# Latest **URL:** https://discuss.elastic.co/latest.md?page=1498 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1499 --- ## [Automatic Write Block on Index](https://discuss.elastic.co/t/automatic-write-block-on-index/283014)
**Author:** [@Aamir\_Rizwan](https://discuss.elastic.co/u/Aamir_Rizwan)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 10:09pm UTC](https://discuss.elastic.co/t/automatic-write-block-on-index/283014 "2021-09-01T22:09:11Z")
I have 3 master and 3 data nodes. I was getting this error: AuthorizationException(403, 'cluster\_block\_exception', 'blocked by: \[FORBIDDEN/8/index write (api)\];') Increased the data nodes by 1 but still getting the sam… --- ## [How to check the progress of searchable snapshot action -?](https://discuss.elastic.co/t/how-to-check-the-progress-of-searchable-snapshot-action/283059)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 10:08pm UTC](https://discuss.elastic.co/t/how-to-check-the-progress-of-searchable-snapshot-action/283059 "2021-09-01T22:08:37Z")
How to check the progress of searchable snapshot action - progress ? How do we get to know how much data is left to be snapshotted ? is there any API for this ? --- ## [Persist Elasticsearch/Kibana Keystores with Docker](https://discuss.elastic.co/t/persist-elasticsearch-kibana-keystores-with-docker/283099)
**Author:** [@Stef\_Nestor](https://discuss.elastic.co/u/Stef_Nestor)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 10:08pm UTC](https://discuss.elastic.co/t/persist-elasticsearch-kibana-keystores-with-docker/283099 "2021-09-01T22:08:02Z")
Goal: persist Elasticsearch/Kibana keystores across Docker sessions by mounting data directory Common errors: Exception in thread "main" java.nio.file.FileSystemException: /usr/share/elasticsearch/config/elasticsearch… --- ## [ElasticSearch as primary database and other solutions](https://discuss.elastic.co/t/elasticsearch-as-primary-database-and-other-solutions/283021)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 10:07pm UTC](https://discuss.elastic.co/t/elasticsearch-as-primary-database-and-other-solutions/283021 "2021-09-01T22:07:50Z")
I am using elasticsearch as primary database. But due to the lack of the ACID properties, I want to: or replace it with another database with similar or better performances ( maybe postgresql or kafka/ksql ). or use ot… --- ## [Simultaneous data use of 2 indices differentes | Utilisation simultanée de 2 indices differents](https://discuss.elastic.co/t/simultaneous-data-use-of-2-indices-differentes-utilisation-simultanee-de-2-indices-differents/281688)
**Author:** [@kalache](https://discuss.elastic.co/u/kalache)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 9:54pm UTC](https://discuss.elastic.co/t/simultaneous-data-use-of-2-indices-differentes-utilisation-simultanee-de-2-indices-differents/281688 "2021-09-01T21:54:33Z")
Hello, I’m improving the IT inventory and I want to use the Elastic Stack to made it. Logstash collect data into CSV file, Elasticsearch analyze this data and Kibana let us to visualize the data. Why we want to use El… --- ## [Filter in aggregation not working with top hits](https://discuss.elastic.co/t/filter-in-aggregation-not-working-with-top-hits/282964)
**Author:** [@saurabh.biswas](https://discuss.elastic.co/u/saurabh.biswas)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 8:17pm UTC](https://discuss.elastic.co/t/filter-in-aggregation-not-working-with-top-hits/282964 "2021-09-01T20:17:58Z")
Hello, I'm trying to write a query to form an aggregation of all the colleges under a university, put them into country id buckets and get the top colleges based out of each country. Somehow I'm not getting what I'm ex… --- ## [Unable to install fleet server](https://discuss.elastic.co/t/unable-to-install-fleet-server/282613)
**Author:** [@Dovan](https://discuss.elastic.co/u/Dovan)\ **Replies:** 9\ **Last updated:** [September 1, 2021, 6:57pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-server/282613 "2021-09-01T18:57:07Z")
I'm trying to install fleet server on my local server (the same where elasticsearch is installed) and I'm not succeeding. I've tried to uninstall and reinstall elastic-agent 7.14 and it doesn't work. the commands and th… --- ## [Multiple Elasticsearch Filters in one Logstash Pipeline](https://discuss.elastic.co/t/multiple-elasticsearch-filters-in-one-logstash-pipeline/283087)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 6:49pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-filters-in-one-logstash-pipeline/283087 "2021-09-01T18:49:29Z")
