# Latest **URL:** https://discuss.elastic.co/latest.md?page=1844 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1845 --- ## [Compare two fields in same document without using script](https://discuss.elastic.co/t/compare-two-fields-in-same-document-without-using-script/263955)
**Author:** [@sardar\_nale](https://discuss.elastic.co/u/sardar_nale)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 7:53am UTC](https://discuss.elastic.co/t/compare-two-fields-in-same-document-without-using-script/263955 "2021-02-11T07:53:14Z")
Hi all, We are using elastic version 7.10.2. I want to compare two fields from a same document.Scripting is disabled in my organization. Kindly help in building below query without using script. Here my query is : nic… --- ## [Correct Index balancing between 2 different datacenter](https://discuss.elastic.co/t/correct-index-balancing-between-2-different-datacenter/263406)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 5\ **Last updated:** [February 11, 2021, 7:41am UTC](https://discuss.elastic.co/t/correct-index-balancing-between-2-different-datacenter/263406 "2021-02-11T07:41:46Z")
hi there, this is my current scenario: 5 nodes (n1-n2-n3-n4-n5) 1 index with 3 shards and 1 replica 2 datacenter (n1 in DC1, n2 in DC2, n3 in DC1, n4 in DC2, n5 in DC1) shard0 is on n1 and n5 (so in DC1) shard1 is … --- ## [Older indices are not getting deleted after rollover](https://discuss.elastic.co/t/older-indices-are-not-getting-deleted-after-rollover/263953)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 5\ **Last updated:** [February 11, 2021, 7:04am UTC](https://discuss.elastic.co/t/older-indices-are-not-getting-deleted-after-rollover/263953 "2021-02-11T07:04:10Z")
i did the following steps created an ilm policy. created an index template and attached the ilm policy to it. finally created an index using create index API. when i checked the index under index management section in… --- ## [\[Alerting\] My alerts are broken after upgrading Elastic Cloud to 7.10.2](https://discuss.elastic.co/t/alerting-my-alerts-are-broken-after-upgrading-elastic-cloud-to-7-10-2/263898)
**Author:** [@nickbabkin](https://discuss.elastic.co/u/nickbabkin)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 6:38am UTC](https://discuss.elastic.co/t/alerting-my-alerts-are-broken-after-upgrading-elastic-cloud-to-7-10-2/263898 "2021-02-11T06:38:41Z")
Hi! After upgrading ES cluster and Kibana to 7.10.2, I noticed that some of my alerts have started to throw error and hence refuse to work due to these error: An error occurred when decrypting the alert. Unable to dec… --- ## [ElasticSearch curator Instalation](https://discuss.elastic.co/t/elasticsearch-curator-instalation/263952)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 5:51am UTC](https://discuss.elastic.co/t/elasticsearch-curator-instalation/263952 "2021-02-11T05:51:48Z")
Hi Team, I wanted to install elasticsearch curator in our k8s cluster. What is the best way to have curator in k8s cluster? Is there any helm chart available for elasticsearch curator? Our k8s cluster is running on Fe… --- ## [Filebeat performance is low after upgraded to 7.9.3](https://discuss.elastic.co/t/filebeat-performance-is-low-after-upgraded-to-7-9-3/263828)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 4\ **Last updated:** [February 11, 2021, 5:31am UTC](https://discuss.elastic.co/t/filebeat-performance-is-low-after-upgraded-to-7-9-3/263828 "2021-02-11T05:31:02Z")
Hi, I am using Filebeat to read all the application logs in my openshift cluster. The filebeat sends the logs to the logstash for indexing and then to Elasticsearch and finally visible on Kibana. Using 3 filebeat pods … --- ## [Legend in map visualization](https://discuss.elastic.co/t/legend-in-map-visualization/263799)
**Author:** [@Pranath](https://discuss.elastic.co/u/Pranath)\ **Replies:** 4\ **Last updated:** [February 11, 2021, 4:38am UTC](https://discuss.elastic.co/t/legend-in-map-visualization/263799 "2021-02-11T04:38:57Z")
Hello, I have tried to get legend (as above one) for below map but didn't find that option anywhere in 7.9 version. Is there any way to add legend in map ? --- ## [Logstash Data Persistency](https://discuss.elastic.co/t/logstash-data-persistency/263948)
