# Latest **URL:** https://discuss.elastic.co/latest.md?page=1571 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1572 --- ## [Kibana cannot perform migrations due to validation error](https://discuss.elastic.co/t/kibana-cannot-perform-migrations-due-to-validation-error/278678)
**Author:** [@dbernard](https://discuss.elastic.co/u/dbernard)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 3:13pm UTC](https://discuss.elastic.co/t/kibana-cannot-perform-migrations-due-to-validation-error/278678 "2021-07-15T15:13:26Z")
Kibana is unable to perform migrations and then reports it cannot connect to elastic search. elasticsearch is running locally. Upgrading to 7.11.2 elasticsearch and kibana. "type":"log","@timestamp":"2021-07-14T14:02:… --- ## [Kibana not starting](https://discuss.elastic.co/t/kibana-not-starting/278516)
**Author:** [@123451](https://discuss.elastic.co/u/123451)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 3:02pm UTC](https://discuss.elastic.co/t/kibana-not-starting/278516 "2021-07-15T15:02:05Z")
Good morning all, My kibana is not starting, when I run the command systemctl status kibana. this is what I get. I don't know what seems to be the issue --- ## [JDBC Timestamp doesn't refresh, leads to large queues](https://discuss.elastic.co/t/jdbc-timestamp-doesnt-refresh-leads-to-large-queues/278393)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 3:00pm UTC](https://discuss.elastic.co/t/jdbc-timestamp-doesnt-refresh-leads-to-large-queues/278393 "2021-07-15T15:00:11Z")
Hi all, I am using the jdbc plugin with LS 7.13.2 to retrieve records from an Oracle DB. When users make changes to their info, I record the timestamp of the change in the dateChanged column of the DB. Through the jdbc … --- ## [ELasticsearch 7.9.1 won't start](https://discuss.elastic.co/t/elasticsearch-7-9-1-wont-start/278808)
**Author:** [@Barry\_Dupont](https://discuss.elastic.co/u/Barry_Dupont)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 2:39pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-1-wont-start/278808 "2021-07-15T14:39:29Z")
My problem is that ELasticsearch won't start, so i checked log /var/log/elasticsearch/elasticsearch.log and I Got an error concerning 'Lucene\_87 missing' Caused by: java.lang.IllegalArgumentException: An SPI class of … --- ## [ECE 2.10.1 released](https://discuss.elastic.co/t/ece-2-10-1-released/278806)
**Author:** [@marclop](https://discuss.elastic.co/u/marclop)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 2:35pm UTC](https://discuss.elastic.co/t/ece-2-10-1-released/278806 "2021-07-15T14:35:17Z")
We are pleased to announce that ECE 2.10.1 has been released today. Release notes: Elastic Cloud Enterprise 2.10.1 | Elastic Cloud Enterprise Reference \[2.10\] | Elastic --- ## [How to create a watcher alert if a specific service goes down on a system which is monitored using metricbeat agent?](https://discuss.elastic.co/t/how-to-create-a-watcher-alert-if-a-specific-service-goes-down-on-a-system-which-is-monitored-using-metricbeat-agent/278464)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 2:34pm UTC](https://discuss.elastic.co/t/how-to-create-a-watcher-alert-if-a-specific-service-goes-down-on-a-system-which-is-monitored-using-metricbeat-agent/278464 "2021-07-15T14:34:31Z")
I have few systems on which I have metricbeat v7.12.1 installed. How can I configure the watcher alert to send me an email if the service called testservice.exe goes down on server A? --- ## [Kibana Dashboard align all visualiazations to left](https://discuss.elastic.co/t/kibana-dashboard-align-all-visualiazations-to-left/278659)
**Author:** [@sandy13sharma2006](https://discuss.elastic.co/u/sandy13sharma2006)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 2:34pm UTC](https://discuss.elastic.co/t/kibana-dashboard-align-all-visualiazations-to-left/278659 "2021-07-15T14:34:05Z")
Hi Team, I'm using Elasticsearch 7.11.2 and Kibana 7.11.2 docker image when I trying to access the Dashboard, all visualizations are getting align to left side as per image. All respective visualizations and index-patte… --- ## [Change distribution version number](https://discuss.elastic.co/t/change-distribution-version-number/278719)
