# Latest **URL:** https://discuss.elastic.co/latest.md?page=1577 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1578 --- ## [Action failed with 'security\_exception](https://discuss.elastic.co/t/action-failed-with-security-exception/278400)
**Author:** [@dridk](https://discuss.elastic.co/u/dridk)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 7:44pm UTC](https://discuss.elastic.co/t/action-failed-with-security-exception/278400 "2021-07-12T19:44:34Z")
Ubuntu 20.04.2 LTS Kibana 7.13.3 ElasticSearch 7.13.3 After a kibana upgrade , I cannot restart the server. The webpage stay on "Kibana server is not ready yet" . My /var/log/kibana.log has : {"type":"log","@timest… --- ## [Split a field for a specific pattern](https://discuss.elastic.co/t/split-a-field-for-a-specific-pattern/278465)
**Author:** [@mvasqueznr](https://discuss.elastic.co/u/mvasqueznr)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 7:26pm UTC](https://discuss.elastic.co/t/split-a-field-for-a-specific-pattern/278465 "2021-07-12T19:26:02Z")
Hi. I have a log like this: 12:32:46 2021/06/28 ZBXTRAP 192.168.50.135 PDU INFO: notificationtype INFORM version 1 receivedfrom UDP: \[192.168.50.135\]:10756-\>\[… --- ## [Bug in visualization without title in dashboard](https://discuss.elastic.co/t/bug-in-visualization-without-title-in-dashboard/278461)
**Author:** [@Martin\_R\_Disandro](https://discuss.elastic.co/u/Martin_R_Disandro)\ **Replies:** 3\ **Last updated:** [July 12, 2021, 7:15pm UTC](https://discuss.elastic.co/t/bug-in-visualization-without-title-in-dashboard/278461 "2021-07-12T19:15:35Z")
Panel option is overlapping the first occurrence and doesn't allow to interact with it. Browser: Firefox 89 Kibana: 7.12.1 and 7.13.3 Steps to reproduce: Create dashboard Edit "Create Visualization" button "Save … --- ## [Assistance needed in creating a watcher alert for specific hostnames if the CPU/memory goes above certain threshold](https://discuss.elastic.co/t/assistance-needed-in-creating-a-watcher-alert-for-specific-hostnames-if-the-cpu-memory-goes-above-certain-threshold/278454)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 7:04pm UTC](https://discuss.elastic.co/t/assistance-needed-in-creating-a-watcher-alert-for-specific-hostnames-if-the-cpu-memory-goes-above-certain-threshold/278454 "2021-07-12T19:04:47Z")
The existing threshold alert does what I need but its taking into account all the agents that are reporting to kibana using metricbeat. I only want the watcher for specific server say serverA reports a CPU level of 90% f… --- ## [Is it possible for ES to drop every field that's not in mapping upon indexing](https://discuss.elastic.co/t/is-it-possible-for-es-to-drop-every-field-thats-not-in-mapping-upon-indexing/278449)
**Author:** [@R.L](https://discuss.elastic.co/u/R.L)\ **Replies:** 4\ **Last updated:** [July 12, 2021, 6:58pm UTC](https://discuss.elastic.co/t/is-it-possible-for-es-to-drop-every-field-thats-not-in-mapping-upon-indexing/278449 "2021-07-12T18:58:52Z")
Let's say I have a index template mapping which has fields: { "first\_name"..., "last\_name"..., } and someone is uploading docs with fields: { "first\_name": "jon", "last\_name": "connington", "address": "blah… --- ## [Max heap size in nodes elasticsearch](https://discuss.elastic.co/t/max-heap-size-in-nodes-elasticsearch/278444)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 5:41pm UTC](https://discuss.elastic.co/t/max-heap-size-in-nodes-elasticsearch/278444 "2021-07-12T17:41:41Z")
Hi, I have a 3-node architecture with the following roles: "roles" : \[ "ingest", "master", "data", "ml" \] currently each server has 32GB of memory, which means that my nodes have 16GB for elastic. In the last few… --- ## [Kibana Unable to find the process running](https://discuss.elastic.co/t/kibana-unable-to-find-the-process-running/278315)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-unable-to-find-the-process-running/278315 "2021-07-12T18:20:01Z")
I have started Kibana using nohup ./kibana & but unable to find the same nohup using ps -ef | grep kibana However I do see the nohup.out file is being populated. --- ## [Which mapping data type should be user for particulartText](https://discuss.elastic.co/t/which-mapping-data-type-should-be-user-for-particularttext/278443)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 6:08pm UTC](https://discuss.elastic.co/t/which-mapping-data-type-should-be-user-for-particularttext/278443 "2021-07-12T18:08:27Z")
