# Latest **URL:** https://discuss.elastic.co/latest.md?page=1581 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1582 --- ## [Aggs order with a query scope, got docs not in the query scope, why?](https://discuss.elastic.co/t/aggs-order-with-a-query-scope-got-docs-not-in-the-query-scope-why/278230)
**Author:** [@daniel\_wang](https://discuss.elastic.co/u/daniel_wang)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 7:05am UTC](https://discuss.elastic.co/t/aggs-order-with-a-query-scope-got-docs-not-in-the-query-scope-why/278230 "2021-07-09T07:05:15Z")
My es version info: { "version": { "number": "7.7.1", "build\_flavor": "default", "build\_type": "tar", "build\_hash": "ad56dce891c901a492bb1ee393f12dfff473a423", "build\_date": "… --- ## [PHP APM agent cannot connect](https://discuss.elastic.co/t/php-apm-agent-cannot-connect/278235)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 4:44am UTC](https://discuss.elastic.co/t/php-apm-agent-cannot-connect/278235 "2021-07-09T04:44:15Z")
Hi All, I'm getting an error message in /var/log/messages after In installed the php apm-agent Jul 9 12:39:11 localhost journal: ool www: Elastic APM PHP Tracer \[PID: 7439\] 2021-07-09 12:39:11.677510+08:00 \[ERROR\] … --- ## [Uptime Up status for any status code](https://discuss.elastic.co/t/uptime-up-status-for-any-status-code/277446)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 3:52am UTC](https://discuss.elastic.co/t/uptime-up-status-for-any-status-code/277446 "2021-07-09T03:52:57Z")
Hi, I have configured heartbeat for multiple urls. Problem is that there are some urls which throws status codes as 405 or 403. However urls are reachable. Our aim is to consider any such ports as UP in uptime. Can we d… --- ## [Winlogbeat timestamp different with event create time](https://discuss.elastic.co/t/winlogbeat-timestamp-different-with-event-create-time/278160)
**Author:** [@Jacky1](https://discuss.elastic.co/u/Jacky1)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 3:38am UTC](https://discuss.elastic.co/t/winlogbeat-timestamp-different-with-event-create-time/278160 "2021-07-09T03:38:46Z")
Dears I got a very strange problem. We installed winlogbeat v7.2 and directly shipped windows event log to ES, configurations about winlogbeat as below: name: Security ignore\_older: 24h name: Microsoft-Windows-NTLM/O… --- ## [Advice on optimal number of indices](https://discuss.elastic.co/t/advice-on-optimal-number-of-indices/278227)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 12:59am UTC](https://discuss.elastic.co/t/advice-on-optimal-number-of-indices/278227 "2021-07-09T00:59:51Z")
I am working on a system to store network flow records in Elasticsearch. There are too many documents to keep for long periods (~35 million per hour). We wrote a tool to aggregate these into fewer documents (~8 million … --- ## [Policy for index failed on step \[{"phase":"hot","action":"rollover","name":"check-rollover-ready"}\]](https://discuss.elastic.co/t/policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/278141)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 6:40am UTC](https://discuss.elastic.co/t/policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/278141 "2021-07-08T06:40:09Z")
I am using Logstash to create a daily index in ElasticSearch. This time, I tried to create an index using an index template, but I noticed that ElasticSearch was generating the following ILM error. $ tail -n 30 /var/lo… --- ## [How to enable geo\_point or geo\_shape in csv data to linestring](https://discuss.elastic.co/t/how-to-enable-geo-point-or-geo-shape-in-csv-data-to-linestring/278120)
**Author:** [@yuhw1](https://discuss.elastic.co/u/yuhw1)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 12:07am UTC](https://discuss.elastic.co/t/how-to-enable-geo-point-or-geo-shape-in-csv-data-to-linestring/278120 "2021-07-09T00:07:22Z")
I am trying to draw a line by extracting the location and timestamp data from the geo\_point or geo\_shape index where the csv file is uploaded. But it keeps failing, and the aggregations are not applied. So, I am asking i… --- ## [More Like This (MLT) query among only documents with a given field value?](https://discuss.elastic.co/t/more-like-this-mlt-query-among-only-documents-with-a-given-field-value/278225)
