# Latest **URL:** https://discuss.elastic.co/latest.md?page=1651 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1652 --- ## [Watcher unable to send number of hits in email](https://discuss.elastic.co/t/watcher-unable-to-send-number-of-hits-in-email/274292)
**Author:** [@tuli](https://discuss.elastic.co/u/tuli)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 8:50am UTC](https://discuss.elastic.co/t/watcher-unable-to-send-number-of-hits-in-email/274292 "2021-05-31T08:50:10Z")
Hello, We have a watcher which is sending a CSV attachment with the number of hosts matching the condition. However, we also want it writes in the body the total number of hits/hosts in the CSV found. For eg: if in the… --- ## [Custom similarity is really slow, even when very simple (using doc.freq)](https://discuss.elastic.co/t/custom-similarity-is-really-slow-even-when-very-simple-using-doc-freq/273936)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 8:48am UTC](https://discuss.elastic.co/t/custom-similarity-is-really-slow-even-when-very-simple-using-doc-freq/273936 "2021-05-31T08:48:54Z")
Hi I am trying to use custom similarities. I wish to have a very simple similarity, where the score is just doc.freq. As I understand this is stored in the statistics, so it should be very fast. When having ~30mill do… --- ## [Aggregeations with different keys and values (label and ID)](https://discuss.elastic.co/t/aggregeations-with-different-keys-and-values-label-and-id/274218)
**Author:** [@Julian\_Klotz](https://discuss.elastic.co/u/Julian_Klotz)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 8:39am UTC](https://discuss.elastic.co/t/aggregeations-with-different-keys-and-values-label-and-id/274218 "2021-05-31T08:39:38Z")
Dear ES community, I hope someone can help me out with a (honestly) very basic question. I’m posting this because I couldn’t find a simple answer, to my surprise. Let’s say I have a blog post indexed in ES (example bel… --- ## [How to create temporary tables in beeline SparkSQL for ElasticSearch. ElasticSearch is behind HAProxy](https://discuss.elastic.co/t/how-to-create-temporary-tables-in-beeline-sparksql-for-elasticsearch-elasticsearch-is-behind-haproxy/274461)
**Author:** [@Chilaka\_Ramakrishna](https://discuss.elastic.co/u/Chilaka_Ramakrishna)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 8:20am UTC](https://discuss.elastic.co/t/how-to-create-temporary-tables-in-beeline-sparksql-for-elasticsearch-elasticsearch-is-behind-haproxy/274461 "2021-05-31T08:20:36Z")
How to connect beeline to elasticsearch via HAPROXY. CREATE TEMPORARY TABLE temp\_table USING org.elasticsearch.spark.sql OPTIONS (resource 'temp\_index/\_doc', nodes 'preview.abc.com', mapping.date.rich 'false', nodes.pat… --- ## [Update index by query error large index](https://discuss.elastic.co/t/update-index-by-query-error-large-index/274079)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 8:06am UTC](https://discuss.elastic.co/t/update-index-by-query-error-large-index/274079 "2021-05-31T08:06:52Z")
Hey, I'm trying to update my index by query like so: POST my\_index/\_update\_by\_query?pipeline=my\_pipeline&conflicts=proceed Because my index has alot of docs (nearly 40mil) the update stops after some thousand docs and… --- ## [Architecture of elasticsearch-xpack monitoring with Metricbeat](https://discuss.elastic.co/t/architecture-of-elasticsearch-xpack-monitoring-with-metricbeat/274168)
**Author:** [@kodka](https://discuss.elastic.co/u/kodka)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 8:03am UTC](https://discuss.elastic.co/t/architecture-of-elasticsearch-xpack-monitoring-with-metricbeat/274168 "2021-05-31T08:03:24Z")
Documentation (Collecting Elasticsearch monitoring data with Metricbeat | Elasticsearch Guide \[7.13\] | Elastic) says: "Ideally install a single Metricbeat instance configured with scope: cluster and configure hosts to po… --- ## [Similarly module code not working in Node.Js](https://discuss.elastic.co/t/similarly-module-code-not-working-in-node-js/274114)