Hi, Current Index Mapping is- "question\_prompt": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 } } … --- ## [Metricbeat http module nested json](https://discuss.elastic.co/t/metricbeat-http-module-nested-json/278452)
**Author:** [@creativeguitar](https://discuss.elastic.co/u/creativeguitar)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 6:00pm UTC](https://discuss.elastic.co/t/metricbeat-http-module-nested-json/278452 "2021-07-12T18:00:15Z")
I need help regarding elastic search mapping of nested json response. I am using the meatricbeat's http module to query data from our asset management system and I am getting the following response in return "fields": \[… --- ## [Can't reassign shards, all shards currently on same node](https://discuss.elastic.co/t/cant-reassign-shards-all-shards-currently-on-same-node/277794)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 6\ **Last updated:** [July 12, 2021, 5:38pm UTC](https://discuss.elastic.co/t/cant-reassign-shards-all-shards-currently-on-same-node/277794 "2021-07-12T17:38:27Z")
We are maintaining a 10 node cluster (5 hot nodes with SSD storage and 5 warm nodes with SAS storage, latest Elasticsearch version by the way). The shard allocation for a specific index like looks this: GET \_cat/shards… --- ## [Not able to visualize percentage on pie with signals](https://discuss.elastic.co/t/not-able-to-visualize-percentage-on-pie-with-signals/276481)
**Author:** [@saumya1](https://discuss.elastic.co/u/saumya1)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 5:34pm UTC](https://discuss.elastic.co/t/not-able-to-visualize-percentage-on-pie-with-signals/276481 "2021-07-12T17:34:44Z")
{ "$schema":"https://vega.github.io/schema/vega/v5.json", "description":"A basic pie chart example.", "width":200, "height":200, "autosize":"none", "signals":\[ { "name":"startAngle", … --- ## [Новые поля](https://discuss.elastic.co/t/topic/278321)
**Author:** [@\_LA](https://discuss.elastic.co/u/_LA)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 5:26pm UTC](https://discuss.elastic.co/t/topic/278321 "2021-07-12T17:26:54Z")
Подскажите пожалуйста, я верно понимаю что новые поля в индексы добавляются согласно этой документации? --- ## [Can I see all transactions and spans filtered by the environment in Discover?](https://discuss.elastic.co/t/can-i-see-all-transactions-and-spans-filtered-by-the-environment-in-discover/277095)
**Author:** [@m-s-santos](https://discuss.elastic.co/u/m-s-santos)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 5:25pm UTC](https://discuss.elastic.co/t/can-i-see-all-transactions-and-spans-filtered-by-the-environment-in-discover/277095 "2021-07-12T17:25:35Z")
Hi! I'm trying to see all transactions and spans sent to Kibana in Discover to know if a change I made increased the amount of log. To achieve this, I was trying to see all spans and transactions filtered by the environm… --- ## [Drop event in heartbeat](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096)
**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 5:02pm UTC](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096 "2021-07-12T17:02:02Z")
I would like drop event when namespace is different of "production" I'm using auto discover kubernetes into my heartbeat.yml heartbeat.autodiscover: # Autodiscover services providers: - type: kubernetes resou… --- ## [Retrieving all records from query search without having to use .size -ElasticsSearch](https://discuss.elastic.co/t/retrieving-all-records-from-query-search-without-having-to-use-size-elasticssearch/278440)
**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\ **Replies:** 5\ **Last updated:** [July 12, 2021, 4:53pm UTC](https://discuss.elastic.co/t/retrieving-all-records-from-query-search-without-having-to-use-size-elasticssearch/278440 "2021-07-12T16:53:33Z")
I noticed that when running the following dsl query search on the cli console for ElasticSearch that it will only return a few of the records. If I add a "size": 3000, then I will be able to retrieve more than I original… --- ## [Need Elastic APM support for Ktor backend server](https://discuss.elastic.co/t/need-elastic-apm-support-for-ktor-backend-server/278129)
