# Latest **URL:** https://discuss.elastic.co/latest.md?page=1836 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1837 --- ## [Aggregating sequence of connected events](https://discuss.elastic.co/t/aggregating-sequence-of-connected-events/264421)
**Author:** [@steff1](https://discuss.elastic.co/u/steff1)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 11:25am UTC](https://discuss.elastic.co/t/aggregating-sequence-of-connected-events/264421 "2021-02-16T11:25:48Z")
Lets say I have events like this in my log {type:"approval\_revokation", approval\_id=22} {type:"approval", request\_id=12, approval\_id=22} {type:"control3", request\_id=12} {type:"control2", request\_id=12} {type:"control1"… --- ## [How to debug suggest queries](https://discuss.elastic.co/t/how-to-debug-suggest-queries/264396)
**Author:** [@Fabrizio\_Fortino](https://discuss.elastic.co/u/Fabrizio_Fortino)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 9:16am UTC](https://discuss.elastic.co/t/how-to-debug-suggest-queries/264396 "2021-02-16T09:16:27Z")
I have a suggest query that is not returning a document and I would like to understand the reason. Is there any way to debug why this happens? I tried using the explain API but this does not return back any useful inform… --- ## [“Error” message creates a pop-up \[esaggs\]\>](https://discuss.elastic.co/t/error-message-creates-a-pop-up-esaggs/260803)
**Author:** [@gulshann](https://discuss.elastic.co/u/gulshann)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 11:15am UTC](https://discuss.elastic.co/t/error-message-creates-a-pop-up-esaggs/260803 "2021-02-16T11:15:18Z")
Hi, if I am ideal for more than 10 minutes and then try to interact Dashboard then I am getting a error pop up msg in my widget. I am using kibana v 7.10 --- ## [How to setup XPack for role based acess to kibana using the offical helm charts](https://discuss.elastic.co/t/how-to-setup-xpack-for-role-based-acess-to-kibana-using-the-offical-helm-charts/264415)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 11:06am UTC](https://discuss.elastic.co/t/how-to-setup-xpack-for-role-based-acess-to-kibana-using-the-offical-helm-charts/264415 "2021-02-16T11:06:50Z")
Hello there, We are trying to setup xpack using the official helm chart for rolebased authentification. We don´t have access to our host machiene other than kubectl. Is it possible to do so ? Thanks in advance … --- ## [How to build visualizations based on String fields](https://discuss.elastic.co/t/how-to-build-visualizations-based-on-string-fields/264000)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 10:42am UTC](https://discuss.elastic.co/t/how-to-build-visualizations-based-on-string-fields/264000 "2021-02-16T10:42:52Z")
Hi there. I am trying to figure out a way to work with our data in kibana. Problem is, even tough we have a lot of diffrent lines within the Payload part of our logs wich means its kind of difficult to build filters in … --- ## [Fleet Agent on Windows goes 'Unhealthy' after 7.11 upgrade](https://discuss.elastic.co/t/fleet-agent-on-windows-goes-unhealthy-after-7-11-upgrade/264286)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 6\ **Last updated:** [February 16, 2021, 10:14am UTC](https://discuss.elastic.co/t/fleet-agent-on-windows-goes-unhealthy-after-7-11-upgrade/264286 "2021-02-16T10:14:19Z")
After upgrading Elastic-Agent to 7.11 Windows machines get a 'Unhealty' state in Fleet. Even installing Elastic-Agent on a clean installed Windows machine will get this issue. The 4 Ubuntu servers are doing well. Than… --- ## [Graph Synonym search case sensitive](https://discuss.elastic.co/t/graph-synonym-search-case-sensitive/264094)
**Author:** [@sagar.pattnayak](https://discuss.elastic.co/u/sagar.pattnayak)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 10:11am UTC](https://discuss.elastic.co/t/graph-synonym-search-case-sensitive/264094 "2021-02-16T10:11:44Z")
Hi I have applied graph synonym search and it is working as expected when ever I search on lowercase. However the moment i change the keyword to upper case it is not working as expected. For example I have the terms la… --- ## [How to add multiple filter in Search template](https://discuss.elastic.co/t/how-to-add-multiple-filter-in-search-template/264132)
