# Latest **URL:** https://discuss.elastic.co/latest.md?page=1864 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1865 --- ## [How to sum bucket aggregations in ranges](https://discuss.elastic.co/t/how-to-sum-bucket-aggregations-in-ranges/262602)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 3:23pm UTC](https://discuss.elastic.co/t/how-to-sum-bucket-aggregations-in-ranges/262602 "2021-02-01T15:23:07Z")
Hi, I have a ELK setup of 7.10.0v. I have created one data-table with sum of brokerage, Unique count of Client\_id and so on, now in the bucket I want to do the ranges on sum of brokerage. How can I take sum of brokerag… --- ## [Terms Aggregation not returning keys](https://discuss.elastic.co/t/terms-aggregation-not-returning-keys/262634)
**Author:** [@gabe.ks11](https://discuss.elastic.co/u/gabe.ks11)\ **Replies:** 15\ **Last updated:** [February 1, 2021, 2:59pm UTC](https://discuss.elastic.co/t/terms-aggregation-not-returning-keys/262634 "2021-02-01T14:59:06Z")
Hi everyone, So recently we ran into a problem using elastic, we are attempting to detect records which have a duplicate value (hash) and to patch them with a flag so that we iterate all records as we go. (27 million re… --- ## [Auto create DataStream by writing to it](https://discuss.elastic.co/t/auto-create-datastream-by-writing-to-it/262848)
**Author:** [@gkman](https://discuss.elastic.co/u/gkman)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 2:29pm UTC](https://discuss.elastic.co/t/auto-create-datastream-by-writing-to-it/262848 "2021-02-01T14:29:28Z")
Hi. Is it possible to create a DataStream by attempting to writing to it? (similarly to the way index can be created by attempting to write to it.) --- ## [Question about line color for a Vega scatter chart](https://discuss.elastic.co/t/question-about-line-color-for-a-vega-scatter-chart/262679)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 2:20pm UTC](https://discuss.elastic.co/t/question-about-line-color-for-a-vega-scatter-chart/262679 "2021-02-01T14:20:54Z")
I have, what I assume is, an easy question. I have a scatter chart (code below) and I want to make the vertical and horizontal line black. Right now it's white. I have tried a handful of different things but nothing h… --- ## [Updating non-file synonyms](https://discuss.elastic.co/t/updating-non-file-synonyms/262364)
**Author:** [@Henr1k](https://discuss.elastic.co/u/Henr1k)\ **Replies:** 6\ **Last updated:** [February 1, 2021, 2:17pm UTC](https://discuss.elastic.co/t/updating-non-file-synonyms/262364 "2021-02-01T14:17:52Z")
Hi, I was trying to do updates on non-file synonyms, but it fails. Do I have to use a file or am I doing it wrong? Files isn't that well supported in Elasticsearch Cloud. It is only via Cloud UI or have I missed an AP… --- ## [Disabled object fields appearing on fields list and being parsed on document detail](https://discuss.elastic.co/t/disabled-object-fields-appearing-on-fields-list-and-being-parsed-on-document-detail/262526)
**Author:** [@mxandeco](https://discuss.elastic.co/u/mxandeco)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 2:10pm UTC](https://discuss.elastic.co/t/disabled-object-fields-appearing-on-fields-list-and-being-parsed-on-document-detail/262526 "2021-02-01T14:10:11Z")
I have a template like: { "index\_patterns": \["events-\*"\], "mappings": { "properties": { "id": { "type": "keyword" }, "topic": { "type": "keyword" }, "name": { "type": "keyword" }, "timestam… --- ## [How to collect \`dmesg\` outputs - or those logs are useless?](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 2:08pm UTC](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714 "2021-02-01T14:08:54Z")
Hi thanks for the lib! I wonder (1) whether I should collect dmesg outputs? Are they useful or useless? In addition, I wonder how can I collect them using Filebeat? Thanks! --- ## [Accessing .watcher-history index in Canvas?](https://discuss.elastic.co/t/accessing-watcher-history-index-in-canvas/262823)
**Author:** [@VishalBhalla](https://discuss.elastic.co/u/VishalBhalla)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 1:56pm UTC](https://discuss.elastic.co/t/accessing-watcher-history-index-in-canvas/262823 "2021-02-01T13:56:01Z")
Hello, I can't seem to access the .watcher-history index from within Canvas. Trying to use an ESSQL query such as: SELECT "result.input.payload.alert.hits.hits" FROM ".watcher-history" LIMIT 99 Just results in the err… --- ## [Can you have a data table visualization using computed metric?](https://discuss.elastic.co/t/can-you-have-a-data-table-visualization-using-computed-metric/262267)
**Author:** [@RandomTruffle](https://discuss.elastic.co/u/RandomTruffle)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 12:28pm UTC](https://discuss.elastic.co/t/can-you-have-a-data-table-visualization-using-computed-metric/262267 "2021-02-01T12:28:19Z")
I have a bunch of data representing individual runs of jobs in a cluster. There are a couple thousand unique kinds of jobs, and so one of the fields in each entry is the job's name. Other fields include duration, succe… --- ## [How to use grok to match filenames as indexes in logstash](https://discuss.elastic.co/t/how-to-use-grok-to-match-filenames-as-indexes-in-logstash/262840)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 1:14pm UTC](https://discuss.elastic.co/t/how-to-use-grok-to-match-filenames-as-indexes-in-logstash/262840 "2021-02-01T13:14:55Z")
We try to use developer names as indexes in logstash. Therefore our filenames are something like: developer1.log We have tried to use grok to match a certain part of the path as our filename. Nothing seems to be workin… --- ## [Logstash multilevel aggregation #logstash](https://discuss.elastic.co/t/logstash-multilevel-aggregation-logstash/262329)