**Author:** [@prandelicious](https://discuss.elastic.co/u/prandelicious)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 2:32pm UTC](https://discuss.elastic.co/t/change-distribution-version-number/278719 "2021-07-15T14:32:44Z")
Every time I run make release, it always creates beats-8.0.0-platform.tar.gz. Is there a way to change the version number? --- ## [Aggregate combinations of nested documents](https://discuss.elastic.co/t/aggregate-combinations-of-nested-documents/278796)
**Author:** [@Andy\_Gout](https://discuss.elastic.co/u/Andy_Gout)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 1:52pm UTC](https://discuss.elastic.co/t/aggregate-combinations-of-nested-documents/278796 "2021-07-15T13:52:49Z")
Using Elasticsearch, I would like to aggregate combinations of nested documents. Take a hypothetical index of movie data with these mappings: { mappings: { properties: { title: { type: 'keyword' }, peop… --- ## [Same level script aggregation](https://discuss.elastic.co/t/same-level-script-aggregation/278631)
**Author:** [@Ivan\_Janev](https://discuss.elastic.co/u/Ivan_Janev)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 1:16pm UTC](https://discuss.elastic.co/t/same-level-script-aggregation/278631 "2021-07-15T13:16:15Z")
I'm wondering if it is possible to do a same level script aggregation in ES. Let's say I have 2 fields in my documents sales and spend. This is the result I want to achieve: { "size": 0, "query": { "match\_all": … --- ## [Error on parsing gzip files "Unexpected end of ZLIB input stream"](https://discuss.elastic.co/t/error-on-parsing-gzip-files-unexpected-end-of-zlib-input-stream/278789)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 1:09pm UTC](https://discuss.elastic.co/t/error-on-parsing-gzip-files-unexpected-end-of-zlib-input-stream/278789 "2021-07-15T13:09:31Z")
I have a gzip file about ~600MB that seems to be running into a plugin error mentioned below . \[2021-07-15T13:00:29,121\]\[ERROR\]\[logstash.javapipeline \]\[main\]\[4ea2794871220248b7ea22dd607e71d79bddbc1bff243a66da02aa3b… --- ## [Issues in performance](https://discuss.elastic.co/t/issues-in-performance/278788)
**Author:** [@Arthi\_Jaiswal](https://discuss.elastic.co/u/Arthi_Jaiswal)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 1:07pm UTC](https://discuss.elastic.co/t/issues-in-performance/278788 "2021-07-15T13:07:18Z")
I have a case where I am ingesting over 5 MN log lines / minute into logstash hosted on an Azure . The performance is really sluggish Any recommendations on how I can improve the performance --- ## [Data redundancy with a single nested level vs multilevel nested document](https://discuss.elastic.co/t/data-redundancy-with-a-single-nested-level-vs-multilevel-nested-document/278471)
**Author:** [@sai\_Yeluri](https://discuss.elastic.co/u/sai_Yeluri)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 1:04pm UTC](https://discuss.elastic.co/t/data-redundancy-with-a-single-nested-level-vs-multilevel-nested-document/278471 "2021-07-15T13:04:10Z")
Is it better to have a data redundancy with single nested object or maintain multilevel nested document? There are performance concerns when nested types are used, as per elasticsearch documentation Nested field type | … --- ## [Kibana service start failed](https://discuss.elastic.co/t/kibana-service-start-failed/278566)
**Author:** [@swarali\_vartak](https://discuss.elastic.co/u/swarali_vartak)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 12:55pm UTC](https://discuss.elastic.co/t/kibana-service-start-failed/278566 "2021-07-15T12:55:32Z")
Hi Team, I have standalone server where I downloaded elastic and kibana 7.12.1 in RPM on cent os server After downloading i have install elastic and kibana from below command rpm -i elasticseach-7.12.1-x86\_64.rpm Aft… --- ## [Kafka output dropping single message every time connection to kafka is lost](https://discuss.elastic.co/t/kafka-output-dropping-single-message-every-time-connection-to-kafka-is-lost/278632)
**Author:** [@tporeba](https://discuss.elastic.co/u/tporeba)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 12:43pm UTC](https://discuss.elastic.co/t/kafka-output-dropping-single-message-every-time-connection-to-kafka-is-lost/278632 "2021-07-15T12:43:18Z")
I tested the behaviour of filebeat kafka output when connection to kafka is lost and recovered. Events are correctly redelivered even if the connection is down for a few minutes, but I observe a single event (probably fi… --- ## [Running ELK Services as Root](https://discuss.elastic.co/t/running-elk-services-as-root/278673)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:38pm UTC](https://discuss.elastic.co/t/running-elk-services-as-root/278673 "2021-07-15T12:38:14Z")