**Author:** [@leventyalcin](https://discuss.elastic.co/u/leventyalcin)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 4:21am UTC](https://discuss.elastic.co/t/logstash-data-persistency/263948 "2021-02-11T04:21:52Z")
Hi, As you might know, in-flight queue is hold in memory by Logstash. I'm trying to enable data persistency with a persistent queue. However, restarting logstash or the instance wipes out the data. When I saw that I t… --- ## [Certificate error when creation S3 repository for snapshot](https://discuss.elastic.co/t/certificate-error-when-creation-s3-repository-for-snapshot/263947)
**Author:** [@deependra](https://discuss.elastic.co/u/deependra)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 3:59am UTC](https://discuss.elastic.co/t/certificate-error-when-creation-s3-repository-for-snapshot/263947 "2021-02-11T03:59:00Z")
Hi team, I am trying to create a S3 repository so that I can send snapshot to it and then restore on destination cluster. I am using elasticsearch 5.2.2 version and have installed equivalent s3 repo plugin. OS - cento… --- ## [Agent service will not start, failure to authenticate to Kibana when using API key w/Elasticsearch](https://discuss.elastic.co/t/agent-service-will-not-start-failure-to-authenticate-to-kibana-when-using-api-key-w-elasticsearch/263906)
**Author:** [@dvo](https://discuss.elastic.co/u/dvo)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 1:35am UTC](https://discuss.elastic.co/t/agent-service-will-not-start-failure-to-authenticate-to-kibana-when-using-api-key-w-elasticsearch/263906 "2021-02-11T01:35:52Z")
Hello all, we're doing a POC with Windows servers running \*beat agents sending perf and event log data to a Linux VM running ELK Stack. Everything is latest version. We want to standardize on agents authenticating using … --- ## [Unable to store keystore password for elastic protocol in apm server configuraton](https://discuss.elastic.co/t/unable-to-store-keystore-password-for-elastic-protocol-in-apm-server-configuraton/263899)
**Author:** [@lnitin](https://discuss.elastic.co/u/lnitin)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 12:55am UTC](https://discuss.elastic.co/t/unable-to-store-keystore-password-for-elastic-protocol-in-apm-server-configuraton/263899 "2021-02-11T00:55:47Z")
Hi, I'm trying to store basic auth credentials in keystore, but i'm getting below error Optional protocol and basic auth credentials. protocol: "https" username: "elastic" password: "abcdefg" root@test1:/usr/share/a… --- ## [Remove garbage from message end](https://discuss.elastic.co/t/remove-garbage-from-message-end/263916)
**Author:** [@John\_Smith](https://discuss.elastic.co/u/John_Smith)\ **Replies:** 3\ **Last updated:** [February 10, 2021, 11:19pm UTC](https://discuss.elastic.co/t/remove-garbage-from-message-end/263916 "2021-02-10T23:19:13Z")
Hello, I've following message send by filebeat: "message" =\> "{"country-code":"GB","payload":"{\\"access\_token\\":\\"\*\*\*\*\*\*\*\*\*\*\\",\\"token\_type\\":\\"Bearer\\",}","status":"ok","status-code":200,"error":"","content-type":"app… --- ## [Kibana React Plugin CSS is affecting other areas of the site](https://discuss.elastic.co/t/kibana-react-plugin-css-is-affecting-other-areas-of-the-site/263936)
**Author:** [@devbot](https://discuss.elastic.co/u/devbot)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 9:55pm UTC](https://discuss.elastic.co/t/kibana-react-plugin-css-is-affecting-other-areas-of-the-site/263936 "2021-02-10T21:55:03Z")
I have a Kibana plugin, done in React, only intended as an element for Canvas Dashboard. However, I notice that certain CSS styling changes also affect other areas of the site when the plugin is deployed. Is there anythi… --- ## [Master node with 100% CPU](https://discuss.elastic.co/t/master-node-with-100-cpu/263003)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 9\ **Last updated:** [February 10, 2021, 9:36pm UTC](https://discuss.elastic.co/t/master-node-with-100-cpu/263003 "2021-02-10T21:36:32Z")
we are getting 100% CPU usage for a master node. the cluster is hosted in the Elastic cloud. any help will be appreciated! attached below the tasks (it seems to run /admin/snapshot/delete constantly ) --- ## [Optimistic locking](https://discuss.elastic.co/t/optimistic-locking/263847)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 9:28pm UTC](https://discuss.elastic.co/t/optimistic-locking/263847 "2021-02-10T21:28:11Z")
Hi all and sorry for poor english I wonder if it's correct to talk about concurrency in elasticsearch . Exists an optimistic locks for document in elasticsearch? I found this page , I wonder if it is usefull lock docu… --- ## [Cluster Node Down](https://discuss.elastic.co/t/cluster-node-down/263853)
