# Latest **URL:** https://discuss.elastic.co/latest.md?page=1544 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1545 --- ## [Checking runner ip connectivity... FAILED Can't connect $RUNNER\_HOST\_IP \[172.xx.x.xx:22000\]: ConnectionError](https://discuss.elastic.co/t/checking-runner-ip-connectivity-failed-cant-connect-runner-host-ip-172-xx-x-xx-22000-connectionerror/278940)
**Author:** [@vjam](https://discuss.elastic.co/u/vjam)\ **Replies:** 21\ **Last updated:** [August 3, 2021, 5:31pm UTC](https://discuss.elastic.co/t/checking-runner-ip-connectivity-failed-cant-connect-runner-host-ip-172-xx-x-xx-22000-connectionerror/278940 "2021-08-03T17:31:26Z")
Hello All - We are trying to install Elastic (cloud-enterprise-version 2.8.1) in the following environment. AWS, RHEL-8 Docker (docker-ce-19.03.15) but seem to be constantly getting the error below Checking runner ip… --- ## [\_grokparsefailure is occurring even after the grok pattern is success](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 4:51pm UTC](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352 "2021-08-03T16:51:02Z")
Hi Team, I'm using logstash 6.8.3, and I'm trying to parse ES slow logs and my sample field is a ES source\_query which looks like {"from":0,"size":0,"post\_filter":{"bool":{"must":\[{"term":{"someId":{"value":1234,"boost… --- ## [Rally create-track limit document count](https://discuss.elastic.co/t/rally-create-track-limit-document-count/279916)
**Author:** [@mots](https://discuss.elastic.co/u/mots)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 4:10pm UTC](https://discuss.elastic.co/t/rally-create-track-limit-document-count/279916 "2021-08-03T16:10:59Z")
I am able to create a custom track following these instructions. But the target index I am using has over 5 mil documents. It's taking too long to create the custom track and I don't even need that many documents to run… --- ## [Aggregate destination ip addresses and destination ports](https://discuss.elastic.co/t/aggregate-destination-ip-addresses-and-destination-ports/280342)
**Author:** [@Marco\_Lazzarotto](https://discuss.elastic.co/u/Marco_Lazzarotto)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 3:38pm UTC](https://discuss.elastic.co/t/aggregate-destination-ip-addresses-and-destination-ports/280342 "2021-08-03T15:38:23Z")
I'm collecting hundreds of thousands of logs from a firewall (Cisco ASA). On every log record, among other details, I have destination ip addresses and destination ports. Now, I need to have an aggregated list of all d… --- ## [Af\_ Packet mode, local loopback data problem](https://discuss.elastic.co/t/af-packet-mode-local-loopback-data-problem/280335)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 3:12pm UTC](https://discuss.elastic.co/t/af-packet-mode-local-loopback-data-problem/280335 "2021-08-03T15:12:26Z")
Turn on af\_packet, a large number of reconnections occur in the traffic sniffed by the local loop. If pcap is turned on, there is no problem. The following figure is a screenshot of the file with the command dump ./pack… --- ## [ILM policy doesn't work for jaeger](https://discuss.elastic.co/t/ilm-policy-doesnt-work-for-jaeger/280333)
**Author:** [@heruv1m](https://discuss.elastic.co/u/heruv1m)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 2:59pm UTC](https://discuss.elastic.co/t/ilm-policy-doesnt-work-for-jaeger/280333 "2021-08-03T14:59:59Z")
I'm using elasticsearch as storage backend for jaeger. I initialized ilm, then created index. It worked well until 4-th index. On 4-th index ilm not applied anymore. Steps to reproduce Create ilm policy \_ilm/policy/… --- ## [Kibana alerts are not saved after modify them](https://discuss.elastic.co/t/kibana-alerts-are-not-saved-after-modify-them/278296)
**Author:** [@Felipe\_Illanes](https://discuss.elastic.co/u/Felipe_Illanes)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 3:09pm UTC](https://discuss.elastic.co/t/kibana-alerts-are-not-saved-after-modify-them/278296 "2021-08-03T15:09:19Z")
Hi there, first of all thank you for the help. Second, i have an issue when i try to save a new query in the section of Alerts and Actions in KIbana. I'll explain with images... After i updated the query, and add and… --- ## [Remove labels (or ownership) from secret](https://discuss.elastic.co/t/remove-labels-or-ownership-from-secret/280293)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 6\ **Last updated:** [August 3, 2021, 2:58pm UTC](https://discuss.elastic.co/t/remove-labels-or-ownership-from-secret/280293 "2021-08-03T14:58:34Z")