**Author:** [@Mahesh09](https://discuss.elastic.co/u/Mahesh09)\ **Replies:** 4\ **Last updated:** [July 12, 2021, 4:52pm UTC](https://discuss.elastic.co/t/need-elastic-apm-support-for-ktor-backend-server/278129 "2021-07-12T16:52:38Z")
Our team is trying to monitor performance of our Ktor (by Jetbrains) backend application. We are able to attach Elastic APM agent in backend server, and this server is visible at Kibana dashboard as service. But it is no… --- ## [Failure to index documents to App Search using Node.JS](https://discuss.elastic.co/t/failure-to-index-documents-to-app-search-using-node-js/278382)
**Author:** [@Ong](https://discuss.elastic.co/u/Ong)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 3:38pm UTC](https://discuss.elastic.co/t/failure-to-index-documents-to-app-search-using-node-js/278382 "2021-07-12T15:38:30Z")
I am using Node JS with App Search 7.11.1 hosted on ECE 2.8.1. The following is the code to create an App Search client and to index a document. It is based on the official Elastic App Search NPM site. const AppSearchCl… --- ## [Large number of queued refresh threads on a single node, queue count keeps increasing](https://discuss.elastic.co/t/large-number-of-queued-refresh-threads-on-a-single-node-queue-count-keeps-increasing/278435)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 2:41pm UTC](https://discuss.elastic.co/t/large-number-of-queued-refresh-threads-on-a-single-node-queue-count-keeps-increasing/278435 "2021-07-12T14:41:48Z")
I have a 3 node cluster on ES 7.8.1 Once in a while, it seems that the refresh queue gets "stuck" on a node (not always the same node), and the queued number of refresh threads keeps increasing, while the active number … --- ## [The new node cannot add to the cluster but creating a separate new cluster instead](https://discuss.elastic.co/t/the-new-node-cannot-add-to-the-cluster-but-creating-a-separate-new-cluster-instead/278373)
**Author:** [@Zongxian\_Feng](https://discuss.elastic.co/u/Zongxian_Feng)\ **Replies:** 5\ **Last updated:** [July 12, 2021, 2:41pm UTC](https://discuss.elastic.co/t/the-new-node-cannot-add-to-the-cluster-but-creating-a-separate-new-cluster-instead/278373 "2021-07-12T14:41:31Z")
Hi. I am trying to add a new node to an existing cluster(only has one node in it). After configuring in .yml and running the elasticsearch on both nodes, the new node creates a new cluster instead of joining the original… --- ## [Query string boolean operators vs. stop words](https://discuss.elastic.co/t/query-string-boolean-operators-vs-stop-words/276535)
**Author:** [@zsonglorman](https://discuss.elastic.co/u/zsonglorman)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 2:34pm UTC](https://discuss.elastic.co/t/query-string-boolean-operators-vs-stop-words/276535 "2021-07-12T14:34:15Z")
Hello, I'm using a query string query with boolean operators as stated in the docs, like this: ((quick AND fox) OR (brown AND fox) OR fox) AND NOT news This works all right, but I noticed that stop words are not ignore… --- ## [Winlogbeat Keystore Command Not working](https://discuss.elastic.co/t/winlogbeat-keystore-command-not-working/278413)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 11:00am UTC](https://discuss.elastic.co/t/winlogbeat-keystore-command-not-working/278413 "2021-07-12T11:00:08Z")
I am trying to create keystore for winlogbeat, am getting the below error. Can anyone please tell me what is my mistake? C:\\Program Files\\Winlogbeat\\data\>winlogbeat keystore create 'winlogbeat' is not recognized as an i… --- ## [How to remove duplicate document and field with null value](https://discuss.elastic.co/t/how-to-remove-duplicate-document-and-field-with-null-value/278424)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 12:04pm UTC](https://discuss.elastic.co/t/how-to-remove-duplicate-document-and-field-with-null-value/278424 "2021-07-12T12:04:29Z")
Hello friends, there are duplicate lines with empty values in the csv file. I want to delete the null fields in these records and overwrite them with other records. i managed to delete fields with null value. However, I … --- ## [How to update elastic search \_source settings?](https://discuss.elastic.co/t/how-to-update-elastic-search-source-settings/278431)
