# Latest **URL:** https://discuss.elastic.co/latest.md?page=1598 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1599 --- ## [InnerHitBuilder field query](https://discuss.elastic.co/t/innerhitbuilder-field-query/277280)
**Author:** [@111487](https://discuss.elastic.co/u/111487)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 3:56am UTC](https://discuss.elastic.co/t/innerhitbuilder-field-query/277280 "2021-06-29T03:56:27Z")
I have some questions.in the InnerHitBuilder field query , Can I support custom queries for Innerhitbuilder field queries? --- ## [Error writing registrar state to statestore: failed in store/get operation on store 'filebeat'](https://discuss.elastic.co/t/error-writing-registrar-state-to-statestore-failed-in-store-get-operation-on-store-filebeat/277265)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 6:34pm UTC](https://discuss.elastic.co/t/error-writing-registrar-state-to-statestore-failed-in-store-get-operation-on-store-filebeat/277265 "2021-06-28T18:34:16Z")
I am using filebeat 7.12.0 autodiscover to collect events from kubernetes pods. The filebeat log contains an error message as, 2021-06-28T09:56:42.626Z ERROR \[registrar\] registrar/registrar.go:205 Erro… --- ## [Get datetime from logs](https://discuss.elastic.co/t/get-datetime-from-logs/277175)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 2\ **Last updated:** [June 29, 2021, 3:45am UTC](https://discuss.elastic.co/t/get-datetime-from-logs/277175 "2021-06-29T03:45:10Z")
I am trying to get logs to Kibana using logstash and filebeats. However kibana doesn't take data and time (which in the logs) as datetime. Instead in takes as string and cannot change format as well . Appreciate your he… --- ## [Customizing Kibana advanced settings in a Docker container?](https://discuss.elastic.co/t/customizing-kibana-advanced-settings-in-a-docker-container/276365)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 2:23am UTC](https://discuss.elastic.co/t/customizing-kibana-advanced-settings-in-a-docker-container/276365 "2021-06-28T02:23:04Z")
Background to my question I want to deploy a set of Kibana dashboards in a Docker container. This will include changing some Kibana advanced settings, such as courier:ignoreFilterIfFieldNotInIndex, from their default val… --- ## [Planned total network page - how will the cluster react?](https://discuss.elastic.co/t/planned-total-network-page-how-will-the-cluster-react/277235)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 3:10am UTC](https://discuss.elastic.co/t/planned-total-network-page-how-will-the-cluster-react/277235 "2021-06-29T03:10:07Z")
We have a planned network outage for 8 hours that will stop communication between all hosts, including between nodes in our elastic cluster. We have 3 master nodes and 2 minimum master nodes set. Using logstash to write… --- ## [Endpoints not showing up in Security Administration](https://discuss.elastic.co/t/endpoints-not-showing-up-in-security-administration/276878)
**Author:** [@Jukocross](https://discuss.elastic.co/u/Jukocross)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 2:10am UTC](https://discuss.elastic.co/t/endpoints-not-showing-up-in-security-administration/276878 "2021-06-29T02:10:35Z")
Security administration unable to detect any host despite able to enroll the host with elastic agent (Status: Healthy). Installed version 7.13.2 ELK stack with self signed certificates. Setup fleet server and able to… --- ## [How to make elasticsearch returns products from stores that deliver to the user's region?](https://discuss.elastic.co/t/how-to-make-elasticsearch-returns-products-from-stores-that-deliver-to-the-users-region/277234)
**Author:** [@ironzep](https://discuss.elastic.co/u/ironzep)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 2:01am UTC](https://discuss.elastic.co/t/how-to-make-elasticsearch-returns-products-from-stores-that-deliver-to-the-users-region/277234 "2021-06-29T02:01:06Z")
I am struggling with this for a time. The scenario is the following: I have an elasticsearch index which has products and each product has a store. The store has fields that store its latitude, longitude and the max dist… --- ## [I can't do any snapshot related task due to error "No space left on device"](https://discuss.elastic.co/t/i-cant-do-any-snapshot-related-task-due-to-error-no-space-left-on-device/277258)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 1:39am UTC](https://discuss.elastic.co/t/i-cant-do-any-snapshot-related-task-due-to-error-no-space-left-on-device/277258 "2021-06-29T01:39:28Z")