**Author:** [@Tahir\_Khan](https://discuss.elastic.co/u/Tahir_Khan)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 9:24pm UTC](https://discuss.elastic.co/t/cluster-node-down/263853 "2021-02-10T21:24:59Z")
How can i know the cluster node is down through API i was trying with \_cluster/health but its not giving the details about the node down server. I have checked other API as well but didnt got anything. Is there anyway… --- ## [Ingest pipeline error - ailed to parse with all enclosed parsers](https://discuss.elastic.co/t/ingest-pipeline-error-ailed-to-parse-with-all-enclosed-parsers/263809)
**Author:** [@Glenn\_Glashagen](https://discuss.elastic.co/u/Glenn_Glashagen)\ **Replies:** 5\ **Last updated:** [February 10, 2021, 9:12pm UTC](https://discuss.elastic.co/t/ingest-pipeline-error-ailed-to-parse-with-all-enclosed-parsers/263809 "2021-02-10T21:12:04Z")
Hello everybody, I'm recently encountering problem with my ingestion pipeline, where part of if tries to parse a date. If it fails to do so, it should continue and not create the fields time\_log and rest\_message. This … --- ## [How to connect filebeat to azure elasticsearch](https://discuss.elastic.co/t/how-to-connect-filebeat-to-azure-elasticsearch/263833)
**Author:** [@vikramp](https://discuss.elastic.co/u/vikramp)\ **Replies:** 3\ **Last updated:** [February 10, 2021, 9:08pm UTC](https://discuss.elastic.co/t/how-to-connect-filebeat-to-azure-elasticsearch/263833 "2021-02-10T21:08:47Z")
what will be the elastic search ip/url of azure elastic-search as it contains 3 master node and 3 slave node. --- ## [🎉 Elastic Stack 7.11.0 released](https://discuss.elastic.co/t/elastic-stack-7-11-0-released/263929)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 8:32pm UTC](https://discuss.elastic.co/t/elastic-stack-7-11-0-released/263929 "2021-02-10T20:32:49Z")
:tada: Elastic Stack 7.11.0 released New in Elastic 7.11: The flexibility + savings of schema on read joins the blazing speed of schema on write. Plus, retain + search more data with searchable snapshots on low-cost obj… --- ## [Elastic Agent port number change](https://discuss.elastic.co/t/elastic-agent-port-number-change/263924)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 6\ **Last updated:** [February 10, 2021, 8:20pm UTC](https://discuss.elastic.co/t/elastic-agent-port-number-change/263924 "2021-02-10T20:20:38Z")
ECE 2.4 Elastic v7.10.1 Elastic Agent v7.10.1 I hit and issue with the "Enroll and start the Elastic Agent" step for Windows. The first error message that I started receiving was after running this in Powershell: .… --- ## [Lab 5.1 Services Layer from Certified Observability](https://discuss.elastic.co/t/lab-5-1-services-layer-from-certified-observability/263850)
**Author:** [@lielar](https://discuss.elastic.co/u/lielar)\ **Replies:** 3\ **Last updated:** [February 10, 2021, 7:37pm UTC](https://discuss.elastic.co/t/lab-5-1-services-layer-from-certified-observability/263850 "2021-02-10T19:37:01Z")
Hi I am doing Lab 5.1 and after setting up the apm-server, in step 8, I am not getting the same results what is mentioned in the Lab instructions. I have checked my settings numerous times. I also have the daemons run… --- ## [APM client node.js ResponseError](https://discuss.elastic.co/t/apm-client-node-js-responseerror/263885)
**Author:** [@mirko.spezie](https://discuss.elastic.co/u/mirko.spezie)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 7:21pm UTC](https://discuss.elastic.co/t/apm-client-node-js-responseerror/263885 "2021-02-10T19:21:58Z")
Kibana version: 7.10.2 Elasticsearch version: 7.10.2 APM Server version: 7.10.2 APM Agent language and version: node.js 3.10.0 Original install method (e.g. download page, yum, deb, from source, etc.) and version: AP… --- ## [Filebeat:7.10.0 not publishing/pushing logs to single node elasticsearch cluster deployed in kubernetes cluster](https://discuss.elastic.co/t/filebeat-7-10-0-not-publishing-pushing-logs-to-single-node-elasticsearch-cluster-deployed-in-kubernetes-cluster/263123)
**Author:** [@nirmal\_elastic](https://discuss.elastic.co/u/nirmal_elastic)\ **Replies:** 17\ **Last updated:** [February 10, 2021, 7:15pm UTC](https://discuss.elastic.co/t/filebeat-7-10-0-not-publishing-pushing-logs-to-single-node-elasticsearch-cluster-deployed-in-kubernetes-cluster/263123 "2021-02-10T19:15:18Z")
I have single node elasticsearch deployed on master node of k8s cluster and it's accessible using nodePort:30339 curl http://xx.xx.xx.xx:30339 { "name" : "elasticsearch-0", "cluster\_name" : "docker-cluster", "cluste… --- ## [Path.data and path.log not used](https://discuss.elastic.co/t/path-data-and-path-log-not-used/263912)