I am utilizing the full ELK stack in Linux including beats and logstash. I have found a few posts online that recommend not running these services as root such as this discussion post. I tried to find some more informat… --- ## [How to calculate read/write throughput at cluster level?](https://discuss.elastic.co/t/how-to-calculate-read-write-throughput-at-cluster-level/278775)
**Author:** [@Bhagwati\_Malav](https://discuss.elastic.co/u/Bhagwati_Malav)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 12:35pm UTC](https://discuss.elastic.co/t/how-to-calculate-read-write-throughput-at-cluster-level/278775 "2021-07-15T12:35:44Z")
I am working on designing es cluster with below given setup master nodes 3 (m5.a large) 2vcpu, 8gb data nodes 2 (m5.ax large) 4vcpu, 16 gb Keeping default elastic configuration currently. read thread pool - 7 write … --- ## [Indices in delete phase are actually not being deleted](https://discuss.elastic.co/t/indices-in-delete-phase-are-actually-not-being-deleted/278764)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:22pm UTC](https://discuss.elastic.co/t/indices-in-delete-phase-are-actually-not-being-deleted/278764 "2021-07-15T12:22:34Z")
Actually, a duplicate subject, but this one is no longer an issue related to the kibana bug. I just upgrade my cluster to 7.13 and the issue remains. My indices are not deleted in the "delete" phase of ilm. The ILM sett… --- ## [Kibana throws error in chrome version 91.0.4472.124](https://discuss.elastic.co/t/kibana-throws-error-in-chrome-version-91-0-4472-124/278760)
**Author:** [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:07pm UTC](https://discuss.elastic.co/t/kibana-throws-error-in-chrome-version-91-0-4472-124/278760 "2021-07-15T12:07:48Z")
I am unable to load kibana 7.8.1 in Google Chrome Version 91.0.4472.124 (Official Build) (64-bit) Build: 32141 It takes the pages ages to load and when it does, the following error is displayed. This works fine in Mic… --- ## [Convert String to Date](https://discuss.elastic.co/t/convert-string-to-date/278782)
**Author:** [@Meryem\_BS](https://discuss.elastic.co/u/Meryem_BS)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 12:01pm UTC](https://discuss.elastic.co/t/convert-string-to-date/278782 "2021-07-15T12:01:33Z")
Hello, In the logs I upload to Kibana have a "mytimestamp" field, supposedly of type Date but when I inject the logs and parsed it in json, my timestamp is converted to type string. Do you know how can I convert my tim… --- ## [Save NodeClient variable to disk](https://discuss.elastic.co/t/save-nodeclient-variable-to-disk/278773)
**Author:** [@daksh0225](https://discuss.elastic.co/u/daksh0225)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 11:33am UTC](https://discuss.elastic.co/t/save-nodeclient-variable-to-disk/278773 "2021-07-15T11:33:30Z")
Hi all, I have been modifying the source code to accomodate some custom features that I would like to have. In doing so, I have added some new class variables to NodeClient. Currently, these variables do not persist ove… --- ## [Weird index shard allocation behaviour](https://discuss.elastic.co/t/weird-index-shard-allocation-behaviour/278734)
**Author:** [@Lefty](https://discuss.elastic.co/u/Lefty)\ **Replies:** 6\ **Last updated:** [July 15, 2021, 11:30am UTC](https://discuss.elastic.co/t/weird-index-shard-allocation-behaviour/278734 "2021-07-15T11:30:10Z")
Hello everyone, I wonder if you can help me - I have a very weird problem I am running the ELK stack version 7.12.0 I have a 5 data node Elastic cluster - 8 TB of disk each 32GB RAM, 8 CPUs Utilization of disk on the… --- ## [Winlogbeat Original Field remove](https://discuss.elastic.co/t/winlogbeat-original-field-remove/278768)
**Author:** [@Frack](https://discuss.elastic.co/u/Frack)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 11:07am UTC](https://discuss.elastic.co/t/winlogbeat-original-field-remove/278768 "2021-07-15T11:07:23Z")
Hi, Why some field are remove when convert to ECS ? For exemple DestinationIsIpv6 from sysmon: 'winlog.event\_data.SourceIsIpv6' is remove after create 'network.type'. As I have to work with beat agent and industrial… --- ## [Get group by and distinct count of values using other field in Elasticsearch](https://discuss.elastic.co/t/get-group-by-and-distinct-count-of-values-using-other-field-in-elasticsearch/278762)