**Author:** [@aacitelli](https://discuss.elastic.co/u/aacitelli)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 11:01pm UTC](https://discuss.elastic.co/t/more-like-this-mlt-query-among-only-documents-with-a-given-field-value/278225 "2021-07-08T23:01:27Z")
I have a bunch (millions, but ideally scalable to billions/trillions) of documents in an ElasticSearch 7.13.0 index, and I am successfully performing MLT queries on them. Each document has an id, a text field, and a "clu… --- ## [Can't create new Kibana visualizations after upgrade to 7.13](https://discuss.elastic.co/t/cant-create-new-kibana-visualizations-after-upgrade-to-7-13/278202)
**Author:** [@Toumal](https://discuss.elastic.co/u/Toumal)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 10:00pm UTC](https://discuss.elastic.co/t/cant-create-new-kibana-visualizations-after-upgrade-to-7-13/278202 "2021-07-08T22:00:11Z")
Unfortunately I still run into issues after this upgrade: creating any kind of new visualization fails with an "Application not found" error. This is the basic license and I was trying to create a basic bar chart. It see… --- ## [Space/permission controls for "Add data" button](https://discuss.elastic.co/t/space-permission-controls-for-add-data-button/278187)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 8:11pm UTC](https://discuss.elastic.co/t/space-permission-controls-for-add-data-button/278187 "2021-07-08T20:11:24Z")
Is there a permission to remove/hide the button shown in the screenshot? I've tried trial and error but no luck. --- ## [High CPU usages in Elastic Node](https://discuss.elastic.co/t/high-cpu-usages-in-elastic-node/277996)
**Author:** [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 7:53pm UTC](https://discuss.elastic.co/t/high-cpu-usages-in-elastic-node/277996 "2021-07-08T19:53:48Z")
High CPU usages in Elastic Node In a development setting, I have both ElasticSearch, Kibana and MetricBeat running on the same server. The CPU resources are so high that I couldn’t remote onto the server. It is only wh… --- ## [Yarn kbn bootstrap fails](https://discuss.elastic.co/t/yarn-kbn-bootstrap-fails/275337)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 27\ **Last updated:** [July 8, 2021, 7:14pm UTC](https://discuss.elastic.co/t/yarn-kbn-bootstrap-fails/275337 "2021-07-08T19:14:17Z")
Hello everyone, I have been trying to run yarn kbn bootstrap but it keeps giving me following errors. E:\\Kibana-development\\kibana\>yarn kbn bootstrap --force-install yarn run v1.22.10 $ node scripts/kbn bootstrap --for… --- ## [Confluence cloud is having unexpected error during the synchronization](https://discuss.elastic.co/t/confluence-cloud-is-having-unexpected-error-during-the-synchronization/278007)
**Author:** [@James\_Huang1](https://discuss.elastic.co/u/James_Huang1)\ **Replies:** 3\ **Last updated:** [July 8, 2021, 7:05pm UTC](https://discuss.elastic.co/t/confluence-cloud-is-having-unexpected-error-during-the-synchronization/278007 "2021-07-08T19:05:46Z")
I am having unexpected error in the diagnostic.json file when I successfully configure the Confluence Cloud connector in the workplace search and it gave us the "Source returned an unexpected error during synchronization… --- ## [Need clarity on recovery throttling parameters impacting snapshot restores](https://discuss.elastic.co/t/need-clarity-on-recovery-throttling-parameters-impacting-snapshot-restores/278199)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 6:24pm UTC](https://discuss.elastic.co/t/need-clarity-on-recovery-throttling-parameters-impacting-snapshot-restores/278199 "2021-07-08T18:24:50Z")
Hi, Current version used - elasticsearch-oss 7.8.0 Upgrading to: elasticsearch-oss 7.10.2 Elasticsearch 7.9 breaking change mentions about Snapshot restore throttling. As per the change - Restoring from a snapshot n… --- ## [How do I change a symbol on the kibana panel, as per the condition](https://discuss.elastic.co/t/how-do-i-change-a-symbol-on-the-kibana-panel-as-per-the-condition/278077)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 6:08pm UTC](https://discuss.elastic.co/t/how-do-i-change-a-symbol-on-the-kibana-panel-as-per-the-condition/278077 "2021-07-08T18:08:50Z")
