# Latest **URL:** https://discuss.elastic.co/latest.md?page=1705 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1706 --- ## [Index sorting causes illegal\_state\_exception](https://discuss.elastic.co/t/index-sorting-causes-illegal-state-exception/271592)
**Author:** [@buinauskas\_evaldas](https://discuss.elastic.co/u/buinauskas_evaldas)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 6:23am UTC](https://discuss.elastic.co/t/index-sorting-causes-illegal-state-exception/271592 "2021-04-29T06:23:52Z")
Heavily inspired by the Introducing Index Sorting in Elasticsearch 6.0 | Elastic Blog article I went to try index sorting out for faster AND conjunctions. This is my index structure: { "index\_name": { "mappings":… --- ## [Elasticsearch SSL Configuration with existing certificate](https://discuss.elastic.co/t/elasticsearch-ssl-configuration-with-existing-certificate/271589)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 5:56am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-configuration-with-existing-certificate/271589 "2021-04-29T05:56:35Z")
I'm trying to use my own company.cer file for elasticsearch's ssl configuration. However, I've failed with some cases. The first case, I use cer extension of the certificate file in below configuration xpack.security.… --- ## [Kibana 4 to 7 update](https://discuss.elastic.co/t/kibana-4-to-7-update/271072)
**Author:** [@cesar.hernandez.a3se](https://discuss.elastic.co/u/cesar.hernandez.a3se)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 6:14am UTC](https://discuss.elastic.co/t/kibana-4-to-7-update/271072 "2021-04-29T06:14:29Z")
Hi I have a kibana 4.1.2 and I'm wondering if it's possible to update it right to the last kibana 7 version, or maybe I have to update first to an intermediate version (5, 6?) Thanks --- ## [Watcher vs Detection Rule](https://discuss.elastic.co/t/watcher-vs-detection-rule/271564)
**Author:** [@cjumper](https://discuss.elastic.co/u/cjumper)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 4:58am UTC](https://discuss.elastic.co/t/watcher-vs-detection-rule/271564 "2021-04-29T04:58:17Z")
Try to get a better understanding of the 2. Can someone explain to me the difference between a watcher and a detection rule? --- ## [Individual Tokens are not searched when a synonym rule is matched](https://discuss.elastic.co/t/individual-tokens-are-not-searched-when-a-synonym-rule-is-matched/270933)
**Author:** [@jacksumit](https://discuss.elastic.co/u/jacksumit)\ **Replies:** 4\ **Last updated:** [April 29, 2021, 4:50am UTC](https://discuss.elastic.co/t/individual-tokens-are-not-searched-when-a-synonym-rule-is-matched/270933 "2021-04-29T04:50:08Z")
Elasticsearch 7.10.2 Description: When using synonym\_graph filter, and if a synonym rule is matched, Elastic is not searching for individual tokens. I have defined below synonym rule. "synonyms": \[ … --- ## [How to List Indices based on their settings](https://discuss.elastic.co/t/how-to-list-indices-based-on-their-settings/271345)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 4:47am UTC](https://discuss.elastic.co/t/how-to-list-indices-based-on-their-settings/271345 "2021-04-29T04:47:01Z")
Hello Team I am using Elasticsearch 5.6.3 version. I know its old , we are in process of upgrading the cluster. I have a question , How to list Indexes which are having particular settings like : The ones which are ma… --- ## [Password policy configuration](https://discuss.elastic.co/t/password-policy-configuration/271531)
**Author:** [@nadia.a](https://discuss.elastic.co/u/nadia.a)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 4:18am UTC](https://discuss.elastic.co/t/password-policy-configuration/271531 "2021-04-29T04:18:58Z")
Hello is there any advancement with the new release regarding password policy configuration? how is it possible today to enforce the password choice through kibana? Thank you for your answers --- ## [Sorting logevent datetime in asc order](https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 3:57am UTC](https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532 "2021-04-29T03:57:27Z")
