# Latest **URL:** https://discuss.elastic.co/latest.md?page=1723 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1724 --- ## [Group by that returns only groups that match a condition inside each group](https://discuss.elastic.co/t/group-by-that-returns-only-groups-that-match-a-condition-inside-each-group/270674)
**Author:** [@nvano](https://discuss.elastic.co/u/nvano)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 8:59am UTC](https://discuss.elastic.co/t/group-by-that-returns-only-groups-that-match-a-condition-inside-each-group/270674 "2021-04-20T08:59:17Z")
Hello, My project has an elasticsearch dataset with lots of products that contain a group id, a price and a flag that indicates if the product is original or not: \[ { id: 456, group\_id: 1000, is\_original: true, … --- ## [Search and filter part of message](https://discuss.elastic.co/t/search-and-filter-part-of-message/270660)
**Author:** [@ELK\_gj](https://discuss.elastic.co/u/ELK_gj)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 6:55am UTC](https://discuss.elastic.co/t/search-and-filter-part-of-message/270660 "2021-04-20T06:55:24Z")
Hi, I've two separate strings like NAS-EM ATTACH\_REQUEST (0x41) to be searched in the log file and filter all the messages which has the above strings in the same line and send that data to kibana. Can you please hel… --- ## [Reindexing time series index:](https://discuss.elastic.co/t/reindexing-time-series-index/270662)
**Author:** [@Kalpa](https://discuss.elastic.co/u/Kalpa)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 8:03am UTC](https://discuss.elastic.co/t/reindexing-time-series-index/270662 "2021-04-20T08:03:10Z")
Hi all, Here is the scenarios, I need help, I have weekly based indices. for months time filter, I refer last 5 indices. for example, topic\_2021\_1, topic\_2021\_2, topic\_2021\_3, topic\_2021\_4, topic\_2021\_5. Suppose in t… --- ## [Equality shard index distribution](https://discuss.elastic.co/t/equality-shard-index-distribution/270568)
**Author:** [@sysadmin93](https://discuss.elastic.co/u/sysadmin93)\ **Replies:** 3\ **Last updated:** [April 20, 2021, 7:57am UTC](https://discuss.elastic.co/t/equality-shard-index-distribution/270568 "2021-04-20T07:57:55Z")
Hello, I have a 6 nodes clúster with indexs 3 primary shards and 3 replica shards. I'm reading documentation and not found how to force 1 shard from each index per node. It this possible? Thank you --- ## [How to get the data with concept in SQL "Group by"](https://discuss.elastic.co/t/how-to-get-the-data-with-concept-in-sql-group-by/270529)
**Author:** [@Phoebe\_Wong](https://discuss.elastic.co/u/Phoebe_Wong)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 7:48am UTC](https://discuss.elastic.co/t/how-to-get-the-data-with-concept-in-sql-group-by/270529 "2021-04-20T07:48:53Z")
Hi every one, I would like to query the data by using the concept in SQL "Group by" like below "SELECT user, DATE(timestamp), EXTRACT(HOUR FROM timestamp), floor\_name FROM location WHERE DATE(timestamp) BETWEEN "(d1) … --- ## [API call from watcher using webhook, certificate error](https://discuss.elastic.co/t/api-call-from-watcher-using-webhook-certificate-error/270363)
**Author:** [@avy](https://discuss.elastic.co/u/avy)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 7:44am UTC](https://discuss.elastic.co/t/api-call-from-watcher-using-webhook-certificate-error/270363 "2021-04-20T07:44:20Z")
Hi, We are trying to make API call as part of watcher action, using webhook to 3rd party application. When we do that we are getting below error: "type": "s\_s\_l\_handshake\_exception", "reason": "PKIX path… --- ## [How to pass dynamic username-password through nginx for authenticating embedded iframe](https://discuss.elastic.co/t/how-to-pass-dynamic-username-password-through-nginx-for-authenticating-embedded-iframe/270485)