Hi All, The snapshot repository I've registered on my cluster is full. I've being trying to delete some of older snapshots but I keep receiving "No Space left on device" error message. I tried deleting them directly t… --- ## [Invalid field name: \_allow\_permissions,\_deny\_permissions](https://discuss.elastic.co/t/invalid-field-name-allow-permissions-deny-permissions/274287)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 43\ **Last updated:** [June 29, 2021, 12:50am UTC](https://discuss.elastic.co/t/invalid-field-name-allow-permissions-deny-permissions/274287 "2021-06-29T00:50:18Z")
I am trying to implement WorkplaceSearch. Since I want to include online documents used in the company in the search, I am setting up a custom source by referring to the following url. However, when I run the followin… --- ## [Shard Allocation Failures After 5 Retries](https://discuss.elastic.co/t/shard-allocation-failures-after-5-retries/276969)
**Author:** [@xianhechen](https://discuss.elastic.co/u/xianhechen)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 11:54pm UTC](https://discuss.elastic.co/t/shard-allocation-failures-after-5-retries/276969 "2021-06-28T23:54:03Z")
Hi, We have a 23 nodes cluster with 5 master nodes, 3 coordinator nodes, and 15 data nodes. Our index has a total of 30 primary shards and 3 replicas. Size of the index is around 800Gb. Earlier this week we found that t… --- ## [Figure out shard size from size before creating Elasticsearch index in python](https://discuss.elastic.co/t/figure-out-shard-size-from-size-before-creating-elasticsearch-index-in-python/276302)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 9:45pm UTC](https://discuss.elastic.co/t/figure-out-shard-size-from-size-before-creating-elasticsearch-index-in-python/276302 "2021-06-28T21:45:32Z")
Hi, We need to know the size of each shard before creating an index in ES. We are using Hail python library, and have MatrixTable that we convert to Table, and then write to Elasticsearch: mt = mt.rows() # Converts ne… --- ## [Kibana Lens - Drop partial buckets](https://discuss.elastic.co/t/kibana-lens-drop-partial-buckets/277244)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 7\ **Last updated:** [June 28, 2021, 9:29pm UTC](https://discuss.elastic.co/t/kibana-lens-drop-partial-buckets/277244 "2021-06-28T21:29:37Z")
Is there planned work to include the option to drop partial buckets in Kibana Lens visualizations? We are currently trying to display data aggregations grouped by year, but when we select a specific year, the data from … --- ## [Logstash Create new field from existing field and remove character from new field](https://discuss.elastic.co/t/logstash-create-new-field-from-existing-field-and-remove-character-from-new-field/277268)
**Author:** [@Annette1](https://discuss.elastic.co/u/Annette1)\ **Replies:** 4\ **Last updated:** [June 28, 2021, 9:16pm UTC](https://discuss.elastic.co/t/logstash-create-new-field-from-existing-field-and-remove-character-from-new-field/277268 "2021-06-28T21:16:45Z")
I have a simple request but seem unable to be able execute it correctly. I have a field named logname that has several name forms. For instance are logname-app, logname-os, logname-access, and logname. The logname is … --- ## [Setting the default route for Kibana](https://discuss.elastic.co/t/setting-the-default-route-for-kibana/277270)
**Author:** [@Rafael\_Ribeiro](https://discuss.elastic.co/u/Rafael_Ribeiro)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 9:15pm UTC](https://discuss.elastic.co/t/setting-the-default-route-for-kibana/277270 "2021-06-28T21:15:50Z")
Hello, I am trying to change the default route for Kibana on Stack Management \> Advanced Settings to /app/discover. But every time I log into Kibana, I am redirected to /app/home. I am using Elasticsearch 7.10 (AWS man… --- ## [Which node to connect to](https://discuss.elastic.co/t/which-node-to-connect-to/276408)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 7:55pm UTC](https://discuss.elastic.co/t/which-node-to-connect-to/276408 "2021-06-28T19:55:55Z")