Hello Team, We have multiple logline for requestID & responseID. we need to identify which requestID & responseID come first and calculate difference between theses requestID time & responseID time. Request Log: OUT 2… --- ## [Kibanaで２つの時間項目の差を統計表示したい](https://discuss.elastic.co/t/kibana/271308)
**Author:** [@vavan](https://discuss.elastic.co/u/vavan)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 3:54am UTC](https://discuss.elastic.co/t/kibana/271308 "2021-04-29T03:54:53Z")
どなたかご存知の方がいたら教えて下さい。 ２つのDate型の項目（TimeA,TimeB) を持つIndexで、その２項目の時間の差をグラフに統計表示したいと思っています。 TimeB\>TimeA の前提なので、スクリプトフィールドで書けると思ったのですが、うまく書けません。 もしかしたら、Visualizationにある「高度な設定＞Json Input を使って実現でき ますか？（あれは複数項目を跨いだ演算はできない、という… --- ## [ELK 7.12 - ILM Rollover - After rollover data keeps being writing old index 000001](https://discuss.elastic.co/t/elk-7-12-ilm-rollover-after-rollover-data-keeps-being-writing-old-index-000001/271417)
**Author:** [@albertosoares](https://discuss.elastic.co/u/albertosoares)\ **Replies:** 5\ **Last updated:** [April 29, 2021, 3:27am UTC](https://discuss.elastic.co/t/elk-7-12-ilm-rollover-after-rollover-data-keeps-being-writing-old-index-000001/271417 "2021-04-29T03:27:49Z")
I am using logstash to centralize all logs from beats then send them to Elastisearch. I create all ILM policies, index templates, bootstrap each index, and everything goes perfect until rollover, the second index packetb… --- ## [How to expand elasticsearch memory disk size](https://discuss.elastic.co/t/how-to-expand-elasticsearch-memory-disk-size/271348)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 2:51am UTC](https://discuss.elastic.co/t/how-to-expand-elasticsearch-memory-disk-size/271348 "2021-04-29T02:51:02Z")
Hi elasticsearch team, I have this case where my VM size is 110gb. Then my freshly installed elasticsearch have 58gb maximum disk available. How do I Optimize my elasticsearch disk available? This cluster is a single n… --- ## [How to return default value for getCell](https://discuss.elastic.co/t/how-to-return-default-value-for-getcell/271565)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 2:21am UTC](https://discuss.elastic.co/t/how-to-return-default-value-for-getcell/271565 "2021-04-29T02:21:54Z")
Hi, I have the following canvas expression that uses getCell against a data source but it may return null, i.e.the kql returns nothing. Is there a way I can make getCell to return a default value when that happens. Any h… --- ## [Filebeat to elasticsearch configuration(mapping)](https://discuss.elastic.co/t/filebeat-to-elasticsearch-configuration-mapping/271031)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 2:18am UTC](https://discuss.elastic.co/t/filebeat-to-elasticsearch-configuration-mapping/271031 "2021-04-29T02:18:01Z")
Dear All, I am currently trying to put some files into ES using Filebeat, and meanwhile I want to see if I can set the mapping(with Filebeat, without calling API for ES). As I see from some logstash config, there's a wa… --- ## [Configuration reloading can't be used with 'config.string' (-e)](https://discuss.elastic.co/t/configuration-reloading-cant-be-used-with-config-string-e/271576)
**Author:** [@PAVAN\_KUMAR\_REDDY\_GP](https://discuss.elastic.co/u/PAVAN_KUMAR_REDDY_GP)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 1:10am UTC](https://discuss.elastic.co/t/configuration-reloading-cant-be-used-with-config-string-e/271576 "2021-04-29T01:10:00Z")
Hi Team, Getting an error " Configuration reloading can't be used with 'config.string' (-e)" while running logstash with below command. I tried testing the command in logstash version 7.6.2 and 7.9.2 . Can you please … --- ## [Can I using chinese in condition](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 5\ **Last updated:** [April 29, 2021, 1:09am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339 "2021-04-29T01:09:15Z")
Using filebeat to put log into elastic. it seemed I can not using chinese as condition. output.elasticsearch: hosts: '${ELASTICSEARCH\_HOSTS:http://10.200.101.2:9200/}' pipelines: - pipeline: yibo\_test\_jsondata … --- ## [Connect Enterprise Search to elasticsearch via SSL](https://discuss.elastic.co/t/connect-enterprise-search-to-elasticsearch-via-ssl/271466)