**Author:** [@Ram\_Chaudhari](https://discuss.elastic.co/u/Ram_Chaudhari)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 7:42am UTC](https://discuss.elastic.co/t/how-to-pass-dynamic-username-password-through-nginx-for-authenticating-embedded-iframe/270485 "2021-04-20T07:42:11Z")
I have a web application created using angular 8 in which I want to embed a kibana iframe. it should auto signin once the user logs in. I have done it using nginx reverse proxy method for one user. But I have to show dif… --- ## [Include user.name field in journalbeat](https://discuss.elastic.co/t/include-user-name-field-in-journalbeat/270668)
**Author:** [@Nicoske](https://discuss.elastic.co/u/Nicoske)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 7:39am UTC](https://discuss.elastic.co/t/include-user-name-field-in-journalbeat/270668 "2021-04-20T07:39:27Z")
Hi! I have a quite minimalist journalbeat config pushing my journal to elasticsearch but I'm missing the user.name field (I have user.id). I see that it is disabled by default in the reference, but in my index settings … --- ## [Unable to automatically index nested json as nested type elastic search](https://discuss.elastic.co/t/unable-to-automatically-index-nested-json-as-nested-type-elastic-search/270627)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 5\ **Last updated:** [April 20, 2021, 7:20am UTC](https://discuss.elastic.co/t/unable-to-automatically-index-nested-json-as-nested-type-elastic-search/270627 "2021-04-20T07:20:05Z")
I am trying to index a nested json into elastic search using the bulk api. When i pass a nested json to the bulk api method, es was able to automatically identify the nested structure. Here is the json i passed - em… --- ## [Bulk renaming of fields in Kibana saved objects?](https://discuss.elastic.co/t/bulk-renaming-of-fields-in-kibana-saved-objects/270642)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 7:17am UTC](https://discuss.elastic.co/t/bulk-renaming-of-fields-in-kibana-saved-objects/270642 "2021-04-20T07:17:08Z")
I'm developing Kibana (7.11.2) dashboards based on JSON Lines data that is forwarded by a (proprietary) application that I'm also involved in developing. I'm currently using the application to forward data with "compact… --- ## [Sort aggregation by string](https://discuss.elastic.co/t/sort-aggregation-by-string/270579)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 7:06am UTC](https://discuss.elastic.co/t/sort-aggregation-by-string/270579 "2021-04-20T07:06:59Z")
Hi all and sorry for my poor english. I'd like to sort by creation (string) field this query GET /profiles/\_search { "aggs": { "filtered": { "filter": { "bool": { "must": \[ … --- ## [Check each node memory](https://discuss.elastic.co/t/check-each-node-memory/270658)
**Author:** [@Anshumanabhishek](https://discuss.elastic.co/u/Anshumanabhishek)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 6:49am UTC](https://discuss.elastic.co/t/check-each-node-memory/270658 "2021-04-20T06:49:40Z")
I am able to get "os.mem.used\_percent" by this way curl -GET "http://localhost:9200/\_nodes/stats/os". But I need to get all nodes percent only. So, that I make automation script which check if percentage not goes beyond… --- ## [Date difference columns adding an additional one hour in enhanced data table](https://discuss.elastic.co/t/date-difference-columns-adding-an-additional-one-hour-in-enhanced-data-table/270657)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 6:24am UTC](https://discuss.elastic.co/t/date-difference-columns-adding-an-additional-one-hour-in-enhanced-data-table/270657 "2021-04-20T06:24:01Z")
Hi I am having two columns, with login time and logout time, i have used computed column in enhanced tabel, The column is adding one hour day light saving time after difference. how to solve this please --- ## [Implement stemmer on search-as-you-type field](https://discuss.elastic.co/t/implement-stemmer-on-search-as-you-type-field/270656)
**Author:** [@sb8244](https://discuss.elastic.co/u/sb8244)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 6:21am UTC](https://discuss.elastic.co/t/implement-stemmer-on-search-as-you-type-field/270656 "2021-04-20T06:21:34Z")
Is it possible to easily add an additional sub-field under search-as-you-type (SAYT) to use a stemmer analyzer? Ideally, I want to keep the normal SAYT without a stemmer analyzer, and then have a single stemmed field tha… --- ## [Kibana map](https://discuss.elastic.co/t/kibana-map/269552)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 4\ **Last updated:** [April 20, 2021, 5:46am UTC](https://discuss.elastic.co/t/kibana-map/269552 "2021-04-20T05:46:14Z")