Is it possible to do multiple Elasticsearch lookup filters to search multiple indices in a single Logstash pipeline? --- ## [Painless pains: Weird behaviour with try-catch and dotProduct functions](https://discuss.elastic.co/t/painless-pains-weird-behaviour-with-try-catch-and-dotproduct-functions/282499)
**Author:** [@SKRYMr](https://discuss.elastic.co/u/SKRYMr)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 6:34pm UTC](https://discuss.elastic.co/t/painless-pains-weird-behaviour-with-try-catch-and-dotproduct-functions/282499 "2021-09-01T18:34:48Z")
Hello, in our team we use painless scripting quite heavily and have come across some very weird behaviour from time to time, the latest having to do with the following piece of code: try { double test = dotProduct(k… --- ## [Troubleshooting logstash configs](https://discuss.elastic.co/t/troubleshooting-logstash-configs/282842)
**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\ **Replies:** 8\ **Last updated:** [September 1, 2021, 6:14pm UTC](https://discuss.elastic.co/t/troubleshooting-logstash-configs/282842 "2021-09-01T18:14:11Z")
Hi all.. I've been working on ELK for about a couple of months now and I've been really liking it apart from the troubelshooting steps. I've just integrated a syslog for trial before going heavily onto production phase. … --- ## [Purpose of State files](https://discuss.elastic.co/t/purpose-of-state-files/282849)
**Author:** [@hyadavalli](https://discuss.elastic.co/u/hyadavalli)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 5:17pm UTC](https://discuss.elastic.co/t/purpose-of-state-files/282849 "2021-09-01T17:17:17Z")
Hello Everyone, After searching everywhere, I couldn't find the purpose of state files. We started off with version 2.2 and then went to 5.6 and then at 6.8 atm. Below is the scenario we frequently run into: Elastics… --- ## [Counting events in a specific time range](https://discuss.elastic.co/t/counting-events-in-a-specific-time-range/282932)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 5:50pm UTC](https://discuss.elastic.co/t/counting-events-in-a-specific-time-range/282932 "2021-09-01T17:50:02Z")
Our problem is the following; we are collecting information about customers visiting our page. We are intrested in counting repeated visits by the same customer in a specific time range - we would like to determine the n… --- ## ["Required array length too large" error during reindex](https://discuss.elastic.co/t/required-array-length-too-large-error-during-reindex/283090)
**Author:** [@Richard\_Ney](https://discuss.elastic.co/u/Richard_Ney)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 5:49pm UTC](https://discuss.elastic.co/t/required-array-length-too-large-error-during-reindex/283090 "2021-09-01T17:49:52Z")
I'm in the process of reindexing an index of large nested documents. During the reindex I'm using painless script to pull a couple nested documents up a level. For the most part the reindex is going fine but occasionally… --- ## [Kibana is extremely slow (Loading graphs, new pages, etc.)](https://discuss.elastic.co/t/kibana-is-extremely-slow-loading-graphs-new-pages-etc/282955)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 6\ **Last updated:** [September 1, 2021, 5:32pm UTC](https://discuss.elastic.co/t/kibana-is-extremely-slow-loading-graphs-new-pages-etc/282955 "2021-09-01T17:32:40Z")
System: Ubuntu 18.04 16 Cores 16Gb RAM ELK system ELK 7.14 Single node (Kibana, Elastic, Logstash) All was deployed with Ubuntu apt (Install Elasticsearch with Debian Package | Elasticsearch Guide \[7.14\] | Elastic)… --- ## [Kafka connectors/streaming for enriching the data](https://discuss.elastic.co/t/kafka-connectors-streaming-for-enriching-the-data/283083)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 4:56pm UTC](https://discuss.elastic.co/t/kafka-connectors-streaming-for-enriching-the-data/283083 "2021-09-01T16:56:38Z")
Is it possible to enrich/transform the data in Kafka connect/Streams and feed it to elasticsearch, without using logstash for data transformation/enrichment? --- ## [Metricbeat failed reading counters: failed collecting counter values: No data to return](https://discuss.elastic.co/t/metricbeat-failed-reading-counters-failed-collecting-counter-values-no-data-to-return/283082)
