# Latest **URL:** https://discuss.elastic.co/latest.md?page=1535 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1536 --- ## [Query\_suggestion and filters](https://discuss.elastic.co/t/query-suggestion-and-filters/280569)
**Author:** [@Carlos\_Redondo](https://discuss.elastic.co/u/Carlos_Redondo)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 5:41pm UTC](https://discuss.elastic.co/t/query-suggestion-and-filters/280569 "2021-08-09T17:41:34Z")
It looks like this feature has been requested in the past. Search Query Filter is basic functionality that allowed us to define "restrictions" to documents a web user has access to, but our web users are seeing Suggest… --- ## [Elasticsearch help understanding Update by query version conflicts](https://discuss.elastic.co/t/elasticsearch-help-understanding-update-by-query-version-conflicts/280838)
**Author:** [@mgargi01](https://discuss.elastic.co/u/mgargi01)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 4:25pm UTC](https://discuss.elastic.co/t/elasticsearch-help-understanding-update-by-query-version-conflicts/280838 "2021-08-09T16:25:13Z")
Hi - ELastic 7.6.1: I am adding some new field mappings to my index. the index is set to "dynamic" : "strict", so after the mappings are added, I run: POST index.test/\_update\_by\_query?refresh&conflicts=proceed to u… --- ## [Is it possible to set custom colors for Lens filters on a Pie/Donut?](https://discuss.elastic.co/t/is-it-possible-to-set-custom-colors-for-lens-filters-on-a-pie-donut/280590)
**Author:** [@PanoramicPanda](https://discuss.elastic.co/u/PanoramicPanda)\ **Replies:** 4\ **Last updated:** [August 9, 2021, 4:09pm UTC](https://discuss.elastic.co/t/is-it-possible-to-set-custom-colors-for-lens-filters-on-a-pie-donut/280590 "2021-08-09T16:09:07Z")
Trying to convert legacy visualizations to Lens ones, and the thing that's sticking out to me as a sore spot is that I can't figure out how to get specific colors for keywords/filters. The colors in Lens group into the … --- ## [Logstash pipeline error at line 1 column 1](https://discuss.elastic.co/t/logstash-pipeline-error-at-line-1-column-1/280746)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 4\ **Last updated:** [August 9, 2021, 4:05pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-at-line-1-column-1/280746 "2021-08-09T16:05:57Z")
I get this error: \[2021-08-08T20:15:12,553\]\[INFO \]\[logstash.agent \] Successfully started Logstash API endpoint {:port=\>9600} \[2021-08-08T20:15:13,441\]\[ERROR\]\[logstash.agent \] Failed to execute action… --- ## [How does elasticsearch return buckets when aggs by sum is used?](https://discuss.elastic.co/t/how-does-elasticsearch-return-buckets-when-aggs-by-sum-is-used/280740)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 4:00pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-return-buckets-when-aggs-by-sum-is-used/280740 "2021-08-09T16:00:23Z")
By default, the terms aggregation will return the buckets for the top ten terms ordered by the doc\_count . One can change this default behaviour by setting the size parameter. If I am doing a search like below, how … --- ## [ECK Fail to update status field of elasticsearch cluster on EKS 1.19](https://discuss.elastic.co/t/eck-fail-to-update-status-field-of-elasticsearch-cluster-on-eks-1-19/279246)
**Author:** [@Francesco\_Ciocchetti](https://discuss.elastic.co/u/Francesco_Ciocchetti)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 3:51pm UTC](https://discuss.elastic.co/t/eck-fail-to-update-status-field-of-elasticsearch-cluster-on-eks-1-19/279246 "2021-08-09T15:51:40Z")
Hi, i am trying to get a cluster running on EKS 1.19 to sucessfully create an elasticsearchcluster using the ECK operator 1.6 the cluster gets created just fine when i create the elasticsearch resource and i can see the… --- ## [How to increase query results limit of 10,000 results per search in AppSearch](https://discuss.elastic.co/t/how-to-increase-query-results-limit-of-10-000-results-per-search-in-appsearch/280770)
**Author:** [@Subhasis\_Dash](https://discuss.elastic.co/u/Subhasis_Dash)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 3:49pm UTC](https://discuss.elastic.co/t/how-to-increase-query-results-limit-of-10-000-results-per-search-in-appsearch/280770 "2021-08-09T15:49:20Z")
AppSearch has a limit of max 10,000 search results per query. Is this value configurable? We have a requirement where we need to parse through all the search results for a particular filter condition, and update the re… --- ## [From single-node cluster to multi-nodes cluster](https://discuss.elastic.co/t/from-single-node-cluster-to-multi-nodes-cluster/280777)