I want to edit / remove those labels from the elastic user secret eck.k8s.elastic.co/credentials: "true" eck.k8s.elastic.co/owner-kind: Elasticsearch eck.k8s.elastic.co/owner-name: myClusterName eck.k8s.… --- ## [Search-ui single sticky facet](https://discuss.elastic.co/t/search-ui-single-sticky-facet/280310)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 2:52pm UTC](https://discuss.elastic.co/t/search-ui-single-sticky-facet/280310 "2021-08-03T14:52:54Z")
Hello, I'm aware site-search doesnt support disjunctive facets, but I need this functionality for a single facet box , known values, single select option, 1 filter at the time I need a simple solution where you can sel… --- ## [Performance issue while viewing the dashboard](https://discuss.elastic.co/t/performance-issue-while-viewing-the-dashboard/278988)
**Author:** [@Noursh](https://discuss.elastic.co/u/Noursh)\ **Replies:** 9\ **Last updated:** [August 3, 2021, 2:48pm UTC](https://discuss.elastic.co/t/performance-issue-while-viewing-the-dashboard/278988 "2021-08-03T14:48:56Z")
we have a performance issue with the 7.13.2 version, some time it tooks a lot of time to load the dashboards, and even some of them wont load at all and returning me "no results found", these things didn't happened wi… --- ## [I can rename job machine learning?](https://discuss.elastic.co/t/i-can-rename-job-machine-learning/279201)
**Author:** [@fcarrasco](https://discuss.elastic.co/u/fcarrasco)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 2:35pm UTC](https://discuss.elastic.co/t/i-can-rename-job-machine-learning/279201 "2021-08-03T14:35:03Z")
Hi, i can rename job? I created job nifi\_collect, i need change to nifi\_collect\_others I've elastic 7.6.2 I see this index. \< green open .apm-agent-configuration xxxx 1 1 0 0 566b 283b … --- ## [Possible collision with user-defined field 'parameter' and built-in fields](https://discuss.elastic.co/t/possible-collision-with-user-defined-field-parameter-and-built-in-fields/280330)
**Author:** [@macs](https://discuss.elastic.co/u/macs)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 2:25pm UTC](https://discuss.elastic.co/t/possible-collision-with-user-defined-field-parameter-and-built-in-fields/280330 "2021-08-03T14:25:42Z")
Hey, I am working on an app where we tried to append a Logstash Marker with the custom key "parameter", containing a string with some information about where in the application the log event occured. Unfortunately, sinc… --- ## [ElasticSerach API - update by query script params null\_pointer\_exception](https://discuss.elastic.co/t/elasticserach-api-update-by-query-script-params-null-pointer-exception/280325)
**Author:** [@Savas12.01](https://discuss.elastic.co/u/Savas12.01)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 2:18pm UTC](https://discuss.elastic.co/t/elasticserach-api-update-by-query-script-params-null-pointer-exception/280325 "2021-08-03T14:18:41Z")
I am new to the ElasticSearch and am i trying to make use of the \_update\_by\_query route. I am sending this body: { "query": { "match": { "id": "fdfsfsfs-058f-437d-bc52-473808ba61c2" } }, "script": { … --- ## [Show Facets Data in a specific order](https://discuss.elastic.co/t/show-facets-data-in-a-specific-order/280199)
**Author:** [@anuragchoudhary01](https://discuss.elastic.co/u/anuragchoudhary01)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 1:10pm UTC](https://discuss.elastic.co/t/show-facets-data-in-a-specific-order/280199 "2021-08-03T13:10:04Z")
I am using the reference UI react project to display the search results and facets. But here the facets are being displayed in either descending order or in ascending order. But I need to display the results in a speci… --- ## [Static lookup](https://discuss.elastic.co/t/static-lookup/280182)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 1:06pm UTC](https://discuss.elastic.co/t/static-lookup/280182 "2021-08-03T13:06:04Z")