Hello, this is a dum question. But I have two nodes on my cluster (One is master). And I always use the master IP (or URL) to fetch for Info, for example in my Grafana data source I use the Node1 URL to Connect. Is alwa… --- ## [High system load during search when total index size is large](https://discuss.elastic.co/t/high-system-load-during-search-when-total-index-size-is-large/274439)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 8\ **Last updated:** [June 28, 2021, 6:56pm UTC](https://discuss.elastic.co/t/high-system-load-during-search-when-total-index-size-is-large/274439 "2021-06-28T18:56:56Z")
I have a cluster setup where some nodes can experience high system load for a specific index. Index The index is time-based, and is named as such: index-2021.03 index-2021.04 index-2021.05 In other words, I begin a n… --- ## [How can I make a visualization where only the latest data point is a different color?](https://discuss.elastic.co/t/how-can-i-make-a-visualization-where-only-the-latest-data-point-is-a-different-color/277136)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 6:53pm UTC](https://discuss.elastic.co/t/how-can-i-make-a-visualization-where-only-the-latest-data-point-is-a-different-color/277136 "2021-06-28T18:53:59Z")
As titled. I want to create a line graph of one metric versus another and the most recent (chronologically) must be one colour and everything else another colour. How can I do this? I'd like to avoid vega if I can. --- ## [Configure filebeat to route logs from providers (with hints enabled) to specific elastic instances](https://discuss.elastic.co/t/configure-filebeat-to-route-logs-from-providers-with-hints-enabled-to-specific-elastic-instances/277267)
**Author:** [@mitesh](https://discuss.elastic.co/u/mitesh)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 6:48pm UTC](https://discuss.elastic.co/t/configure-filebeat-to-route-logs-from-providers-with-hints-enabled-to-specific-elastic-instances/277267 "2021-06-28T18:48:11Z")
Hi, I am quite new to the ELK stack and would appreciate some guidance on the brief mentioned in the subject. My goal is to have multiple providers (nginx1, nginx2) broadcasting beats events with hints enabled to fileb… --- ## [Output Using CEF codec and to Kafka Server](https://discuss.elastic.co/t/output-using-cef-codec-and-to-kafka-server/277243)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 4\ **Last updated:** [June 28, 2021, 6:34pm UTC](https://discuss.elastic.co/t/output-using-cef-codec-and-to-kafka-server/277243 "2021-06-28T18:34:01Z")
Hi, Is there a way to nest the Output statement so that I can first output using the CEF codec and then Output to a Kafka topic. The requirement is that I have to covert the data to CEF and then send to a Kafka topic. … --- ## [How to build a plugin for a not yet released version?](https://discuss.elastic.co/t/how-to-build-a-plugin-for-a-not-yet-released-version/276833)
**Author:** [@rafis](https://discuss.elastic.co/u/rafis)\ **Replies:** 6\ **Last updated:** [June 28, 2021, 6:21pm UTC](https://discuss.elastic.co/t/how-to-build-a-plugin-for-a-not-yet-released-version/276833 "2021-06-28T18:21:04Z")
Hello, I need to test a fix for elasticsearch 7.14.0 code with my plugin installed. The plugin version must match to be installed, but the latest publicly available build-tools is 7.13.2. I can build elasticsearch-7.14.… --- ## [Find newly added Event that have a unique ID](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690)
**Author:** [@Zentas](https://discuss.elastic.co/u/Zentas)\ **Replies:** 5\ **Last updated:** [June 28, 2021, 6:10pm UTC](https://discuss.elastic.co/t/find-newly-added-event-that-have-a-unique-id/276690 "2021-06-28T18:10:29Z")
Hello, is there any existing feature or way to do this? I need to see Data that has been newly added (fresh ID) in a specific time frame. Example: Time 12:00 Data: Ex 1 - ID: 1 - Name: ... Ex 2 - ID: 2 - Name: ... … --- ## [Can not purge Logstash](https://discuss.elastic.co/t/can-not-purge-logstash/277225)
**Author:** [@Vladimir](https://discuss.elastic.co/u/Vladimir)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 5:44pm UTC](https://discuss.elastic.co/t/can-not-purge-logstash/277225 "2021-06-28T17:44:17Z")
Hi, can somebody help me please to remove logstash from Ubuntu? I had a broken Elastic + Kibana + Logstash + Filebeat installtion so I decided to remove it completely and start installation again. All packages are gone … --- ## [Is there a way to skip the WorkplaceSearch login screen?](https://discuss.elastic.co/t/is-there-a-way-to-skip-the-workplacesearch-login-screen/276219)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 8\ **Last updated:** [June 28, 2021, 5:40pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-skip-the-workplacesearch-login-screen/276219 "2021-06-28T17:40:19Z")
