time… --- ## [FSCrawler failure handling](https://discuss.elastic.co/t/fscrawler-failure-handling/284615)
**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\ **Replies:** 8\ **Last updated:** [September 20, 2021, 6:16pm UTC](https://discuss.elastic.co/t/fscrawler-failure-handling/284615 "2021-09-20T18:16:15Z")
Hello, We are considering the question: how FSCrawler manages failure? What happened if FSCrawler failed to upload a certain file because of a failure on the ElasticSearch side? Does FSCrawler implements an automatic f… --- ## [Bearer token in HTTP filter](https://discuss.elastic.co/t/bearer-token-in-http-filter/284641)
**Author:** [@Juan\_Montoya](https://discuss.elastic.co/u/Juan_Montoya)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 5:03pm UTC](https://discuss.elastic.co/t/bearer-token-in-http-filter/284641 "2021-09-20T17:03:53Z")
Hi, I'm trying to get data from an HTTP API, the main API needs a bearer token to authenticate, a secondary API gives me the token that allows the authentication in the main API. I Solved using http\_poller input to get … --- ## [Heartbeat - Synthetics/Browser Monitor get TLS Certificate Information](https://discuss.elastic.co/t/heartbeat-synthetics-browser-monitor-get-tls-certificate-information/284629)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [September 20, 2021, 4:41pm UTC](https://discuss.elastic.co/t/heartbeat-synthetics-browser-monitor-get-tls-certificate-information/284629 "2021-09-20T16:41:07Z")
Hi All, I was wondering if there is a way to get the Synthetic/Browser monitor of Heartbeat to collect the TLS Certificate information against the initial URL. Currently, when setting up a Browser monitor, I also need … --- ## [Elastic agent goes Unhealthy after deploy Endpoint integration](https://discuss.elastic.co/t/elastic-agent-goes-unhealthy-after-deploy-endpoint-integration/284564)
**Author:** [@SiRVaNdO](https://discuss.elastic.co/u/SiRVaNdO)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:39pm UTC](https://discuss.elastic.co/t/elastic-agent-goes-unhealthy-after-deploy-endpoint-integration/284564 "2021-09-20T16:39:51Z")
Hi there, I have several Elastic agents with different policies and some integrations. I want to do a PoC with the endpoint but when I deploy the endpoint integration in the policy and it deploys to the elastic agents,… [Previous page](https://discuss.elastic.co/latest.md?page=1469) [Next page](https://discuss.elastic.co/latest.md?page=1471)