**Author:** [@Rosanna\_Staiano](https://discuss.elastic.co/u/Rosanna_Staiano)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 3:18pm UTC](https://discuss.elastic.co/t/from-single-node-cluster-to-multi-nodes-cluster/280777 "2021-08-09T15:18:53Z")
Hello! I have a single-node cluster with the "discovery.type: single node" setup, and I want to turn it into a multi-node cluster. Could you give me some advice to make this conversion in the best way? I'm using Elast… --- ## [Link in Markdown panel to dashboard with specific time and refresh interval?](https://discuss.elastic.co/t/link-in-markdown-panel-to-dashboard-with-specific-time-and-refresh-interval/274985)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 5\ **Last updated:** [August 9, 2021, 2:55pm UTC](https://discuss.elastic.co/t/link-in-markdown-panel-to-dashboard-with-specific-time-and-refresh-interval/274985 "2021-08-09T14:55:05Z")
I'm using TSVB Markdown panels to present links to dashboards, like this: \[Dashboard title\](#/dashboard/88da11e0-9c58-11eb-b38d-7b8e5ab9c930) Such links are independent of the current space, which is how I like them. T… --- ## [Cannot delete winlogbeat indices using curator](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 2:48pm UTC](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679 "2021-08-09T14:48:03Z")
Hi there, I´m trying to use curator but something is not right. Can someone try to help me?? Following the config that I have: config.yml client: hosts: - XX.XX.XX.XX port: 9200 url\_prefix: use\_ssl: true … --- ## [Configuring the logs in apm-server](https://discuss.elastic.co/t/configuring-the-logs-in-apm-server/280730)
**Author:** [@Santhosh\_Reddy](https://discuss.elastic.co/u/Santhosh_Reddy)\ **Replies:** 4\ **Last updated:** [August 9, 2021, 2:47pm UTC](https://discuss.elastic.co/t/configuring-the-logs-in-apm-server/280730 "2021-08-09T14:47:33Z")
Kibana version: 7.13.2 Elasticsearch version: 7.13.2 APM Server version: 7.13.2 APM Agent language and version: node v14.17.3 Browser version: Safari Version 14.1 (16611.1.21.161.6) Description: Server logs are rend… --- ## [Elasticsearch wont start with FIPS Mode Enabled](https://discuss.elastic.co/t/elasticsearch-wont-start-with-fips-mode-enabled/280758)
**Author:** [@Zoheb\_Khan](https://discuss.elastic.co/u/Zoheb_Khan)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 2:44pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-with-fips-mode-enabled/280758 "2021-08-09T14:44:37Z")
I am not able to bring-up elasticsearch service in FIPS mode 140-2. I keep getting exception : org.elasticsearch.bootstrap.StartupException: org.elasticsearch.common.ssl.SslConfigException: failed to find a X509Extende… --- ## [Elastic Search App Search - in - FLUTTER](https://discuss.elastic.co/t/elastic-search-app-search-in-flutter/280111)
**Author:** [@vivekdabhi](https://discuss.elastic.co/u/vivekdabhi)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 2:28pm UTC](https://discuss.elastic.co/t/elastic-search-app-search-in-flutter/280111 "2021-08-09T14:28:26Z")
Flutter is hot coding language now a days, I have many clients needs app and web with advance search functionality. ES App Search is one of the best tool I have seen, but i can't find any reference for Flutter to use su… --- ## [Size of an index is very less than the raw document size when ingested via logstash](https://discuss.elastic.co/t/size-of-an-index-is-very-less-than-the-raw-document-size-when-ingested-via-logstash/280812)
**Author:** [@madhanbaskar](https://discuss.elastic.co/u/madhanbaskar)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 2:23pm UTC](https://discuss.elastic.co/t/size-of-an-index-is-very-less-than-the-raw-document-size-when-ingested-via-logstash/280812 "2021-08-09T14:23:23Z")
I have a JSON file which has 93k records in it. The size of the JSON file is 413MB. When Indexed via logstash it is just 88MB in the index. I could see all the records ingested. Index setting : I have 50 fields for ind… --- ## [ElasticSearch/Kibana install on CENT/REHL](https://discuss.elastic.co/t/elasticsearch-kibana-install-on-cent-rehl/280583)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 11\ **Last updated:** [August 9, 2021, 2:03pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-install-on-cent-rehl/280583 "2021-08-09T14:03:55Z")
