# Latest **URL:** https://discuss.elastic.co/latest.md?page=1767 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1768 --- ## [Group Results of terms aggs in "parent" bucket](https://discuss.elastic.co/t/group-results-of-terms-aggs-in-parent-bucket/268205)
**Author:** [@Leander1](https://discuss.elastic.co/u/Leander1)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 11:57am UTC](https://discuss.elastic.co/t/group-results-of-terms-aggs-in-parent-bucket/268205 "2021-03-24T11:57:14Z")
Hey, I'm trying to group results which I get after doing the terms aggregation. I'm getting the following results: hospital 1, doc\_count 20; hospital 2, doc\_count 32; hospital 3, doc\_count 21; facility 1, doc\_count 11;… --- ## [Data source Not Sending Data](https://discuss.elastic.co/t/data-source-not-sending-data/267787)
**Author:** [@Bigranawab](https://discuss.elastic.co/u/Bigranawab)\ **Replies:** 3\ **Last updated:** [March 24, 2021, 11:41am UTC](https://discuss.elastic.co/t/data-source-not-sending-data/267787 "2021-03-24T11:41:31Z")
Hi, I am working on ELK stack and was wondering if a data source has stopped sending data to ELK due to any reason, how can we identify or alert team that this particular network device or server has stopped sending eve… --- ## [Autoscaling api (basic license?)](https://discuss.elastic.co/t/autoscaling-api-basic-license/267859)
**Author:** [@sc75651](https://discuss.elastic.co/u/sc75651)\ **Replies:** 5\ **Last updated:** [March 24, 2021, 11:41am UTC](https://discuss.elastic.co/t/autoscaling-api-basic-license/267859 "2021-03-24T11:41:30Z")
is this feature part of basic license - Autoscaling | Elasticsearch Reference \[master\] | Elastic is yes then, was not able to find below settings Prerequisitesedit If the Elasticsearch security features are enabled,… --- ## [Elastic Cloud vs AWS ELK as a service](https://discuss.elastic.co/t/elastic-cloud-vs-aws-elk-as-a-service/268192)
**Author:** [@evgeniy777](https://discuss.elastic.co/u/evgeniy777)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 10:46am UTC](https://discuss.elastic.co/t/elastic-cloud-vs-aws-elk-as-a-service/268192 "2021-03-24T10:46:26Z")
Hi all ! Can you please explain what the cons and pros of using both solutions ? VS https://cloud.elastic.co/ Thanks in advance --- ## [Extract day, month and year from a date field. Changing Timezone](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646)
**Author:** [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)\ **Replies:** 4\ **Last updated:** [March 24, 2021, 11:30am UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646 "2021-03-24T11:30:50Z")
Hi, I would like to add some fields extracting data from "\[layers\]\[frame\]\[frame\_frame\_time\]" field. My code is: date { match =\> \[ "\[layers\]\[frame\]\[frame\_frame\_time\]","ISO8601" \] target =\> "\[layers\]\[frame\]\[fr… --- ## [EQL detection rule run on indices created by Transforms](https://discuss.elastic.co/t/eql-detection-rule-run-on-indices-created-by-transforms/268022)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 11:02am UTC](https://discuss.elastic.co/t/eql-detection-rule-run-on-indices-created-by-transforms/268022 "2021-03-24T11:02:15Z")
Hello all, I was trying to create an EQL rule that detects port scanning activity. In order to do that I created a tranform that runs an cardinality aggregation on destination port from my netflow logs : { "id": "por… --- ## [Calculate the correct recovery.max\_bytes\_per\_sec](https://discuss.elastic.co/t/calculate-the-correct-recovery-max-bytes-per-sec/268194)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 10:41am UTC](https://discuss.elastic.co/t/calculate-the-correct-recovery-max-bytes-per-sec/268194 "2021-03-24T10:41:47Z")
Hey there, is there a way to calculate the correct value of indices.recovery.max\_bytes\_per\_sec ? --- ## [Filebeat multi-path configuration for send logs to Logstash](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599)