**Author:** [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 9:45am UTC](https://discuss.elastic.co/t/how-to-add-multiple-filter-in-search-template/264132 "2021-02-16T09:45:57Z")
Hi, I am trying to create search template which will support the multiple term filter for different fields. I have created search template but facing issue for adding comm after each filter. in current case if all the f… --- ## [How to build Elastic APM .Net Agent in Visual Studio 2019](https://discuss.elastic.co/t/how-to-build-elastic-apm-net-agent-in-visual-studio-2019/264384)
**Author:** [@StOus87](https://discuss.elastic.co/u/StOus87)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 8:58am UTC](https://discuss.elastic.co/t/how-to-build-elastic-apm-net-agent-in-visual-studio-2019/264384 "2021-02-16T08:58:13Z")
Hi, I am trying to open APM agent code in Visual Studio. Is there a documentation which explains how to set it up. Ive got a clone from the repository in my local environment. Im trying to investigate on what needs to be… --- ## [Shards getting bigger with updates (same number of documents)](https://discuss.elastic.co/t/shards-getting-bigger-with-updates-same-number-of-documents/264329)
**Author:** [@marcineq](https://discuss.elastic.co/u/marcineq)\ **Replies:** 13\ **Last updated:** [February 16, 2021, 8:42am UTC](https://discuss.elastic.co/t/shards-getting-bigger-with-updates-same-number-of-documents/264329 "2021-02-16T08:42:23Z")
Hi all I have a ES 7 cluster of couple of EC2 instances, the index has 6 shards and each shard has 2 replicas (so 1+2 x 6 = 18 shards for an index). When I create the index each shard size is around 25-30gb and we hold … --- ## [Top\_hits aggregation performance problem](https://discuss.elastic.co/t/top-hits-aggregation-performance-problem/264336)
**Author:** [@ozgun](https://discuss.elastic.co/u/ozgun)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 8:31am UTC](https://discuss.elastic.co/t/top-hits-aggregation-performance-problem/264336 "2021-02-16T08:31:51Z")
Hello everyone, I've a query which returns response in 3k-4k ms. When i remove top\_hits aggregations it reduces to 60-70 ms. Why is top\_hits aggregation so slow? How can i speed up my query? Is there any alternative to … --- ## [Strigo environment for Elastic Eingineer I server1-20](https://discuss.elastic.co/t/strigo-environment-for-elastic-eingineer-i-server1-20/264319)
**Author:** [@rhys](https://discuss.elastic.co/u/rhys)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 7:58am UTC](https://discuss.elastic.co/t/strigo-environment-for-elastic-eingineer-i-server1-20/264319 "2021-02-16T07:58:15Z")
Hello, I am using the Strigo env with the Elastic Engineer I course. In /etc/hosts we have the details for server1-20 (as well as a host named db\_server). I wanted to have a go at setting up a large cluster with special… --- ## [Pin ES Documents at specific position](https://discuss.elastic.co/t/pin-es-documents-at-specific-position/264386)
**Author:** [@Venkata\_Naresh](https://discuss.elastic.co/u/Venkata_Naresh)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 7:21am UTC](https://discuss.elastic.co/t/pin-es-documents-at-specific-position/264386 "2021-02-16T07:21:39Z")
I have some documents in ES Index in which I have a requirement to pin the documents at specific index positions irrespective of their score based on the ids. I tried pinned query but it fetching and pinning the documen… --- ## [How to change max payload size on cloud Kibana](https://discuss.elastic.co/t/how-to-change-max-payload-size-on-cloud-kibana/264308)
**Author:** [@harmanpa](https://discuss.elastic.co/u/harmanpa)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 7:11am UTC](https://discuss.elastic.co/t/how-to-change-max-payload-size-on-cloud-kibana/264308 "2021-02-16T07:11:59Z")
I am trying to use filebeat to send logs to elastic cloud, however on calling "filebeat setup" I get the following error: Response: {"statusCode":413,"error":"Request Entity Too Large","message":"Payload content length … --- ## [\[SQL Translate API\] Wrong query generated when querying for nested fields](https://discuss.elastic.co/t/sql-translate-api-wrong-query-generated-when-querying-for-nested-fields/264083)