**Author:** [@Woolis\_Xiibil\_Peek](https://discuss.elastic.co/u/Woolis_Xiibil_Peek)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 4:49pm UTC](https://discuss.elastic.co/t/metricbeat-failed-reading-counters-failed-collecting-counter-values-no-data-to-return/283082 "2021-09-01T16:49:15Z")
Hi. I'm tyring to read the perfmon of a Windows Server 2016. I'm using the Windows module, but I'm getting this message in Kibana. "failed reading counters: failed collecting counter values: No data to return" I have n… --- ## [System Down alert on Kibana](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860)
**Author:** [@grumpypant](https://discuss.elastic.co/u/grumpypant)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 4:41pm UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860 "2021-09-01T16:41:41Z")
New to ELK I'm trying to setup rules for alerting on Kibana. One of them would be "Host Down". Trying to use the system.uptime.duration.ms metricset to tell me if a Host is down for more than 5 mins. So far, below ima… --- ## [Multiple output in Filebeat](https://discuss.elastic.co/t/multiple-output-in-filebeat/283001)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 4:39pm UTC](https://discuss.elastic.co/t/multiple-output-in-filebeat/283001 "2021-09-01T16:39:23Z")
I am trying to setup multiple index outputs from the same filebeat.yml. I have different paths on the same server and I need each path to go to the same logstash but have a different index name. Is it possible? --- ## [Web Crawler stucks in Pending status](https://discuss.elastic.co/t/web-crawler-stucks-in-pending-status/282784)
**Author:** [@Yuriy\_Stakhniak](https://discuss.elastic.co/u/Yuriy_Stakhniak)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 4:27pm UTC](https://discuss.elastic.co/t/web-crawler-stucks-in-pending-status/282784 "2021-09-01T16:27:46Z")
Hey guys. I'm trying to execute several crawl jobs one after another. Each job starts in a different engine. The first job is working perfectly. After SUCCESS I delete the engine and create the new one where I try to st… --- ## [ES7 - HighLevelClient: QueryBuilder serialization / Licensing / performance single node](https://discuss.elastic.co/t/es7-highlevelclient-querybuilder-serialization-licensing-performance-single-node/282748)
**Author:** [@K\_B](https://discuss.elastic.co/u/K_B)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 4:08pm UTC](https://discuss.elastic.co/t/es7-highlevelclient-querybuilder-serialization-licensing-performance-single-node/282748 "2021-09-01T16:08:06Z")
Hi, i moved our java application from 1.7 to 7.14 (kinda lot of work... much changed, steps were 1.3 -\> 1.7 -\> 2.0 -\> 2.4 -\> 5.6 -\> 6.18 -\> 7.14) and its now nearly working as expected. However, somewhere during the 2.x… --- ## [Custom analyzers in Packetbeat index template](https://discuss.elastic.co/t/custom-analyzers-in-packetbeat-index-template/283074)
**Author:** [@yotamgod](https://discuss.elastic.co/u/yotamgod)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 4:05pm UTC](https://discuss.elastic.co/t/custom-analyzers-in-packetbeat-index-template/283074 "2021-09-01T16:05:40Z")
Hi, I recently started using Packetbeat and started adding my own fields to the index template (using the setup.template.append\_fields). I was wondering if there is some way to create a custom analyzer for my custom te… --- ## [Как указать допустимую дистанцию между токенами в запросе query\_string?](https://discuss.elastic.co/t/query-string/283019)
**Author:** [@armada007](https://discuss.elastic.co/u/armada007)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 3:22pm UTC](https://discuss.elastic.co/t/query-string/283019 "2021-09-01T15:22:29Z")
Доброго времени суток! Делаю попытки реализовать полнотекстовый поиск по документам. Предполагается что в строку поиска можно будет вводить различные операторы: AND - логическое И OR - логическое ИЛИ NOT - указанное … --- ## [Multiple Grok patterns help](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965)
**Author:** [@Zorkmid](https://discuss.elastic.co/u/Zorkmid)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 3:17pm UTC](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965 "2021-09-01T15:17:19Z")
Hi All, I'm doing something wrong with the following. The goal is parse 5 basic events from a PulseSecure VPN syslog feed. Is the following the correct?? filter { if "PulseSecure" in \[message\] { grok { … --- ## [Applying aggregation to query results](https://discuss.elastic.co/t/applying-aggregation-to-query-results/283042)