Hi ELK Users, I was working on static look up table on index pattern. As you can observe that, I have two keys which I am mapping to the same value I can see in the Discover section, that these values are getting re… --- ## [Can't divide two fields when querying an index](https://discuss.elastic.co/t/cant-divide-two-fields-when-querying-an-index/280264)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 9\ **Last updated:** [August 3, 2021, 11:59am UTC](https://discuss.elastic.co/t/cant-divide-two-fields-when-querying-an-index/280264 "2021-08-03T11:59:17Z")
Hello, I'm new to Elasticsearch and Kibana and I've been trying to create a watcher that alerts me when the free disk space ratio is lower than a defined value. I believe I've managed to build a working watcher however, … --- ## [Mapping private IP Address to geolocation with GeoIP Processor](https://discuss.elastic.co/t/mapping-private-ip-address-to-geolocation-with-geoip-processor/279981)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 11:54am UTC](https://discuss.elastic.co/t/mapping-private-ip-address-to-geolocation-with-geoip-processor/279981 "2021-08-03T11:54:55Z")
Hello, i am using a tool, that uses Elastic search. For retrieving the geolocaton of the IP Address a Json file was created that uses the GeoIP Processor. I updated this file in order to set the geolocation of the priva… --- ## [Elasticsearch input plugin size](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163)
**Author:** [@JFO\_90](https://discuss.elastic.co/u/JFO_90)\ **Replies:** 7\ **Last updated:** [August 3, 2021, 11:15am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163 "2021-08-03T11:15:25Z")
Hi, I have a logstash configuration from which I'm trying to extract elasticsearch information with the elasticsearch input plugin. The problem that i have is that despite indicating a size, it always returns all the do… --- ## [Disk.indices is higher than disk.used in cat allocation](https://discuss.elastic.co/t/disk-indices-is-higher-than-disk-used-in-cat-allocation/279853)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 13\ **Last updated:** [August 3, 2021, 11:02am UTC](https://discuss.elastic.co/t/disk-indices-is-higher-than-disk-used-in-cat-allocation/279853 "2021-08-03T11:02:35Z")
When I run the following command: GET \_cat/allocation?v&s=disk.indices&h=shards,disk.indices,disk.used,disk.available,disk.total,disk.percent it shows the following output: shards disk.indices disk.used disk.total dis… --- ## [Opentelemetry agent unable to connect APM Server over secure connection](https://discuss.elastic.co/t/opentelemetry-agent-unable-to-connect-apm-server-over-secure-connection/280150)
**Author:** [@nitin194](https://discuss.elastic.co/u/nitin194)\ **Replies:** 8\ **Last updated:** [August 3, 2021, 10:57am UTC](https://discuss.elastic.co/t/opentelemetry-agent-unable-to-connect-apm-server-over-secure-connection/280150 "2021-08-03T10:57:10Z")
Kibana version: 7.13.4 Elasticsearch version: 7.13.4 APM Server version: 7.13.4 APM Agent language and version: NA Browser version: NA Original install method (e.g. download page, yum, deb, from source, etc.) a… --- ## [More documentation on enterprise-search config options?](https://discuss.elastic.co/t/more-documentation-on-enterprise-search-config-options/280056)
**Author:** [@matp](https://discuss.elastic.co/u/matp)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 10:41am UTC](https://discuss.elastic.co/t/more-documentation-on-enterprise-search-config-options/280056 "2021-08-03T10:41:30Z")
I have elasticsearch and enterprise-search both running. In order to get them running together (with basic license) I had to enable SSL on the elasticsearch side in order to use API key as required by enterprise search … --- ## [How would be filter plugin for this desired output](https://discuss.elastic.co/t/how-would-be-filter-plugin-for-this-desired-output/280301)
**Author:** [@Srujan\_L](https://discuss.elastic.co/u/Srujan_L)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 10:25am UTC](https://discuss.elastic.co/t/how-would-be-filter-plugin-for-this-desired-output/280301 "2021-08-03T10:25:34Z")
my input file looks like {"msg1":"\\"abcd\\" : \\"msg2\\""} {"msg1":"\\"Dhhdk\\" : \\"msg3\\""} {"msg1":"\\"Djskdh\\" : \\"msg2\\""} {"msg1":"\\"ksgdh\\" : \\"msg\\""} {"msg1":"\\"hxvdb\\" : \\"msg\\""} my desired output should be like {… --- ## [Disable Fuzziness in Query](https://discuss.elastic.co/t/disable-fuzziness-in-query/280073)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 9:11am UTC](https://discuss.elastic.co/t/disable-fuzziness-in-query/280073 "2021-08-03T09:11:07Z")