**Author:** [@rabi82](https://discuss.elastic.co/u/rabi82)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 1:08am UTC](https://discuss.elastic.co/t/connect-enterprise-search-to-elasticsearch-via-ssl/271466 "2021-04-29T01:08:51Z")
Hi, i have the Elasticsearch up and running with SSL the command curl --insecure -X GET 'https://localhost:9200?pretty' works perfectly now after installing the Enterprise Search, the yml looks like below :: elastics… --- ## [Filebeat AWS Module S3 input error queueURL is not in format](https://discuss.elastic.co/t/filebeat-aws-module-s3-input-error-queueurl-is-not-in-format/261850)
**Author:** [@cjm3625](https://discuss.elastic.co/u/cjm3625)\ **Replies:** 9\ **Last updated:** [April 29, 2021, 12:41am UTC](https://discuss.elastic.co/t/filebeat-aws-module-s3-input-error-queueurl-is-not-in-format/261850 "2021-04-29T00:41:17Z")
Trying to use filebeat to monitor my AWS resources in ISO environment. It looks like the AWS standard endpoint is hard coded. my filebeat.yml filebeat.inputs: - type: s3 queue\_url: https://sqs.us-iso-east-1.c2s.ic.go… --- ## [Wildcard query string](https://discuss.elastic.co/t/wildcard-query-string/271572)
**Author:** [@jrojasp95](https://discuss.elastic.co/u/jrojasp95)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 12:37am UTC](https://discuss.elastic.co/t/wildcard-query-string/271572 "2021-04-29T00:37:30Z")
Hello I need to use wildcards to query about the full\_name and pedt\_fechanac fields, since the input values ​​come from an OCR, I also need the score to be able to get the best match Any recommendation Thank you FIEL… --- ## [Extract multiple xml of multiline log](https://discuss.elastic.co/t/extract-multiple-xml-of-multiline-log/271560)
**Author:** [@E\_T\_N](https://discuss.elastic.co/u/E_T_N)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 12:21am UTC](https://discuss.elastic.co/t/extract-multiple-xml-of-multiline-log/271560 "2021-04-29T00:21:36Z")
Hello. I have a log file with similar estructure: 05 Feb 2021 14:00:00,213 \[AAA-11\] INFO - Line A:\[0\] 05 Feb 2021 14:00:00,231 \[AAA-11\] INFO - Line2:\[0\] 05 Feb 2021 14:00:00,231 \[AAA-11\] INFO - Line3\[: 0\] 05 Feb 202… --- ## [What is maximum limit for new data records for index in data visualizer in kibana?](https://discuss.elastic.co/t/what-is-maximum-limit-for-new-data-records-for-index-in-data-visualizer-in-kibana/271406)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 12:20am UTC](https://discuss.elastic.co/t/what-is-maximum-limit-for-new-data-records-for-index-in-data-visualizer-in-kibana/271406 "2021-04-29T00:20:27Z")
Hi all, I just wanted to know maximum how many records or lines of data can be uploaded for a new index in Kibana Data visualizer? What is limit for no of records or lines? Regards --- ## [Configure the anomaly detector to find unusual logon](https://discuss.elastic.co/t/configure-the-anomaly-detector-to-find-unusual-logon/271553)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:08pm UTC](https://discuss.elastic.co/t/configure-the-anomaly-detector-to-find-unusual-logon/271553 "2021-04-28T20:08:01Z")
Hello everyone, I have a document with IP address and the username. A user in a country can have an IP Address in a specific range for example from 192.168.0.0 up to 192.168.0.255. That means for example it logs on from… --- ## [Cross cluster restore is not working with security enabled on one cluster and disabled on second cluster](https://discuss.elastic.co/t/cross-cluster-restore-is-not-working-with-security-enabled-on-one-cluster-and-disabled-on-second-cluster/271495)
**Author:** [@parthv12](https://discuss.elastic.co/u/parthv12)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 12:10am UTC](https://discuss.elastic.co/t/cross-cluster-restore-is-not-working-with-security-enabled-on-one-cluster-and-disabled-on-second-cluster/271495 "2021-04-29T00:10:23Z")
Hello, I have 2 Elasticsearch clusters, one with security enabled and the other with no security. Using the same repository registered on both the clusters. While trying to restore indices from a snapshot taken on clus… --- ## [Domain Login with Elastic Diagnostics tool](https://discuss.elastic.co/t/domain-login-with-elastic-diagnostics-tool/271460)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 12:09am UTC](https://discuss.elastic.co/t/domain-login-with-elastic-diagnostics-tool/271460 "2021-04-29T00:09:46Z")