**Author:** [@Nagavardhan25](https://discuss.elastic.co/u/Nagavardhan25)\ **Replies:** 5\ **Last updated:** [March 24, 2021, 9:44am UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599 "2021-03-24T09:44:44Z")
Hi, I have one config file in filebeat, i am trying to add two paths for reading the logs from two different locations and under feilds i have created two directories for storing the values in logstash side. Below is th… --- ## [Elastic Cloud Enterprise 2.9.0 released](https://discuss.elastic.co/t/elastic-cloud-enterprise-2-9-0-released/268186)
**Author:** [@AranK](https://discuss.elastic.co/u/AranK)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 9:39am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-2-9-0-released/268186 "2021-03-24T09:39:19Z")
We are pleased to announce that ECE 2.9.0 has been released today. Release notes: Elastic Cloud Enterprise 2.9.0 | Elastic Cloud Enterprise Reference \[2.9\] | Elastic --- ## [Deployment of functionbeat on AWS](https://discuss.elastic.co/t/deployment-of-functionbeat-on-aws/268183)
**Author:** [@workaholicrohit](https://discuss.elastic.co/u/workaholicrohit)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 9:07am UTC](https://discuss.elastic.co/t/deployment-of-functionbeat-on-aws/268183 "2021-03-24T09:07:46Z")
How can we configure the functionbeat on AWS to push sqs data to Elastic? Do we need to install and configure functionbeat on an EC2 to configure the .yml file? --- ## [Logstash 1.5.4 Output to Elasticsearch with https](https://discuss.elastic.co/t/logstash-1-5-4-output-to-elasticsearch-with-https/268065)
**Author:** [@Dan4](https://discuss.elastic.co/u/Dan4)\ **Replies:** 12\ **Last updated:** [March 24, 2021, 9:02am UTC](https://discuss.elastic.co/t/logstash-1-5-4-output-to-elasticsearch-with-https/268065 "2021-03-24T09:02:22Z")
Hello together, I am new to the elastic stack and have no further experience than just google a solution. In my environment I have to use Logstash on a remote server. I can not change it. I have no control over the vers… --- ## [Is there an API to get the read and write performance data?](https://discuss.elastic.co/t/is-there-an-api-to-get-the-read-and-write-performance-data/267642)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 9\ **Last updated:** [March 24, 2021, 8:43am UTC](https://discuss.elastic.co/t/is-there-an-api-to-get-the-read-and-write-performance-data/267642 "2021-03-24T08:43:45Z")
ES version: 6.3.0 My ES cluster block sometimes when perform search and bulk operations, but the cluster status is green, it is strange. The cat.thread\_pool api can output some related info, but i do not know how to de… --- ## [Kibana fails to create kibana.pid in /var/run](https://discuss.elastic.co/t/kibana-fails-to-create-kibana-pid-in-var-run/267247)
**Author:** [@m-b79](https://discuss.elastic.co/u/m-b79)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 8:26am UTC](https://discuss.elastic.co/t/kibana-fails-to-create-kibana-pid-in-var-run/267247 "2021-03-24T08:26:24Z")
Hi, I am a beginner with ELK and since I've updated my Ubuntu 20.04, I have the following problem: When I want to start kibana it fails and when I check the logs it says "\[Error: ENOENT: no such file or directory, open… --- ## [Elasticsearch high cpu load on snapshot creation](https://discuss.elastic.co/t/elasticsearch-high-cpu-load-on-snapshot-creation/265650)
**Author:** [@farmean](https://discuss.elastic.co/u/farmean)\ **Replies:** 6\ **Last updated:** [March 24, 2021, 8:24am UTC](https://discuss.elastic.co/t/elasticsearch-high-cpu-load-on-snapshot-creation/265650 "2021-03-24T08:24:13Z")
Hey everyone! We've got some issue that's making us scratch our heads for a while. We have pretty straightforward setup, 13 nodes, 1 index, 1000 shards, 2 replicas for each, a lot of nested document, high write load an… --- ## [How can I add my own html input element like- Text Box, Text Area, Drop down, Save button in my Kibana dashboard UI](https://discuss.elastic.co/t/how-can-i-add-my-own-html-input-element-like-text-box-text-area-drop-down-save-button-in-my-kibana-dashboard-ui/268170)