The image of the map on kibana is not showing after connected to VPN? --- ## [Getting Error on logstash log file](https://discuss.elastic.co/t/getting-error-on-logstash-log-file/270482)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 5:30am UTC](https://discuss.elastic.co/t/getting-error-on-logstash-log-file/270482 "2021-04-20T05:30:01Z")
\[2021-04-17T21:44:28,123\]\[ERROR\]\[logstash.javapipeline \] A plugin had an unrecoverable error. Will restart this plugin. Pipeline\_id:group\_index Plugin: \"beginning", … --- ## [Winlogbeat to Kibana api/failed](https://discuss.elastic.co/t/winlogbeat-to-kibana-api-failed/270530)
**Author:** [@Coeus.IT](https://discuss.elastic.co/u/Coeus.IT)\ **Replies:** 4\ **Last updated:** [April 20, 2021, 5:24am UTC](https://discuss.elastic.co/t/winlogbeat-to-kibana-api-failed/270530 "2021-04-20T05:24:21Z")
Hi, I have setup a Ubuntu server for centralized logs. Installed: Elasticsearch Kibana Logstash Now, when I wants to run ".\\winlogbeat.exe setup --dashboard" from Windows 10 machine, it shows "error connecting to k… --- ## [ElasticSearch statefulset not using data volume](https://discuss.elastic.co/t/elasticsearch-statefulset-not-using-data-volume/270636)
**Author:** [@yeyus](https://discuss.elastic.co/u/yeyus)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-statefulset-not-using-data-volume/270636 "2021-04-20T05:01:57Z")
Hi fellow users, I've deployed the following single-node setup in my k8s cluster: eck operator: 1.5.0 elasticsearch: 7.12.0 with the following config: apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasti… --- ## [Where can I find the pagination document for es7.3.1?](https://discuss.elastic.co/t/where-can-i-find-the-pagination-document-for-es7-3-1/270294)
**Author:** [@major](https://discuss.elastic.co/u/major)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 2:32am UTC](https://discuss.elastic.co/t/where-can-i-find-the-pagination-document-for-es7-3-1/270294 "2021-04-20T02:32:03Z")
I can only find the pagination doc from v7.8 at Paginate search results | Elasticsearch Guide \[7.8\] | Elastic. But for the version before it, the document is missing. I need the doc of version 7.3.1 and want to confirm i… --- ## [Metricbeat query in Kibana](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398)
**Author:** [@rckvanwijk](https://discuss.elastic.co/u/rckvanwijk)\ **Replies:** 5\ **Last updated:** [April 20, 2021, 2:15am UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398 "2021-04-20T02:15:21Z")
Hi there, I'm creating customer portals within the Kibana interface, this is working nicely. The purpose of this is, is that the customer can check the up-time of their own application without consulting us. Now i can c… --- ## [Send AIX logs to logstash](https://discuss.elastic.co/t/send-aix-logs-to-logstash/270640)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 12:04am UTC](https://discuss.elastic.co/t/send-aix-logs-to-logstash/270640 "2021-04-20T00:04:04Z")
Hi there I would know if filebeat supports the AIX machine? if not how can I send logs from AIX machines to logstash thanks --- ## [If Statements Logstash Pipeline](https://discuss.elastic.co/t/if-statements-logstash-pipeline/270637)
**Author:** [@caitlyn.carlisle](https://discuss.elastic.co/u/caitlyn.carlisle)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 11:55pm UTC](https://discuss.elastic.co/t/if-statements-logstash-pipeline/270637 "2021-04-19T23:55:51Z")
filter { if \["location\_lat"\] == “34.802075” { mutate { add\_field =\> { “Country” =\> “Syria” } } } if \["location\_lat"\] == “44.016521” { mutate { add\_field =\> { “Country” =\> “Serbia” } } } if \["locat… --- ## [Configuring SSL/TLS for elasticsearch cluster](https://discuss.elastic.co/t/configuring-ssl-tls-for-elasticsearch-cluster/270638)