Hi, We had a problem on our Q-System yesterday so I wanted to look into it using the support diagnostics tool. As we primarily use the active directory login I tried to use the tool with my personal account which has su… --- ## [Parameters for dates](https://discuss.elastic.co/t/parameters-for-dates/271546)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 6:29pm UTC](https://discuss.elastic.co/t/parameters-for-dates/271546 "2021-04-28T18:29:52Z")
Hi, Below is my use case = % of requests where \[actual\_Date\] \<= \[Planned\_Date\]+24 hrs) I have written below query GET data\_index1/\_search { "size": 1000, "query": { "match\_all": {} }, "aggs": { "NAME": { "val… --- ## [Add users to account on Elastic Cloud](https://discuss.elastic.co/t/add-users-to-account-on-elastic-cloud/271542)
**Author:** [@christhegrand](https://discuss.elastic.co/u/christhegrand)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 12:00am UTC](https://discuss.elastic.co/t/add-users-to-account-on-elastic-cloud/271542 "2021-04-29T00:00:31Z")
How do I create an account for another user on Elastic Cloud? All I see are ways to add users as billing contacts, as operational email contacts, or to a monitoring email whitelist. --- ## [Cluster stops responding when transferring data to relational index](https://discuss.elastic.co/t/cluster-stops-responding-when-transferring-data-to-relational-index/271332)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 11:52pm UTC](https://discuss.elastic.co/t/cluster-stops-responding-when-transferring-data-to-relational-index/271332 "2021-04-28T23:52:11Z")
Hi everyone. I have a cluster of 3 main 13 data nodes. I have a relational index of 40 shards in this set. '\[ERROR\] \[o.e.x.m.c.c.ClusterStatsCollector\] \[main-3\] collector \[cluster\_stats\] timed out while collecting data' … --- ## [Additional data path not used](https://discuss.elastic.co/t/additional-data-path-not-used/270937)
**Author:** [@karlmaresch](https://discuss.elastic.co/u/karlmaresch)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 11:33pm UTC](https://discuss.elastic.co/t/additional-data-path-not-used/270937 "2021-04-28T23:33:28Z")
Hi, We currently have an elasticsearch cluster with two seperate equal servers as two data nodes - one master, one slave. The servers each have 1 TB of diskspace. However, master is now at 81% of disk usage and slave i… --- ## [Moving indices back to ilm hot phase](https://discuss.elastic.co/t/moving-indices-back-to-ilm-hot-phase/271413)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 11:31pm UTC](https://discuss.elastic.co/t/moving-indices-back-to-ilm-hot-phase/271413 "2021-04-28T23:31:46Z")
Hello, Is it possible to change the rules of ilm , so that indices will get back to hot node? For example, the original configuration was "move to warm storage after 5 days" , and we want to change it to 90 days. Ide… --- ## [APM server status is not updated](https://discuss.elastic.co/t/apm-server-status-is-not-updated/271567)
**Author:** [@thiton](https://discuss.elastic.co/u/thiton)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 11:28pm UTC](https://discuss.elastic.co/t/apm-server-status-is-not-updated/271567 "2021-04-28T23:28:15Z")
Hello, I try to install APM server but it is not detected from Kibana instance. Kibana version: 7.11.1 Elasticsearch version: 7.11.1 APM Server version: 7.11.1 \*\*\* Steps to reproduce: Download and unpack APM server… --- ## [PSI Exam Environment](https://discuss.elastic.co/t/psi-exam-environment/271563)
**Author:** [@gse](https://discuss.elastic.co/u/gse)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 10:08pm UTC](https://discuss.elastic.co/t/psi-exam-environment/271563 "2021-04-28T22:08:56Z")
Has anyone done one of the Elastic exams, with the proctor, while using a Linux workstation? I get the impression they can only handle Windows and Mac. I've asked Elastic, they didn't know. I've emailed PSIonline support… [Previous page](https://discuss.elastic.co/latest.md?page=1704) [Next page](https://discuss.elastic.co/latest.md?page=1706)