**Author:** [@Amit\_Singh4](https://discuss.elastic.co/u/Amit_Singh4)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 8:22am UTC](https://discuss.elastic.co/t/how-can-i-add-my-own-html-input-element-like-text-box-text-area-drop-down-save-button-in-my-kibana-dashboard-ui/268170 "2021-03-24T08:22:43Z")
How can I add my own html input element like- Text Box, Text Area, Drop down, Save button in my Kibana dashboard UI. And after clicking on Button (like- Save), I want to save these new html input values into Elasticseac… --- ## [Datetime parsing errors when including locale de-AT](https://discuss.elastic.co/t/datetime-parsing-errors-when-including-locale-de-at/268091)
**Author:** [@philippkahr](https://discuss.elastic.co/u/philippkahr)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 12:21pm UTC](https://discuss.elastic.co/t/datetime-parsing-errors-when-including-locale-de-at/268091 "2021-03-23T12:21:13Z")
Hi, I am at a loss, we have to deal with german encodings of month such as Dezember instead of December, or März instead of March, which also impacts the MMM notation instead of Mar it is Mär. This is an example message… --- ## [Elasticsearch - high load CPU](https://discuss.elastic.co/t/elasticsearch-high-load-cpu/268165)
**Author:** [@Jefferson\_Ferrari](https://discuss.elastic.co/u/Jefferson_Ferrari)\ **Replies:** 22\ **Last updated:** [March 24, 2021, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-high-load-cpu/268165 "2021-03-24T07:35:28Z")
Hello guys, We have a problem with elasticserach performance. My env is: 3 masters: AWS t3.large VM on premises CPU: 2 Memory: 8GB VM on premises CPU: 2 Memory: 8GB 15 Datas AWS 5 EC2 instance m5.4xlarge 10 VMs… --- ## [Scripted Field not showing Expression Language in Kibana](https://discuss.elastic.co/t/scripted-field-not-showing-expression-language-in-kibana/267945)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [March 24, 2021, 7:07am UTC](https://discuss.elastic.co/t/scripted-field-not-showing-expression-language-in-kibana/267945 "2021-03-24T07:07:10Z")
I am not getting expression language in scripted field. I am using kibana 7.11 version. I want to perform sum on two fields but getting error --- ## [My problem about Geo-bounding box query indexed](https://discuss.elastic.co/t/my-problem-about-geo-bounding-box-query-indexed/267597)
**Author:** [@Sakura1996](https://discuss.elastic.co/u/Sakura1996)\ **Replies:** 9\ **Last updated:** [March 24, 2021, 6:42am UTC](https://discuss.elastic.co/t/my-problem-about-geo-bounding-box-query-indexed/267597 "2021-03-24T06:42:31Z")
Hi, I encountered 2 problems when following the doc, ES version is 7.9. As the doc when use type="indexed" option in bounding box query, the geo-point type must have lat and lon indexed, but I want to know how to do i… --- ## [Problem in sorting dual axis graph](https://discuss.elastic.co/t/problem-in-sorting-dual-axis-graph/265618)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 6:37am UTC](https://discuss.elastic.co/t/problem-in-sorting-dual-axis-graph/265618 "2021-03-24T06:37:38Z")
Hi, Plotted bar and line graph together, tried to sort bar graph and expected line graph to sort accordingly. where as line graph was sorted in weird manner. Output : Expected Output : { "$schema": "https://ve… --- ## [Unable to load SSL configuration for Elasticsearch](https://discuss.elastic.co/t/unable-to-load-ssl-configuration-for-elasticsearch/268087)
**Author:** [@runchranda](https://discuss.elastic.co/u/runchranda)\ **Replies:** 4\ **Last updated:** [March 24, 2021, 6:20am UTC](https://discuss.elastic.co/t/unable-to-load-ssl-configuration-for-elasticsearch/268087 "2021-03-24T06:20:57Z")
Hi, I am trying to Encrypt communications in Elasticsearch between nodes. I refer to this, \[Encrypting communications in Elasticsearch\] (Encrypting communications in Elasticsearch | Elasticsearch Reference \[7.11\] | Ela… --- ## [Unable to forward watcher alert to index with all details](https://discuss.elastic.co/t/unable-to-forward-watcher-alert-to-index-with-all-details/268048)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 5:54am UTC](https://discuss.elastic.co/t/unable-to-forward-watcher-alert-to-index-with-all-details/268048 "2021-03-24T05:54:51Z")
{ "trigger": { "schedule": { "interval": "15m" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ "##selective index##" … --- ## [Time based Indexes with the powers of ILM](https://discuss.elastic.co/t/time-based-indexes-with-the-powers-of-ilm/268038)