**Author:** [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 6:32am UTC](https://discuss.elastic.co/t/sql-translate-api-wrong-query-generated-when-querying-for-nested-fields/264083 "2021-02-16T06:32:24Z")
Hi folks, I have an index with documents that are customer centric. Every document has customer ID, array of orders, within orders array we have an items array. Both orders and items fields are of type nested. There is … --- ## [Feature Requests](https://discuss.elastic.co/t/feature-requests/264276)
**Author:** [@fchiorascu](https://discuss.elastic.co/u/fchiorascu)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 6:22am UTC](https://discuss.elastic.co/t/feature-requests/264276 "2021-02-16T06:22:19Z")
Hi, Dear Product team, below are some kind feature requests: In Stack Monitoring view of Elastic Stack it will be a great feature to have a maturity overall index of the stack deployed/installed having the acceptance… --- ## [Elastic Cloud Elasticsearch with nginx reverse proxy](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-with-nginx-reverse-proxy/264152)
**Author:** [@CrystalDesignDR](https://discuss.elastic.co/u/CrystalDesignDR)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 5:59am UTC](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-with-nginx-reverse-proxy/264152 "2021-02-16T05:59:31Z")
Hi, I'm trying to use nginx to have a better looking domain name for elastic cloud, APM reverse proxy works so far, however the elasticsearch endpoint wont work, any ideas? I've also tried everything listed here Nginx… --- ## [Unable to start elasticsearch](https://discuss.elastic.co/t/unable-to-start-elasticsearch/264313)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 5:51am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch/264313 "2021-02-16T05:51:34Z")
Hi, I am unable to start Elasticsearch on docker. Refer following screenshot for error. Can anyone help me to solve this error. Elasticsearch version - 6.4.3 Thanks --- ## [Transform Hour and date](https://discuss.elastic.co/t/transform-hour-and-date/264347)
**Author:** [@Jelssy\_Pomar\_Alvan](https://discuss.elastic.co/u/Jelssy_Pomar_Alvan)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 5:13am UTC](https://discuss.elastic.co/t/transform-hour-and-date/264347 "2021-02-16T05:13:39Z")
Hello, I am new to Kibana, I have a Table with 2 columns (dateini and date end) with format "dd / mm / yyyy hh: mm: ss". I need to change this format to "hh: mm: ss" and then do a subtraction of these 2 fields and displa… --- ## [Formato de Hora y Fecha](https://discuss.elastic.co/t/formato-de-hora-y-fecha/264346)
**Author:** [@Jelssy\_Pomar\_Alvan](https://discuss.elastic.co/u/Jelssy_Pomar_Alvan)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 4:55am UTC](https://discuss.elastic.co/t/formato-de-hora-y-fecha/264346 "2021-02-16T04:55:44Z")
Hola, soy nueva en Kibana, tengo una Tabla con 2 columnas (fechaini y fechafin) con formato "dd/mm/yyyy hh:mm:ss" . Necesito cambiar este formato a "hh:mm:ss" y luego hacer una resta de estos 2 campos. Por ejemplo: 19:… --- ## [Creating a visualization for Top CPU hits over last 24 hours](https://discuss.elastic.co/t/creating-a-visualization-for-top-cpu-hits-over-last-24-hours/264374)
**Author:** [@kamal\_thapa](https://discuss.elastic.co/u/kamal_thapa)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 4:23am UTC](https://discuss.elastic.co/t/creating-a-visualization-for-top-cpu-hits-over-last-24-hours/264374 "2021-02-16T04:23:33Z")
Hello, I am new to Elasticsearch. We have 50 servers to monitor and It is essential for us to find the top CPU hits over last 24 hours. The diagram should show the top CPU hit with timestamp. What visualization would be … --- ## [Syslog output date format](https://discuss.elastic.co/t/syslog-output-date-format/264366)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 7\ **Last updated:** [February 16, 2021, 3:38am UTC](https://discuss.elastic.co/t/syslog-output-date-format/264366 "2021-02-16T03:38:39Z")
Hi, I am running Windows logs successfully to our SIEM using a kafka input and a logstash syslog output. The logs are parsing perfectly in the SIEM. When running a virtually identical pipeline to poll a different topi… --- ## [LogStash::ConfigurationError", :message=\>"Expected one of \[A-Za-z0-9\_-\]](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 15\ **Last updated:** [February 16, 2021, 3:27am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315 "2021-02-16T03:27:30Z")