Good Afternoon; I have been working with ELK now for 3.5 months and as I am going to be deploying this in RHEL in the near future it was time to move away from the Windows deployment that I have been testing with. So I… --- ## [Yarn start error: Permission denied](https://discuss.elastic.co/t/yarn-start-error-permission-denied/280501)
**Author:** [@wenqi73](https://discuss.elastic.co/u/wenqi73)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 1:12pm UTC](https://discuss.elastic.co/t/yarn-start-error-permission-denied/280501 "2021-08-09T13:12:02Z")
I tried to develop kibana and run the commands in Getting started | Kibana Guide \[7.14\] | Elastic, when I run yarn start --run-examples the terminal threw an error: user/git/kibana/node\_modules/lmdb-store/index.js:77 … --- ## [Gsub doesn't replace the given char](https://discuss.elastic.co/t/gsub-doesnt-replace-the-given-char/280783)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 1:02pm UTC](https://discuss.elastic.co/t/gsub-doesnt-replace-the-given-char/280783 "2021-08-09T13:02:43Z")
Hi Team, I'm trying to replace a char with another char in a string field, but it doesn't looks like it is doing the job, please is there anyone to help me in correcting this. Here is an example of what I'm doing , "s… --- ## [Parsing data in Kibana](https://discuss.elastic.co/t/parsing-data-in-kibana/280791)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 12:33pm UTC](https://discuss.elastic.co/t/parsing-data-in-kibana/280791 "2021-08-09T12:33:55Z")
Hi all, i have data like this, How do i parsing this data? I need data id or data amount to have its own labels. --- ## [Inconsistent completion suggester results size](https://discuss.elastic.co/t/inconsistent-completion-suggester-results-size/280807)
**Author:** [@abido](https://discuss.elastic.co/u/abido)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 12:05pm UTC](https://discuss.elastic.co/t/inconsistent-completion-suggester-results-size/280807 "2021-08-09T12:05:09Z")
Hello, I am getting weird behaviour with the number of results returned by the Completion Suggester. I have the following request body for example: "suggest": { "title": { "prefix": "ja", "completion": { … --- ## [Elastic Agent with Synthetics Integration- Adding TCP monitor break the Agent](https://discuss.elastic.co/t/elastic-agent-with-synthetics-integration-adding-tcp-monitor-break-the-agent/280651)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 6\ **Last updated:** [August 9, 2021, 11:31am UTC](https://discuss.elastic.co/t/elastic-agent-with-synthetics-integration-adding-tcp-monitor-break-the-agent/280651 "2021-08-09T11:31:50Z")
Hi All, I have an Elastic Agent Installed with synthetic integration (heartbeat). Adding HTTP and ICMP monitors work fine but when I tried adding a TCP monitor with the correct host:port format the agent become unhealth… --- ## [How to scrape a page with logstash](https://discuss.elastic.co/t/how-to-scrape-a-page-with-logstash/279892)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 11:26am UTC](https://discuss.elastic.co/t/how-to-scrape-a-page-with-logstash/279892 "2021-08-09T11:26:11Z")
We have an application that does not save to the database in real time, however it has a page that has some information in real time, I would like to access and scrape this information and put it inside elasticseach. ob… --- ## [Gem/Bundler errors while installing a new logstash filter](https://discuss.elastic.co/t/gem-bundler-errors-while-installing-a-new-logstash-filter/280797)
**Author:** [@lionaneesh](https://discuss.elastic.co/u/lionaneesh)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 11:23am UTC](https://discuss.elastic.co/t/gem-bundler-errors-while-installing-a-new-logstash-filter/280797 "2021-08-09T11:23:01Z")
I am trying to install the logstash-filter-goaudit plugin on my kubernetes pod running logstash image: docker.elastic.co/logstash/logstash-oss:6.4.1 . We are still on ES 6.6 and am currently trying to onboard goaudit log… --- ## [Phrase\_prefix with cross\_fields](https://discuss.elastic.co/t/phrase-prefix-with-cross-fields/280792)