**Author:** [@spartin07](https://discuss.elastic.co/u/spartin07)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:30pm UTC](https://discuss.elastic.co/t/configuring-ssl-tls-for-elasticsearch-cluster/270638 "2021-04-19T23:30:45Z")
I'm trying to enable elastic search security for my es cluster and am following this page Encrypting communications in an Elasticsearch Docker Container | Elasticsearch Guide \[7.12\] | Elastic However, unlike in the exam… --- ## [Export to PDF option missing from dashboards](https://discuss.elastic.co/t/export-to-pdf-option-missing-from-dashboards/270435)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 9\ **Last updated:** [April 19, 2021, 11:38pm UTC](https://discuss.elastic.co/t/export-to-pdf-option-missing-from-dashboards/270435 "2021-04-19T23:38:56Z")
Hi team, I have a Kibana instance w/ a platinum license and when I'm under Dashboards and I go to the share menu I don't see the option to export to PDF. I have tried enabling xpack.reporting.enabled: true on the kib… --- ## [Hands-on Verbatim Query Usage in elasticsearch using NEST.Net client](https://discuss.elastic.co/t/hands-on-verbatim-query-usage-in-elasticsearch-using-nest-net-client/270442)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:38pm UTC](https://discuss.elastic.co/t/hands-on-verbatim-query-usage-in-elasticsearch-using-nest-net-client/270442 "2021-04-19T23:38:13Z")
--- ## [Logstash: unrecognized service](https://discuss.elastic.co/t/logstash-unrecognized-service/270394)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:35pm UTC](https://discuss.elastic.co/t/logstash-unrecognized-service/270394 "2021-04-19T23:35:27Z")
Hi, I have my logstash actively running but when I executed "sudo service logstash configtest" result is "logstash: unrecognized service". I am running on Ubuntu 18.04 Many Thanks! --- ## [ElasticsearchError error=“400 - Rejected by Elasticsearch](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/270361)
**Author:** [@Julien\_BRUNET\_BTWIN](https://discuss.elastic.co/u/Julien_BRUNET_BTWIN)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:34pm UTC](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/270361 "2021-04-19T23:34:33Z")
Hello i am using EFK stack in my GKE cluster and recently i observed below errors in my fluentd logs. 2021-04-15 14:39:25 +0000 \[warn\]: dump an error event: error\_class=Fluent::Plugin::ElasticsearchErrorHandler::Elasti… --- ## [APM Agent data not getting connected/uploaded to APM Server](https://discuss.elastic.co/t/apm-agent-data-not-getting-connected-uploaded-to-apm-server/270319)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 11:34pm UTC](https://discuss.elastic.co/t/apm-agent-data-not-getting-connected-uploaded-to-apm-server/270319 "2021-04-19T23:34:19Z")
I unable to setup APM Agent load data to get updated into APM Server. In Kibana APM Server status says 'You have correctly setup APM Server' However when I click on the Agent status in Kibana it says 'No data has been … --- ## [Search in wrong Index](https://discuss.elastic.co/t/search-in-wrong-index/270369)
**Author:** [@Gioking](https://discuss.elastic.co/u/Gioking)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:33pm UTC](https://discuss.elastic.co/t/search-in-wrong-index/270369 "2021-04-19T23:33:23Z")
Hi all, I'm new to Elasticsearch, I had to add a couple of field in mssql, the same fields must be created in elasticsearch. To add new fields I follow this procedure: 1 Copy the index mapping from the original index … --- ## [How to use "explain" in Elasticsearch-PHP search operation?](https://discuss.elastic.co/t/how-to-use-explain-in-elasticsearch-php-search-operation/270367)
**Author:** [@DimanG](https://discuss.elastic.co/u/DimanG)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 9:40am UTC](https://discuss.elastic.co/t/how-to-use-explain-in-elasticsearch-php-search-operation/270367 "2021-04-16T09:40:43Z")
Hi! I'm using ELK via Elasticsearch-PHP. I want to use "explain" in certain circumstances. When I write "explain" or "\_explain" before or within "body" the result contains explanation in some cases, but it always return… [Previous page](https://discuss.elastic.co/latest.md?page=1722) [Next page](https://discuss.elastic.co/latest.md?page=1724)