I am fetching results with the following query where search is being done on Strings (Recipe name): let body2 = { size: 200, from: 0, sort : \[ { "@timestamp" : {"order": "desc", "form… --- ## [ES\_JAVA\_OPTS is ignore or not set](https://discuss.elastic.co/t/es-java-opts-is-ignore-or-not-set/280190)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 8:54am UTC](https://discuss.elastic.co/t/es-java-opts-is-ignore-or-not-set/280190 "2021-08-03T08:54:09Z")
Hi Team, I had setup elasticsearch cluster(version 6.8.14) using eck operator. I wanted to use more heapsize so I had set ES\_JAVA\_OPTS as "-Xms6g -Xmx6g". but it is taking the default heapsize which is 1g. Kindly help m… --- ## [Auditbeat: Combining data from both (system & file\_integrity) modules](https://discuss.elastic.co/t/auditbeat-combining-data-from-both-system-file-integrity-modules/280281)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 7:24am UTC](https://discuss.elastic.co/t/auditbeat-combining-data-from-both-system-file-integrity-modules/280281 "2021-08-03T07:24:06Z")
I am trying to list events from Auditbeat as below: In Kibana discovery, select Auditbeat index pattern Search for a file say, /etc/auditbeat/auditbeat.yml It lists records that do not show the username for changes/cr… --- ## [Rest API Issues with downloading visualisation/dashboard as png](https://discuss.elastic.co/t/rest-api-issues-with-downloading-visualisation-dashboard-as-png/280165)
**Author:** [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 7:17am UTC](https://discuss.elastic.co/t/rest-api-issues-with-downloading-visualisation-dashboard-as-png/280165 "2021-08-03T07:17:31Z")
HI Team, We are trying to download a kibana dashboard using the RESTAPI. http://localhost:5601/app/kibana#/dashboard/export?dashboard=7adfa750-4c81-11e8-b3d7-01146121b73d By specifying the dashboard id, Im able to do… --- ## [Details of Top N records](https://discuss.elastic.co/t/details-of-top-n-records/280224)
**Author:** [@ddramireddy](https://discuss.elastic.co/u/ddramireddy)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:09am UTC](https://discuss.elastic.co/t/details-of-top-n-records/280224 "2021-08-03T07:09:21Z")
Hi, I have an index with following schema: GroupName,Time,Value Example values: G1 2020-01-01 1:00:00. 10 G2 2020-01-01 1:00:00. 15 G3 2020-01-01 1:00:00. 20 G1 2020-01-01 2:00:00. 10 G2 2020-01-01 2:00:00. 20 G… --- ## [API/endpoint to get analyzer/filter details](https://discuss.elastic.co/t/api-endpoint-to-get-analyzer-filter-details/280254)
**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:06am UTC](https://discuss.elastic.co/t/api-endpoint-to-get-analyzer-filter-details/280254 "2021-08-03T07:06:35Z")
I have a synonyms analyzer with 2 filters configured to read from synonyms mapping files. I use the /\_analyze API to see how the analyzer processes text. But is there a way to get a summary of configured filters or ana… --- ## [Getting false hits on queries (boolean, match, term, and filters)](https://discuss.elastic.co/t/getting-false-hits-on-queries-boolean-match-term-and-filters/280100)
**Author:** [@encompassJeff](https://discuss.elastic.co/u/encompassJeff)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 6:53am UTC](https://discuss.elastic.co/t/getting-false-hits-on-queries-boolean-match-term-and-filters/280100 "2021-08-03T06:53:09Z")
I use Elastic to host an index used for managing list filters, which returns IDs matching a query, that I then use in Seek call on a SQL database to retrieve large sets of data with decent efficiency. Lately I've seen a … --- ## [Couldn't find any input plugin named 'google\_pubsub'. Are you sure this is correct?](https://discuss.elastic.co/t/couldnt-find-any-input-plugin-named-google-pubsub-are-you-sure-this-is-correct/280218)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 6:51am UTC](https://discuss.elastic.co/t/couldnt-find-any-input-plugin-named-google-pubsub-are-you-sure-this-is-correct/280218 "2021-08-03T06:51:50Z")
Hello, I noticed Kibana is no longer having Google cloud Stackdriver logs. So I started my troubleshooting with logstash and debug the .conf file, here's what I got: \[2021-08-02T20:08:44,540\]\[DEBUG\]\[logstash.plugins.re… [Previous page](https://discuss.elastic.co/latest.md?page=1543) [Next page](https://discuss.elastic.co/latest.md?page=1545)