**Author:** [@MarvinLiu](https://discuss.elastic.co/u/MarvinLiu)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 1:45pm UTC](https://discuss.elastic.co/t/how-to-update-elastic-search-source-settings/278431 "2021-07-12T13:45:01Z")
When I try to update the \_source parameter in elastic search,I got an error. Can I change this settings? PUT source-test POST source-test/\_mappings { "\_source" : { "enabled":true } } POST source-test/\_mapping… --- ## [Boost two related fields in a search query](https://discuss.elastic.co/t/boost-two-related-fields-in-a-search-query/278428)
**Author:** [@Antojvlt](https://discuss.elastic.co/u/Antojvlt)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 12:45pm UTC](https://discuss.elastic.co/t/boost-two-related-fields-in-a-search-query/278428 "2021-07-12T12:45:57Z")
Hi, I am new to Elasticsearch and I encounter a difficultly to make my search query to work as expected. I want to search on documents that contain two field: "review\_count" : { "type" : "long" }, "s… --- ## [Watcher cambiar datos en index pettern](https://discuss.elastic.co/t/watcher-cambiar-datos-en-index-pettern/277963)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 12:39pm UTC](https://discuss.elastic.co/t/watcher-cambiar-datos-en-index-pettern/277963 "2021-07-12T12:39:53Z")
Hola a todos, ¿en Watcher se podrá cambiar datos cuando cumplan las condiciones?? Alguien sabe realmente si se puede realizar esto por medio de watcher. Pregunto por qué no me quedo clara la información de esta herramie… --- ## [How to make stopwords path text file work with words that have single quotes](https://discuss.elastic.co/t/how-to-make-stopwords-path-text-file-work-with-words-that-have-single-quotes/278427)
**Author:** [@Zubair\_Ali](https://discuss.elastic.co/u/Zubair_Ali)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 12:34pm UTC](https://discuss.elastic.co/t/how-to-make-stopwords-path-text-file-work-with-words-that-have-single-quotes/278427 "2021-07-12T12:34:12Z")
I have the following stopwords filter: "english\_stop": { "type": "stop", "stopwords\_path": "/usr/local/etc/elasticsearch/stopwords.txt", "updateable": true } These are the words in my st… --- ## [Log\_ecs\_reformatting not reformatting all logfiles](https://discuss.elastic.co/t/log-ecs-reformatting-not-reformatting-all-logfiles/276532)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 8\ **Last updated:** [July 12, 2021, 11:54am UTC](https://discuss.elastic.co/t/log-ecs-reformatting-not-reformatting-all-logfiles/276532 "2021-07-12T11:54:31Z")
Hi all, I have upgraded to the latest Java agent version 1.24.0 today and I wanted to try the log\_ecs\_reformatting feature in our testsystem. It kinda works but it seems to ignore the logback over Slf4j logs: I have a … --- ## [Use predicate expression with NEST in .NET 5](https://discuss.elastic.co/t/use-predicate-expression-with-nest-in-net-5/278420)
**Author:** [@Henrique\_Mauri](https://discuss.elastic.co/u/Henrique_Mauri)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 11:50am UTC](https://discuss.elastic.co/t/use-predicate-expression-with-nest-in-net-5/278420 "2021-07-12T11:50:26Z")
Hi Is it possible to configure in NEST (.NET 5) a way to use a default predicate expression (Default Query Filter) for all NEST queries (GetAsync, GetManyAsync, SearchAsync, ExistsAsync, ...) performed on any index? Th… --- ## [Yum repo doesn't work](https://discuss.elastic.co/t/yum-repo-doesnt-work/278404)
**Author:** [@loposk](https://discuss.elastic.co/u/loposk)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 11:41am UTC](https://discuss.elastic.co/t/yum-repo-doesnt-work/278404 "2021-07-12T11:41:05Z")
Added a repository according to the instructions Install Elasticsearch with RPM | Elasticsearch Guide \[7.13\] | Elastic When yum trying download https://artifacts.elastic.co/packages/7.x/yum/repodata/filelists.xml.gz I g… --- ## [Elasticsearch query DSL as a filter on Kibana](https://discuss.elastic.co/t/elasticsearch-query-dsl-as-a-filter-on-kibana/278415)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-as-a-filter-on-kibana/278415 "2021-07-12T11:16:29Z")
Hi guys, i need help with - my challenge is that i have to generate a new field when the query match the cretiria. see the code below: Here I need to add/create a field (references) and fill it with the same value I … [Previous page](https://discuss.elastic.co/latest.md?page=1576) [Next page](https://discuss.elastic.co/latest.md?page=1578)