**Author:** [@appydam](https://discuss.elastic.co/u/appydam)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:55am UTC](https://discuss.elastic.co/t/similarly-module-code-not-working-in-node-js/274114 "2021-05-31T07:55:30Z")
I have some data and I have to apply similarity module on it in settings part. I did that in Node.Js I sent data to Elasticsearch Kibana with Bulk API but similarity module is not working. I need help like how to integ… --- ## [Update boost value in index mapping is not taking effect](https://discuss.elastic.co/t/update-boost-value-in-index-mapping-is-not-taking-effect/274158)
**Author:** [@Anand\_Bhagwat](https://discuss.elastic.co/u/Anand_Bhagwat)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:54am UTC](https://discuss.elastic.co/t/update-boost-value-in-index-mapping-is-not-taking-effect/274158 "2021-05-31T07:54:34Z")
Hi, I have index configuration mapping file which I am using to create an index. The mapping contains dynamic mappings with boost value in it. Json snippet is given below: "mappings": { "dynamic\_templates":… --- ## [Elastic search wildcard search space issue](https://discuss.elastic.co/t/elastic-search-wildcard-search-space-issue/274263)
**Author:** [@Mithoon](https://discuss.elastic.co/u/Mithoon)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:53am UTC](https://discuss.elastic.co/t/elastic-search-wildcard-search-space-issue/274263 "2021-05-31T07:53:26Z")
Consider index field " ProductName " having the value " dove 3.75oz " and when user searches for "dove 3.75oz" text below bool query is working fine to retreive the document: {"bool":{"must":\[{"wildcard":{"ProductName":… --- ## [License is expired](https://discuss.elastic.co/t/license-is-expired/274464)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 7:52am UTC](https://discuss.elastic.co/t/license-is-expired/274464 "2021-05-31T07:52:31Z")
I use free version of ELK stack and I receive message "Your trial license is expired". What needs to be done to renew the license? How I can resolve this issues? --- ## [How to merge two indices in Kibana?](https://discuss.elastic.co/t/how-to-merge-two-indices-in-kibana/274322)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 7:34am UTC](https://discuss.elastic.co/t/how-to-merge-two-indices-in-kibana/274322 "2021-05-31T07:34:55Z")
It is possible to merge to indices in kibana. In two indices some columns are same and some not. I want to merge that indices into one. I have merge two indices but they are appended. Means I get the appended data one ov… --- ## [Export CSV from Vegalite Visualization](https://discuss.elastic.co/t/export-csv-from-vegalite-visualization/274160)
**Author:** [@deeksha39](https://discuss.elastic.co/u/deeksha39)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:25am UTC](https://discuss.elastic.co/t/export-csv-from-vegalite-visualization/274160 "2021-05-31T07:25:01Z")
I want to export the data in csv format from vegalite visualization. is it possible in kibana? --- ## [Speed Up Query of huge indices](https://discuss.elastic.co/t/speed-up-query-of-huge-indices/274424)
**Author:** [@arkash20](https://discuss.elastic.co/u/arkash20)\ **Replies:** 6\ **Last updated:** [May 31, 2021, 7:24am UTC](https://discuss.elastic.co/t/speed-up-query-of-huge-indices/274424 "2021-05-31T07:24:09Z")
Hi, I would like to have your opinion about the next challenge I face: We have an index with about 200M records. We would like get all the records periodically, and send it to a service for some internal purpose. I t… --- ## [Elasticsearch Ram recommendation](https://discuss.elastic.co/t/elasticsearch-ram-recommendation/274300)
**Author:** [@godisdj007](https://discuss.elastic.co/u/godisdj007)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch-ram-recommendation/274300 "2021-05-31T07:23:50Z")
I'm deploying an Elasticsearch cluster with roughly 40GB a day with a time-to-live of 365 days. Write speed would be around 50 msgs/sec. Reads would be mostly driven by user dashboards, so the read frequency won't be hig… --- ## [Watcher 7.8 Do I have to modify the range of my query to match the timezone?](https://discuss.elastic.co/t/watcher-7-8-do-i-have-to-modify-the-range-of-my-query-to-match-the-timezone/274103)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 7:21am UTC](https://discuss.elastic.co/t/watcher-7-8-do-i-have-to-modify-the-range-of-my-query-to-match-the-timezone/274103 "2021-05-31T07:21:15Z")