**Author:** [@Razvan\_Todea](https://discuss.elastic.co/u/Razvan_Todea)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 10:48am UTC](https://discuss.elastic.co/t/phrase-prefix-with-cross-fields/280792 "2021-08-09T10:48:02Z")
We want the following use case, if a record is saved in the database with the following fields. { "id": 1, "name": "Benefit", "address": "Supersonic" } Queries such as these should match: ben benefit super ben… --- ## [Filebeat setup command receives timeout form kibana](https://discuss.elastic.co/t/filebeat-setup-command-receives-timeout-form-kibana/280795)
**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 11:04am UTC](https://discuss.elastic.co/t/filebeat-setup-command-receives-timeout-form-kibana/280795 "2021-08-09T11:04:42Z")
Hi, I have filebeat installed, and whenever i try to tun the setup command to load dashboards to kibana(from the f5 module) i recieve a timeout error. Kibana is up and running and reacheable, so I dont really understan… --- ## [Incorrect shard allocation](https://discuss.elastic.co/t/incorrect-shard-allocation/280359)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 10:32am UTC](https://discuss.elastic.co/t/incorrect-shard-allocation/280359 "2021-08-09T10:32:19Z")
i have 15nodes cluster with various mix of datasources 8% is larger shards 10-30GB size. 30% is smaller shards 1-15GB. And majority is very small shards megabites 60%. The reason of having small shards is having lot of … --- ## [The ES index does not generate fields parsed by logstash](https://discuss.elastic.co/t/the-es-index-does-not-generate-fields-parsed-by-logstash/280786)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 9:55am UTC](https://discuss.elastic.co/t/the-es-index-does-not-generate-fields-parsed-by-logstash/280786 "2021-08-09T09:55:17Z")
I used logstash to parse the JSON log, but the ES index did not generate the corresponding fields logstash config: filter { if \[service\] == "roomtest" { grok { match =\> { "messag… --- ## [Load balancing data from Filebeat to Logstash using Nginx](https://discuss.elastic.co/t/load-balancing-data-from-filebeat-to-logstash-using-nginx/179473)
**Author:** [@Nikhil04](https://discuss.elastic.co/u/Nikhil04)\ **Replies:** 8\ **Last updated:** [August 9, 2021, 9:35am UTC](https://discuss.elastic.co/t/load-balancing-data-from-filebeat-to-logstash-using-nginx/179473 "2021-08-09T09:35:16Z")
Hello, I have ELK cluster with 3 nodes for elasticsearch(master+data) , 2 nodes for logstash(Active and Passive) and 2 for kibana.I have to utilize both the logstash nodes. I am using filebeat to parse logs and send da… --- ## [Cannot update field mapping with custom normalizer](https://discuss.elastic.co/t/cannot-update-field-mapping-with-custom-normalizer/280782)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 9:14am UTC](https://discuss.elastic.co/t/cannot-update-field-mapping-with-custom-normalizer/280782 "2021-08-09T09:14:25Z")
Trying to extends a field mapper returns exception... The field: ... "detail.data.myfield": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 … --- ## [Make Elasticsearch running as a service?](https://discuss.elastic.co/t/make-elasticsearch-running-as-a-service/280510)
**Author:** [@Veak](https://discuss.elastic.co/u/Veak)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 9:11am UTC](https://discuss.elastic.co/t/make-elasticsearch-running-as-a-service/280510 "2021-08-09T09:11:16Z")
Hello, i've installed the elasticsearch 7.x on a raspberry PI 4B on ubuntu 20.04. I've installed it manually with the .tgz. It's working fine when i launch it manually with the command : ./elasticsearch -d (in the di… --- ## [The number of indexes is increasing day by day, and the kibana dashboard shows that indexes are getting slower and slower](https://discuss.elastic.co/t/the-number-of-indexes-is-increasing-day-by-day-and-the-kibana-dashboard-shows-that-indexes-are-getting-slower-and-slower/280618)
**Author:** [@yt\_h](https://discuss.elastic.co/u/yt_h)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 8:49am UTC](https://discuss.elastic.co/t/the-number-of-indexes-is-increasing-day-by-day-and-the-kibana-dashboard-shows-that-indexes-are-getting-slower-and-slower/280618 "2021-08-09T08:49:53Z")
elastic search version：7.5.1 kibana：7.5.1 3 master roles, 3 data roles, 6 nodes in total. It takes a few minutes to query the index, this is the fragmentation state. GET \_cluster/health { "cluster\_name": "elastics… [Previous page](https://discuss.elastic.co/latest.md?page=1534) [Next page](https://discuss.elastic.co/latest.md?page=1536)