**Author:** [@Vinay\_Ranjan](https://discuss.elastic.co/u/Vinay_Ranjan)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 10:06am UTC](https://discuss.elastic.co/t/get-group-by-and-distinct-count-of-values-using-other-field-in-elasticsearch/278762 "2021-07-15T10:06:16Z")
I have an index having document structure as below - { "key": \["10", "20"\], "keywords": \[ { 'case': 1, 'word': 'abc' }, { 'case': 2, 'word': 'def' }, { 'case': 1 … --- ## [Delete all indices exept some based on the index name](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536)
**Author:** [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 8:47am UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536 "2021-07-15T08:47:00Z")
Hello all, We are using curator to delete indices after a certain amount of time in our environments. I am facing an issue with understanding how to make it work for deleting indices based on time but leaving some indic… --- ## [Unable to embed Kibana dashboard on a reverse proxy server using Nginx](https://discuss.elastic.co/t/unable-to-embed-kibana-dashboard-on-a-reverse-proxy-server-using-nginx/278521)
**Author:** [@Fabian\_Matesa](https://discuss.elastic.co/u/Fabian_Matesa)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 8:46am UTC](https://discuss.elastic.co/t/unable-to-embed-kibana-dashboard-on-a-reverse-proxy-server-using-nginx/278521 "2021-07-15T08:46:51Z")
I am trying to embed a Kibana dashboard using Nginx, but keep getting a blank screen. No errors are thrown (except for the expected "inline script" error), but nothing gets loaded. Kibana is deployed on an Azure cloud, a… --- ## [Exporting detection rules and its exceptions](https://discuss.elastic.co/t/exporting-detection-rules-and-its-exceptions/278753)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 8:43am UTC](https://discuss.elastic.co/t/exporting-detection-rules-and-its-exceptions/278753 "2021-07-15T08:43:16Z")
how to export all detection rules along with its query into csv format from elasticsearch portal? how to export exceptions under each detection rule into csv format from elasticsearch portal? --- ## [Error in jvmgcmonitorservice (gc overhead)](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 9\ **Last updated:** [July 15, 2021, 8:13am UTC](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241 "2021-07-15T08:13:39Z")
I am having the following problem. $ cat /var/log/elasticsearch/elasticsearch.log | grep WARN \[2021-07-09T00:04:51,795\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[ITS-ELST-01\] \[gc\]\[young\]\[214003\]\[2290\] duration \[1.7s\], collec… --- ## [How to process logs from certain period of time? (I use elasticsearch input plugin)](https://discuss.elastic.co/t/how-to-process-logs-from-certain-period-of-time-i-use-elasticsearch-input-plugin/278702)
**Author:** [@John\_Smith1](https://discuss.elastic.co/u/John_Smith1)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 7:28am UTC](https://discuss.elastic.co/t/how-to-process-logs-from-certain-period-of-time-i-use-elasticsearch-input-plugin/278702 "2021-07-15T07:28:32Z")
In pipeline I receive logs from server with elasticsearch input plugin and I want to process not all logs, but for example only last 2 months, or, preferably from certain date to certain date. When I receive logs there… --- ## [Need Clarification Regarding Size Parameter in ES Query](https://discuss.elastic.co/t/need-clarification-regarding-size-parameter-in-es-query/278735)
**Author:** [@sayamiasis](https://discuss.elastic.co/u/sayamiasis)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 7:23am UTC](https://discuss.elastic.co/t/need-clarification-regarding-size-parameter-in-es-query/278735 "2021-07-15T07:23:27Z")
I wanted to know if there is a difference in executing these two queries when the result response is consisting of only 3 documents. query1: { "size":10, "query": { "bool":{ "must":\[ { "term":{ "t… [Previous page](https://discuss.elastic.co/latest.md?page=1570) [Next page](https://discuss.elastic.co/latest.md?page=1572)