Hi, I have create an alert whenever match a field, and Im having problems to make it work. the query works well in devs tools when I query for now-7d, but in the watch is never executed. this is my range "… --- ## [Watcher @timestamp timezone](https://discuss.elastic.co/t/watcher-timestamp-timezone/274167)
**Author:** [@toms130](https://discuss.elastic.co/u/toms130)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:19am UTC](https://discuss.elastic.co/t/watcher-timestamp-timezone/274167 "2021-05-31T07:19:07Z")
Hi there, I can't figure how t change timestamp timezone in watcher output I got . Below is my watcher alert { "trigger": { "schedule": { "interval": "15m" } }, "input": { "search": { "re… --- ## [Sending data from elasticsearch to mixpanel](https://discuss.elastic.co/t/sending-data-from-elasticsearch-to-mixpanel/274455)
**Author:** [@faizanammar](https://discuss.elastic.co/u/faizanammar)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 7:18am UTC](https://discuss.elastic.co/t/sending-data-from-elasticsearch-to-mixpanel/274455 "2021-05-31T07:18:13Z")
Hello, I wanna know and have guidance on any mechanism to send the data stored in ElasticSearch to MixPanel. Is there any way to accomplish this.? Thanks. F. --- ## [503 Service Unavailable - Master not discovered error in AKS](https://discuss.elastic.co/t/503-service-unavailable-master-not-discovered-error-in-aks/273713)
**Author:** [@pindropviolence](https://discuss.elastic.co/u/pindropviolence)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 7:18am UTC](https://discuss.elastic.co/t/503-service-unavailable-master-not-discovered-error-in-aks/273713 "2021-05-31T07:18:03Z")
HI, I have a AKS cluster (k1) with 3 nodes. I have deployed ECK operator using all\_in\_one.yaml. I have another AKS cluster(k2) which is running my application stack , i have installed filebeats in this cluster (k2) and… --- ## [Java Agent 1.23 with AdoptOpenJDK 11 leads to NoClassDefFoundError in javax/servlet/ServletContext](https://discuss.elastic.co/t/java-agent-1-23-with-adoptopenjdk-11-leads-to-noclassdeffounderror-in-javax-servlet-servletcontext/274216)
**Author:** [@Michael\_C](https://discuss.elastic.co/u/Michael_C)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 6:54am UTC](https://discuss.elastic.co/t/java-agent-1-23-with-adoptopenjdk-11-leads-to-noclassdeffounderror-in-javax-servlet-servletcontext/274216 "2021-05-31T06:54:56Z")
Kibana version: 7.13 Elasticsearch version: 7.13 APM Server version: 7.13 APM Agent language and version: java 1.23 Description of the problem including expected versus actual behavior. Please include screenshots (if… --- ## [Mathlion](https://discuss.elastic.co/t/mathlion/274354)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 6:45am UTC](https://discuss.elastic.co/t/mathlion/274354 "2021-05-31T06:45:18Z")
Hi I would like to use mathlion for calculation of daily data which is stored in elastic search.... I am using latest version of kibana 7.13 --- ## [Relevant data not coming in elasticsearch](https://discuss.elastic.co/t/relevant-data-not-coming-in-elasticsearch/274456)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 6:40am UTC](https://discuss.elastic.co/t/relevant-data-not-coming-in-elasticsearch/274456 "2021-05-31T06:40:25Z")
Hi, I am building a search with edge ngram. Here is my mapping: PUT xyz { "settings": { "analysis": { "filter": { "autocomplete": { "type": "edge\_ngram", "min\_gram": 2, "max\_g… --- ## [Fleet Server installation options](https://discuss.elastic.co/t/fleet-server-installation-options/274261)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 6:29am UTC](https://discuss.elastic.co/t/fleet-server-installation-options/274261 "2021-05-31T06:29:59Z")
Hey, currently, the only way to install fleet server is using a subprocess of elastic agent. This is very weird to me - Elastic Agent is a client component, and Fleet Server is an infrastructure component. I typically … --- ## [All fields should at least contain one term and all terms should be present](https://discuss.elastic.co/t/all-fields-should-at-least-contain-one-term-and-all-terms-should-be-present/272426)