I have installed WorkplaceSearch in an internal on-premise environment. This server is in an environment that cannot be accessed except within the company, so if possible, I would like to skip the screen for entering au… --- ## [How to convert logstash elasticsearch plugin in ingest pipeline?](https://discuss.elastic.co/t/how-to-convert-logstash-elasticsearch-plugin-in-ingest-pipeline/277156)
**Author:** [@crpj](https://discuss.elastic.co/u/crpj)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 5:38pm UTC](https://discuss.elastic.co/t/how-to-convert-logstash-elasticsearch-plugin-in-ingest-pipeline/277156 "2021-06-28T17:38:41Z")
Hello, I would like to know if and how it is possible to use the logstash elasticsearch plugin in an ingest pipeline, currently the use of a workaround in logstash which enables enriching data based in a query from ano… --- ## [Alphabetically sort name field](https://discuss.elastic.co/t/alphabetically-sort-name-field/276505)
**Author:** [@gautamz07](https://discuss.elastic.co/u/gautamz07)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 5:26pm UTC](https://discuss.elastic.co/t/alphabetically-sort-name-field/276505 "2021-06-28T17:26:13Z")
I have the following definition for the name field "name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 } } }, How do i sort this alphabetically ? I am tr… --- ## [Elastic Agent filling up disk space with logs, disaster](https://discuss.elastic.co/t/elastic-agent-filling-up-disk-space-with-logs-disaster/276668)
**Author:** [@Achilleas](https://discuss.elastic.co/u/Achilleas)\ **Replies:** 6\ **Last updated:** [June 28, 2021, 5:03pm UTC](https://discuss.elastic.co/t/elastic-agent-filling-up-disk-space-with-logs-disaster/276668 "2021-06-28T17:03:52Z")
We had a meltdown on one of our servers, where the elastic agent filled up the disk space with logs (36GB of text logfiles, in 2 months), from a trial we had on the Elastic Cloud. I know I am to blame for installing an … --- ## [Grok pattern not working with spaces](https://discuss.elastic.co/t/grok-pattern-not-working-with-spaces/277254)
**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 4:54pm UTC](https://discuss.elastic.co/t/grok-pattern-not-working-with-spaces/277254 "2021-06-28T16:54:40Z")
Hi all , I am trying to get a pattern for tbelow log in GrokDebugger site. Jun 27 00:00:12 location2-squid2 SQUID 1624732203.029 877 172.1.1.1 TCP\_MISS/200 70205 GET http://10.10.1.1/v1/loading/summary? - HIER\_DIRECT… --- ## [Problem install logstash-7.13.2-x86](https://discuss.elastic.co/t/problem-install-logstash-7-13-2-x86/277249)
**Author:** [@mylogstash](https://discuss.elastic.co/u/mylogstash)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 4:22pm UTC](https://discuss.elastic.co/t/problem-install-logstash-7-13-2-x86/277249 "2021-06-28T16:22:53Z")
On Centos 7.9 During upgrade of logstash-7.13.2-x86 the ownership /usr/share/logstash changes from logstash:logstash to root:root. Why does the installation changes the owner of /usr/share/logstash ? --- ## [Proximity searches](https://discuss.elastic.co/t/proximity-searches/276850)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 3:49pm UTC](https://discuss.elastic.co/t/proximity-searches/276850 "2021-06-28T15:49:02Z")
I’m trying to achieve Proximity searches with whole wild card, • (Alice \* Bob) NEAR/4 (Sam \* \* John): find all the documents having the phrase “Alice \* Bob” within 4 words distance to “Sam \* \* John”. I’ve tried followi… --- ## [Custom Domain Name](https://discuss.elastic.co/t/custom-domain-name/276056)
**Author:** [@andremarzo](https://discuss.elastic.co/u/andremarzo)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 3:45pm UTC](https://discuss.elastic.co/t/custom-domain-name/276056 "2021-06-28T15:45:03Z")
I am using cloud.elastic.co instance but it provides you long URL to access ES like XXXXXXXXXXXXXX.us-east-xx.aws.found.io How is possible to use your own domain name with elastic cloud instance? [Previous page](https://discuss.elastic.co/latest.md?page=1597) [Next page](https://discuss.elastic.co/latest.md?page=1599)