How do I change a symbol on the kibana panel, as per the condition. example, I wanted to show that when something had a value above 10, I would place an image, and if it was less than 10, another image. It would be poss… --- ## [\[kibana 7.13\]can not support the --allow-root when using the kibana-keystore](https://discuss.elastic.co/t/kibana-7-13-can-not-support-the-allow-root-when-using-the-kibana-keystore/278207)
**Author:** [@harry\_010](https://discuss.elastic.co/u/harry_010)\ **Replies:** 6\ **Last updated:** [July 8, 2021, 6:08pm UTC](https://discuss.elastic.co/t/kibana-7-13-can-not-support-the-allow-root-when-using-the-kibana-keystore/278207 "2021-07-08T18:08:26Z")
when I used the following command to create the Keystore, I got the following error. /usr/share/kibana/bin/kibana-keystore create --allow-root kibana.keystore located in the data folder is deprecated. Future versions … --- ## [Firefox not loading the contents in kibana dashboard](https://discuss.elastic.co/t/firefox-not-loading-the-contents-in-kibana-dashboard/278182)
**Author:** [@martianzz](https://discuss.elastic.co/u/martianzz)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 5:50pm UTC](https://discuss.elastic.co/t/firefox-not-loading-the-contents-in-kibana-dashboard/278182 "2021-07-08T17:50:19Z")
OS is debian 8. Tried opening elastic in all browsers. None worked. Except for Firefox atleast loaded the contents without the values. It is working in all other Desktops. Kindly help with this issue. --- ## [Full Collection rebuild for Indexing fails](https://discuss.elastic.co/t/full-collection-rebuild-for-indexing-fails/277679)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 4:20pm UTC](https://discuss.elastic.co/t/full-collection-rebuild-for-indexing-fails/277679 "2021-07-08T16:20:07Z")
Upgraded to new Oracle12c CMS and migrated ~4 Million documents. However running the Full Collection Rebuild for Indexing fails with below error. 2 difference CMS instances are pointing to same Elasticsearch.. Error: "\>… --- ## [Observability engineer training](https://discuss.elastic.co/t/observability-engineer-training/277845)
**Author:** [@sabualrub](https://discuss.elastic.co/u/sabualrub)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 4:36pm UTC](https://discuss.elastic.co/t/observability-engineer-training/277845 "2021-07-08T16:36:30Z")
I have a problem with the training. In the lab instructions, there is a link to open kibana and practice the lab but when I click on it, it opens a page that tells that can't reach this page. I tried to use different br… --- ## [Error 401 when authenticating with OpenIDConnect](https://discuss.elastic.co/t/error-401-when-authenticating-with-openidconnect/277977)
**Author:** [@Kostas\_elastic](https://discuss.elastic.co/u/Kostas_elastic)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 4:29pm UTC](https://discuss.elastic.co/t/error-401-when-authenticating-with-openidconnect/277977 "2021-07-08T16:29:09Z")
Hello everyone, I am getting this error message after trying to authenticate with OIDC. {"statusCode":401,"error":"Unauthorized","message":"Response session state does not have corresponding state or nonce parameters o… --- ## [Netflow Configuration](https://discuss.elastic.co/t/netflow-configuration/278176)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 4:15pm UTC](https://discuss.elastic.co/t/netflow-configuration/278176 "2021-07-08T16:15:01Z")
what would be the best way to ingest netflow traffic in elastic? I couldn't find much info about this on elastic website. --- ## [Can No Longer Use Range Condition to Drop Events By Event ID?](https://discuss.elastic.co/t/can-no-longer-use-range-condition-to-drop-events-by-event-id/278206)
**Author:** [@eafrost.cissp](https://discuss.elastic.co/u/eafrost.cissp)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 4:05pm UTC](https://discuss.elastic.co/t/can-no-longer-use-range-condition-to-drop-events-by-event-id/278206 "2021-07-08T16:05:39Z")
This post is a continuation of https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273/3, which didn't produce a complete solution for me. With the change of data type f… --- ## [Create a table showing two "sibling" elements](https://discuss.elastic.co/t/create-a-table-showing-two-sibling-elements/278112)