**Author:** [@Mark\_Pevec](https://discuss.elastic.co/u/Mark_Pevec)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 7:00pm UTC](https://discuss.elastic.co/t/path-data-and-path-log-not-used/263912 "2021-02-10T19:00:14Z")
I am running Elasticsearch on VMs in Google Cloud (using the standard latest 7.x debian package installation) and am trying out different configurations. I recently tried to run a cluster with VMs with local SSD (local … --- ## [Cisco Umbrella selfhosted s3 the queue is not processing](https://discuss.elastic.co/t/cisco-umbrella-selfhosted-s3-the-queue-is-not-processing/263152)
**Author:** [@YegorKovylyayev](https://discuss.elastic.co/u/YegorKovylyayev)\ **Replies:** 8\ **Last updated:** [February 10, 2021, 6:52pm UTC](https://discuss.elastic.co/t/cisco-umbrella-selfhosted-s3-the-queue-is-not-processing/263152 "2021-02-10T18:52:46Z")
Hello, can not connect Cisco Umbrella from self hosted s3 to filebeat on cisco.yml is have: - module: cisco umbrella: enabled: true var.input: s3 var.queue\_url: https://sqs.eu-west-1.amazonaws.com/111111111… --- ## [ECE 2.8.0 released](https://discuss.elastic.co/t/ece-2-8-0-released/263922)
**Author:** [@atorok](https://discuss.elastic.co/u/atorok)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 6:44pm UTC](https://discuss.elastic.co/t/ece-2-8-0-released/263922 "2021-02-10T18:44:50Z")
We are pleased to announce that ECE 2.8.0 has been released today. Release notes: https://www.elastic.co/guide/en/cloud-enterprise/current/ece-release-notes-2.8.0.html --- ## [Pg\_trgm similarity ( text, text ) → real (postgresql Function) on ElasticSearch](https://discuss.elastic.co/t/pg-trgm-similarity-text-text-real-postgresql-function-on-elasticsearch/263920)
**Author:** [@zied\_marouani](https://discuss.elastic.co/u/zied_marouani)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 6:34pm UTC](https://discuss.elastic.co/t/pg-trgm-similarity-text-text-real-postgresql-function-on-elasticsearch/263920 "2021-02-10T18:34:47Z")
Hello , i'm trying to imrpove the search time for a text from a postgresql database using Elasticsearch , the problem is the search returns a nameof product with best score using "similarity" function in Postgresql exam… --- ## [How to configure Auditbeat to panic the kernel if auditing fails](https://discuss.elastic.co/t/how-to-configure-auditbeat-to-panic-the-kernel-if-auditing-fails/263919)
**Author:** [@RLPowellJr](https://discuss.elastic.co/u/RLPowellJr)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-to-configure-auditbeat-to-panic-the-kernel-if-auditing-fails/263919 "2021-02-10T18:34:30Z")
Greetings all! We have a small Elastic Stack used for security-relevant event collection in a standalone Red Hat Enterprise Linux 7.4 & 7.6 modeling & simulation enclave. The Stack is just four Elasticsearch nodes, a K… --- ## [How to create a Vega bar graph with the unique count of devices?](https://discuss.elastic.co/t/how-to-create-a-vega-bar-graph-with-the-unique-count-of-devices/263447)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 14\ **Last updated:** [February 10, 2021, 6:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-vega-bar-graph-with-the-unique-count-of-devices/263447 "2021-02-10T18:30:37Z")
Hello, I have some events that where created: In file 1: {"souceNetwork":"cc567", "sourceDevice":"z01", "destinationNetwork":"cc567", "destinationDevice":"z02", "path":"/user/file1"} {"sourceNetwork":"cc567", "source… --- ## [Is it possible to split a logstash file output into a random number of output files for throughput reasons?](https://discuss.elastic.co/t/is-it-possible-to-split-a-logstash-file-output-into-a-random-number-of-output-files-for-throughput-reasons/263909)
**Author:** [@jethropickering](https://discuss.elastic.co/u/jethropickering)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 6:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-split-a-logstash-file-output-into-a-random-number-of-output-files-for-throughput-reasons/263909 "2021-02-10T18:22:24Z")
Hi all. We are writing to file at about 5000-20000 eps at times. logstash is able to do this fine. The reason we need to write to file and not an endpoint is because of a custom solution(that can't be changed) that read… [Previous page](https://discuss.elastic.co/latest.md?page=1843) [Next page](https://discuss.elastic.co/latest.md?page=1845)