**Author:** [@Alamgir\_Qazi](https://discuss.elastic.co/u/Alamgir_Qazi)\ **Replies:** 5\ **Last updated:** [March 24, 2021, 5:54am UTC](https://discuss.elastic.co/t/time-based-indexes-with-the-powers-of-ilm/268038 "2021-03-24T05:54:29Z")
I want to get benefits of ILM (hot, warm, cold) features + the fixed size of indexes without changing the date/time index. Is this possible ? E.g. I have an index events-2021-03-23 and I want ILM to create a new index l… --- ## [Unable to fetch custom indices data in ECS](https://discuss.elastic.co/t/unable-to-fetch-custom-indices-data-in-ecs/267742)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 5:54am UTC](https://discuss.elastic.co/t/unable-to-fetch-custom-indices-data-in-ecs/267742 "2021-03-24T05:54:21Z")
If i add my custom indices in data sources on elastic security then how should i map field in ecs --- ## [Create debian package from source](https://discuss.elastic.co/t/create-debian-package-from-source/268097)
**Author:** [@maxlavr](https://discuss.elastic.co/u/maxlavr)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 5:04am UTC](https://discuss.elastic.co/t/create-debian-package-from-source/268097 "2021-03-24T05:04:28Z")
Hello everyone. My name is Max and my profession is DevOps. I'm working in company which use Elastic Stack. New security standards for our product require building your software from source code and creating deb packages… --- ## [How to fuzzy search a subset of the result?](https://discuss.elastic.co/t/how-to-fuzzy-search-a-subset-of-the-result/268164)
**Author:** [@nshimiye.tech](https://discuss.elastic.co/u/nshimiye.tech)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 4:34am UTC](https://discuss.elastic.co/t/how-to-fuzzy-search-a-subset-of-the-result/268164 "2021-03-24T04:34:54Z")
I have a need to search through collapsed results, is this possible? Something like this { "query": { "match\_all": {} }, "sort": { "createdTime": "desc" }, "collapse": { "field": "name.raw", "query"… --- ## [Issue with date field in CSV plugin](https://discuss.elastic.co/t/issue-with-date-field-in-csv-plugin/268047)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 7\ **Last updated:** [March 24, 2021, 4:26am UTC](https://discuss.elastic.co/t/issue-with-date-field-in-csv-plugin/268047 "2021-03-24T04:26:41Z")
Hi All, I'm trying to ingest data into elasticsearch using csv plugin, data is going smooth for one or two days then all of a sudden there is a wired entry which will get updated with some random date and year. I'm … --- ## [Cluster status turn yellow everyday morning 8:00](https://discuss.elastic.co/t/cluster-status-turn-yellow-everyday-morning-8-00/268036)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 17\ **Last updated:** [March 24, 2021, 3:10am UTC](https://discuss.elastic.co/t/cluster-status-turn-yellow-everyday-morning-8-00/268036 "2021-03-24T03:10:29Z")
ES version: 6.3.0 I get the pending tasks and thread pool status, here is the info: { "tasks": \[ { "insert\_order": 327314, "priority": "URGENT", "source": "create-index \[… --- ## [Securing Elasticsearch cluster](https://discuss.elastic.co/t/securing-elasticsearch-cluster/268132)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 2:44am UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/268132 "2021-03-24T02:44:22Z")
We know it is strongly recommended in Linux to disable root user. We know it is also recommended to disable root user in Mysql. I do not know why we can not disable/rename superuser "elastic" in elasticsearch and we ca… --- ## [Filter for When Log changes Slightly](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152)
**Author:** [@rmoss25](https://discuss.elastic.co/u/rmoss25)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 2:40am UTC](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152 "2021-03-24T02:40:27Z")
HI, How do you create a grok pattern that can handle the log changing every now and then so I have a filter written that works but every so often the last field of an almost identical log is empty and the existing filt… [Previous page](https://discuss.elastic.co/latest.md?page=1766) [Next page](https://discuss.elastic.co/latest.md?page=1768)