**Author:** [@rgahan5c](https://discuss.elastic.co/u/rgahan5c)\ **Replies:** 7\ **Last updated:** [July 8, 2021, 3:33pm UTC](https://discuss.elastic.co/t/create-a-table-showing-two-sibling-elements/278112 "2021-07-08T15:33:34Z")
I have data that is in the form: { user\_email: "test@example.com", number\_of\_emails\_sent: 100, ... } I would like to display it in a table like: User Email Number of Emails Sent test@examp… --- ## [Node dont start after server crash](https://discuss.elastic.co/t/node-dont-start-after-server-crash/278204)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/node-dont-start-after-server-crash/278204 "2021-07-08T15:12:35Z")
We run ES 7.13.2 on k8s, with Docker engine. This is simple 3 nodes cluster with 10 indices and less than 100Go of data. The ES cluster is used to monitore another ES cluster which is working fine (via metricbeat). Our… --- ## [How to create several roles at once](https://discuss.elastic.co/t/how-to-create-several-roles-at-once/278203)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-create-several-roles-at-once/278203 "2021-07-08T15:12:34Z")
Hi all, Is there a way to create several roles at once using POST /\_security/role/ API? If so, can someone plz give an example? The ideia here is to first use GET /\_security/role/, remove all reserved roles and then u… --- ## [Data stream tracks generation](https://discuss.elastic.co/t/data-stream-tracks-generation/275729)
**Author:** [@demudrol](https://discuss.elastic.co/u/demudrol)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 3:00pm UTC](https://discuss.elastic.co/t/data-stream-tracks-generation/275729 "2021-07-08T15:00:42Z")
Hi! There is information about following convention: .ds-\-\-\ But when define data stream in index template like this: "index\_patterns": \["my-data-stream-\*"\], "data\_stream": { }, … --- ## [No option for managing index patterns after Kibana Upgrade](https://discuss.elastic.co/t/no-option-for-managing-index-patterns-after-kibana-upgrade/278201)
**Author:** [@Toumal](https://discuss.elastic.co/u/Toumal)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 2:55pm UTC](https://discuss.elastic.co/t/no-option-for-managing-index-patterns-after-kibana-upgrade/278201 "2021-07-08T14:55:31Z")
I've recently upgraded to the latest Kibana version (7.13) and now I don't see any option to manage index patterns. Any hints what I can do here? I have quite a few dashboards set up and simply starting over is not r… --- ## ["allocate\_explanation" : "allocation temporarily throttled"](https://discuss.elastic.co/t/allocate-explanation-allocation-temporarily-throttled/276709)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 1:21am UTC](https://discuss.elastic.co/t/allocate-explanation-allocation-temporarily-throttled/276709 "2021-06-23T01:21:10Z")
Hello World! Per Cluster Allocation Explain API | Elasticsearch Guide \[6.8\] | Elastic - I ran and got following: GET /\_cluster/allocation/explain "node\_decision" : "throttled", "deciders" : \[ { … --- ## [Add and manage APM alert for multiple services](https://discuss.elastic.co/t/add-and-manage-apm-alert-for-multiple-services/278178)
**Author:** [@mr-perseus](https://discuss.elastic.co/u/mr-perseus)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 2:49pm UTC](https://discuss.elastic.co/t/add-and-manage-apm-alert-for-multiple-services/278178 "2021-07-08T14:49:12Z")
I was following this documentation: Alerts | Kibana Guide \[7.13\] | Elastic How is it possible to create alerts for multiple services (but not for every service)? Or is it possible to group them somehow? I tried to set t… --- ## [Datafeed creation via API](https://discuss.elastic.co/t/datafeed-creation-via-api/278090)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 2:43pm UTC](https://discuss.elastic.co/t/datafeed-creation-via-api/278090 "2021-07-08T14:43:08Z")
Hi, I have created 2 identical datafeed: 1 datafeed created via Kibana (datafeed\_job\_device1) 1 datafeed created via API (api\_datafeed\_api\_job\_device1) The 2 resulting JSON files related to these 2 datafeed are exact… [Previous page](https://discuss.elastic.co/latest.md?page=1580) [Next page](https://discuss.elastic.co/latest.md?page=1582)