Hi Guys, Good Day!! I am facing the issue while staring the logstash. LogStash::ConfigurationError", :message=\>"Expected one of \[A-Za-z0-9\_-\] \[ \\t\\r\\n\], "#", "{", \[A-Za-z0-9\_\], "}" at line 49, column 31 (byte 1290) af… --- ## [Understanding implications of \`index: false\` with \`type: keyword\`](https://discuss.elastic.co/t/understanding-implications-of-index-false-with-type-keyword/264352)
**Author:** [@workmanw](https://discuss.elastic.co/u/workmanw)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 1:14am UTC](https://discuss.elastic.co/t/understanding-implications-of-index-false-with-type-keyword/264352 "2021-02-16T01:14:37Z")
Hello, I have a pretty simple use case that has been discussed at length on this forum, I'm storing a large block of text that I just want to reside in my source document, not be indexed at all. Originally this field wa… --- ## [Customise labels of pie in AWS ES Kibana](https://discuss.elastic.co/t/customise-labels-of-pie-in-aws-es-kibana/264372)
**Author:** [@markk](https://discuss.elastic.co/u/markk)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 1:12am UTC](https://discuss.elastic.co/t/customise-labels-of-pie-in-aws-es-kibana/264372 "2021-02-16T01:12:00Z")
Good day, I am using AWS ES Kibana and I created a pie chart to figure out the number of 1's and 0's of a certain field ("approved"). This was created with Metrics - Aggregation: Count, Buckets - Split Slices, Aggregati… --- ## [Recommanded setting for 3 nodes elasticsearch](https://discuss.elastic.co/t/recommanded-setting-for-3-nodes-elasticsearch/264293)
**Author:** [@nawanop-AMNB](https://discuss.elastic.co/u/nawanop-AMNB)\ **Replies:** 1\ **Last updated:** [February 15, 2021, 10:42pm UTC](https://discuss.elastic.co/t/recommanded-setting-for-3-nodes-elasticsearch/264293 "2021-02-15T22:42:24Z")
I'm new at elasticsearch , so I need some advice to build 3 nodes elasticsearch on small production which can handle about 2-3 tps when it peaks option 1: 3 nodes 1.1 node 1: - master: true - data: false - RAM 4 GB … --- ## [Elasticsearch-certutil http](https://discuss.elastic.co/t/elasticsearch-certutil-http/264341)
**Author:** [@Abdullah\_Al-Mansour](https://discuss.elastic.co/u/Abdullah_Al-Mansour)\ **Replies:** 2\ **Last updated:** [February 15, 2021, 10:42pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http/264341 "2021-02-15T22:42:02Z")
License: Basic OS: Windows10 & Windows Server 2016 version: elasticsearch 7.2.0 Issue: elasticsearch-certutil does not contain the HTTP option. Attempts to enter elasticsearch-certutil http on the commandline fail wit… --- ## [Cluster Rebalancing](https://discuss.elastic.co/t/cluster-rebalancing/264303)
**Author:** [@cwiechmann](https://discuss.elastic.co/u/cwiechmann)\ **Replies:** 2\ **Last updated:** [February 15, 2021, 10:40pm UTC](https://discuss.elastic.co/t/cluster-rebalancing/264303 "2021-02-15T22:40:17Z")
Hi All, I'm using ILM policies and as part of the Warm-Phase indices should be shrinked. As you know, for that all of the shards of an index must be reallocated to a single node, which unfortunately quite often fails. I… --- ## [How do I check what causing high JVM?](https://discuss.elastic.co/t/how-do-i-check-what-causing-high-jvm/264118)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 4\ **Last updated:** [February 15, 2021, 10:35pm UTC](https://discuss.elastic.co/t/how-do-i-check-what-causing-high-jvm/264118 "2021-02-15T22:35:58Z")
Hi, We have been having some heavy load on our system, but I am not exactly sure what causing them. Just wondering is there a way to check what have caused the high JVM load in our system. I know the high JVM load can b… --- ## [ECK on AWS EKS: Readiness probe failed when using ingress and nodeport for es](https://discuss.elastic.co/t/eck-on-aws-eks-readiness-probe-failed-when-using-ingress-and-nodeport-for-es/264354)
**Author:** [@vinnar](https://discuss.elastic.co/u/vinnar)\ **Replies:** 0\ **Last updated:** [February 15, 2021, 7:51pm UTC](https://discuss.elastic.co/t/eck-on-aws-eks-readiness-probe-failed-when-using-ingress-and-nodeport-for-es/264354 "2021-02-15T19:51:58Z")
Hi Guys, I am trying to setup an elastic-kibana stack on EKS, starting with the quickstart template and then making changes incrementally to make it more suitable for the environment. For the es, I started with the Clu… [Previous page](https://discuss.elastic.co/latest.md?page=1835) [Next page](https://discuss.elastic.co/latest.md?page=1837)