**Author:** [@me.mohammed](https://discuss.elastic.co/u/me.mohammed)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 2:52pm UTC](https://discuss.elastic.co/t/applying-aggregation-to-query-results/283042 "2021-09-01T14:52:22Z")
Hello everyone, I'm trying to apply an aggregation filter to my query, I basically have an array of objects which looks like this { "productDeals": \[ { "id": 1, "startAt": "2021-08-30T17:40:14.000Z", "end… --- ## [Alert if index has 0 documents in last X minutes (Rules and connectors or Detection Rules)](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/282902)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 2:36pm UTC](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/282902 "2021-09-01T14:36:36Z")
Hello Guys, I've been working around with "Rules and Connectors" and "Detection Rules" in order to get a notification when one of my beats stops sending data. Each beat has different indexes, so i would like to "know" i… --- ## [Two node cluster - Keep certain indexes on primary instance](https://discuss.elastic.co/t/two-node-cluster-keep-certain-indexes-on-primary-instance/283050)
**Author:** [@save4elastic](https://discuss.elastic.co/u/save4elastic)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 2:29pm UTC](https://discuss.elastic.co/t/two-node-cluster-keep-certain-indexes-on-primary-instance/283050 "2021-09-01T14:29:51Z")
Is it possible to keep certain high usage indices on the more powerful instance and offload indexes that are older to a low power instance? I am hoping to keep all shards of new indexes on the primary instance to increas… --- ## [Filebeat 7.14.0 filestream input field log.offset is character count of the line](https://discuss.elastic.co/t/filebeat-7-14-0-filestream-input-field-log-offset-is-character-count-of-the-line/282956)
**Author:** [@Michael\_Savettiere](https://discuss.elastic.co/u/Michael_Savettiere)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-7-14-0-filestream-input-field-log-offset-is-character-count-of-the-line/282956 "2021-09-01T14:22:10Z")
Using Filebeat 7.14.0 input: filestream and output.console: pretty: true I see that the value of log.offset is the size of the event.message and not the offset from the beginning of the file. I used to use input: log an… --- ## [From logstash how to lookup on a data in elastic index?](https://discuss.elastic.co/t/from-logstash-how-to-lookup-on-a-data-in-elastic-index/281387)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 10\ **Last updated:** [August 18, 2021, 6:36pm UTC](https://discuss.elastic.co/t/from-logstash-how-to-lookup-on-a-data-in-elastic-index/281387 "2021-08-18T18:36:15Z")
Need a support, i have created a lookup index in elastic search index - lookup Username;Identifier;First name;Last name booker12;l9012;Rachel;Booker grey07;l2070;Laura;Grey johnson81;l4081;Craig;Johnson jenkins46;… --- ## [Is Update By Query API a good choice to update single document in elasticsearch?](https://discuss.elastic.co/t/is-update-by-query-api-a-good-choice-to-update-single-document-in-elasticsearch/283035)
**Author:** [@Karthikeyan\_Amaresan](https://discuss.elastic.co/u/Karthikeyan_Amaresan)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 1:30pm UTC](https://discuss.elastic.co/t/is-update-by-query-api-a-good-choice-to-update-single-document-in-elasticsearch/283035 "2021-09-01T13:30:16Z")
I have a use case where i want to update the document without knowing its index. Currently i am querying by id and getting the index and then updating (2 operation). Update By Query API seems to perform this use case in … --- ## [Поиск в индексе с "грязными" данными](https://discuss.elastic.co/t/topic/282814)
**Author:** [@Jenya87](https://discuss.elastic.co/u/Jenya87)\ **Replies:** 7\ **Last updated:** [September 1, 2021, 1:21pm UTC](https://discuss.elastic.co/t/topic/282814 "2021-09-01T13:21:46Z")
Доброго времени суток. Иcпользую ES 7.13. Есть индекс, созданный программой FSCrawler. В самом индексе есть данные о номерах телефона, но вот беда, их формат может быть: 7(999)111-22-333 или 7-999-111-22-333 или 7.999.… [Previous page](https://discuss.elastic.co/latest.md?page=1497) [Next page](https://discuss.elastic.co/latest.md?page=1499)