**Author:** [@My-project-repositor](https://discuss.elastic.co/u/My-project-repositor)\ **Replies:** 6\ **Last updated:** [May 31, 2021, 5:43am UTC](https://discuss.elastic.co/t/all-fields-should-at-least-contain-one-term-and-all-terms-should-be-present/272426 "2021-05-31T05:43:47Z")
Hello, How can I query documents where all fields should at least contain one term and all terms should be present ? Suppose I have this index PUT /test\_query { "mappings": { "properties": { "firstname": { … --- ## [I want to save all \_grokparsefailure entries in a file to review them later, however](https://discuss.elastic.co/t/i-want-to-save-all-grokparsefailure-entries-in-a-file-to-review-them-later-however/273477)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 5\ **Last updated:** [May 31, 2021, 5:22am UTC](https://discuss.elastic.co/t/i-want-to-save-all-grokparsefailure-entries-in-a-file-to-review-them-later-however/273477 "2021-05-31T05:22:17Z")
My output configuration portion: if "\_grokparsefailure" in \[tags\] { file { path =\> "/home/myaccount/testfolder/grokfailures" file\_mode =\> 0600 } } else { file { path =\> "/home/myaccount/testfolder/groksuccess" … --- ## [Threshold detection not working with group by](https://discuss.elastic.co/t/threshold-detection-not-working-with-group-by/274362)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 3:57am UTC](https://discuss.elastic.co/t/threshold-detection-not-working-with-group-by/274362 "2021-05-31T03:57:27Z")
Hi All, I am using Elastic version 7.12. I want to create a detection rule based on the threshold. My requirements is as follows. Identify possible Bruteforce attack coming from same source IP. If there are more than … --- ## [Detection Rule - Output of a aggregation bucket should match with other types of logs in the same index](https://discuss.elastic.co/t/detection-rule-output-of-a-aggregation-bucket-should-match-with-other-types-of-logs-in-the-same-index/274345)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 0\ **Last updated:** [May 28, 2021, 1:02pm UTC](https://discuss.elastic.co/t/detection-rule-output-of-a-aggregation-bucket-should-match-with-other-types-of-logs-in-the-same-index/274345 "2021-05-28T13:02:20Z")
Hi, Can someone please help to create a detection rule based on logic mentioned below. All unique mac.address field name with common.role:rogue should be aggregated and matched againewith the mac.address field name wit… --- ## [Kibana is not acessible locally](https://discuss.elastic.co/t/kibana-is-not-acessible-locally/274397)
**Author:** [@hulkbuster](https://discuss.elastic.co/u/hulkbuster)\ **Replies:** 2\ **Last updated:** [May 30, 2021, 11:34pm UTC](https://discuss.elastic.co/t/kibana-is-not-acessible-locally/274397 "2021-05-30T23:34:03Z")
Hello! I'm new to Kibana and trying to setup Elastic Stack locally following this tutorial: https://www.rosehosting.com/blog/how-to-install-elk-stack-on-ubuntu-20-04/ All systemd services are running, but Kibana is not… --- ## [Updating from 7.10 to 7.13](https://discuss.elastic.co/t/updating-from-7-10-to-7-13/274163)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 10:11pm UTC](https://discuss.elastic.co/t/updating-from-7-10-to-7-13/274163 "2021-05-30T22:11:18Z")
Hi, I have a single node environment: On Server: Elasticsearch 7.10 Kibana 7.10 logstash 7.10 On Clients: packetbeat and winlogbeat both 7.10 versions. 1- How can I update to the latest version? Is there a single w… --- ## [Is there a way to exclude unwanted lines into one event with logstash](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309)
**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 5:13pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309 "2021-05-30T17:13:58Z")
i want to delete certain lines in the messsage field using logstash .I don't want to drop the field just extra lines in the field. is it possible ? --- ## [Filebeat dissect processor does nothing](https://discuss.elastic.co/t/filebeat-dissect-processor-does-nothing/274438)
**Author:** [@IvanovOleg](https://discuss.elastic.co/u/IvanovOleg)\ **Replies:** 0\ **Last updated:** [May 30, 2021, 3:52pm UTC](https://discuss.elastic.co/t/filebeat-dissect-processor-does-nothing/274438 "2021-05-30T15:52:11Z")
Hello. I want to parse logs from the java app running in the kubernetes pod. I have a filebeat configuration like this: filebeat.autodiscover: providers: - type: kubernetes templates: - condition.or:… [Previous page](https://discuss.elastic.co/latest.md?page=1650) [Next page](https://discuss.elastic.co/latest.md?page=1652)