**Author:** [@onkarborade](https://discuss.elastic.co/u/onkarborade)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 1:13pm UTC](https://discuss.elastic.co/t/logstash-multilevel-aggregation-logstash/262329 "2021-02-01T13:13:59Z")
Hi, I am trying do a aggregation using plugins logstash-filter-aggregate (2.8.0). I extract data from relation database using plugin-jdbc. Where a teachers has and multiple contact\_details. I would like this result: … --- ## [How to let Functionbeat write to multiple indices](https://discuss.elastic.co/t/how-to-let-functionbeat-write-to-multiple-indices/262614)
**Author:** [@yahya92](https://discuss.elastic.co/u/yahya92)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 1:11pm UTC](https://discuss.elastic.co/t/how-to-let-functionbeat-write-to-multiple-indices/262614 "2021-02-01T13:11:43Z")
Hello Is there a way to let Functionbeat write to multiple indices? I have seen that it can write to only one of many indices according to defined rules. Example: output.elasticsearch: indices: - index: "index-firs… --- ## [How much heap memory need for elasticsearch data nodes](https://discuss.elastic.co/t/how-much-heap-memory-need-for-elasticsearch-data-nodes/262773)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 1:07pm UTC](https://discuss.elastic.co/t/how-much-heap-memory-need-for-elasticsearch-data-nodes/262773 "2021-02-01T13:07:40Z")
I am runnig 8 node cluster (3 Master+3 data+2 coordinate) data\_node 1 contains 714 shards and heap memory is 10gb data\_node 2 contains 715 shards and heap memory is 10gb data\_node 3 contains 715 shards and heap memory … --- ## [How ElasticSearch compare with GeoMesa](https://discuss.elastic.co/t/how-elasticsearch-compare-with-geomesa/262569)
**Author:** [@nico44000](https://discuss.elastic.co/u/nico44000)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 12:52pm UTC](https://discuss.elastic.co/t/how-elasticsearch-compare-with-geomesa/262569 "2021-02-01T12:52:37Z")
It's unclear for me how ElasticSearch 8 compare with GeoMesa, for geo-spatial queries. With ElasticSearch, I can index and query Point/Line/Polygon/MultiPolygon with very high performance. Since few years, ElasticSearc… --- ## [Kibana is slow](https://discuss.elastic.co/t/kibana-is-slow/262811)
**Author:** [@stk1](https://discuss.elastic.co/u/stk1)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 12:48pm UTC](https://discuss.elastic.co/t/kibana-is-slow/262811 "2021-02-01T12:48:01Z")
Hi, my problem is that Kibana (v7.10, but also in previous versions) is very slow when a section is changed or reloaded. For example loading the log-in screen, changing to APM etc. takes each 5-10 seconds (changing insi… --- ## [Create arrays in Logstash](https://discuss.elastic.co/t/create-arrays-in-logstash/262260)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 12:43pm UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260 "2021-02-01T12:43:27Z")
Hello guys. Dont know if it is possible, but i would like to create an array in my logstash to use in an if statement. ill give an example for you to understand me. Giving a random "log to be processed" as example: ra… --- ## [Watcher email output ,access nested aggregations fields](https://discuss.elastic.co/t/watcher-email-output-access-nested-aggregations-fields/262345)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 12:38pm UTC](https://discuss.elastic.co/t/watcher-email-output-access-nested-aggregations-fields/262345 "2021-02-01T12:38:22Z")
hi guys, i have below watcher simulation output ... how do i access and iterate over below fields and send them in email action i am trying using {{ctx.payload.aggregations.2.buckets.3.buckets.4.buckets.1.value}} but … --- ## [Snapshot Kibana 6.8 under Windows](https://discuss.elastic.co/t/snapshot-kibana-6-8-under-windows/261537)
**Author:** [@dumitrao](https://discuss.elastic.co/u/dumitrao)\ **Replies:** 13\ **Last updated:** [February 1, 2021, 12:25pm UTC](https://discuss.elastic.co/t/snapshot-kibana-6-8-under-windows/261537 "2021-02-01T12:25:21Z")
Hello, I am trying to setup Kibana to create a snapshot but I am missing the setting - Register a repository - in Kibana 6.8 I add already in the elasticsearch.yml - path.repo: E:\\Program Files\\Elastic\\\\Elasticsearch … --- ## [JMX Input Plugin Config metrics on sub path (host:port/jmx)](https://discuss.elastic.co/t/jmx-input-plugin-config-metrics-on-sub-path-host-port-jmx/262830)
**Author:** [@Andy\_Barber1](https://discuss.elastic.co/u/Andy_Barber1)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 12:24pm UTC](https://discuss.elastic.co/t/jmx-input-plugin-config-metrics-on-sub-path-host-port-jmx/262830 "2021-02-01T12:24:19Z")
Hi I am looking to do some basic JMX connection using logstash and the JMX-input plugin. basic platform stuff (elastic kibana and logstash) are working ok. the Input plugin configuration had parameters for host and port… --- ## [7.9 ILM Policy - Rollover never happens](https://discuss.elastic.co/t/7-9-ilm-policy-rollover-never-happens/262050)
**Author:** [@Mitchell](https://discuss.elastic.co/u/Mitchell)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 12:11pm UTC](https://discuss.elastic.co/t/7-9-ilm-policy-rollover-never-happens/262050 "2021-02-01T12:11:36Z")
Hello, If I have an index named config and a corresponding index pattern config\*, it is unclear to me, after several attempts, how to follow the steps in this tutorial https://www.elastic.co/guide/en/elasticsearch/refe… --- ## [Metric background colour based on query](https://discuss.elastic.co/t/metric-background-colour-based-on-query/262636)
**Author:** [@ian\_k](https://discuss.elastic.co/u/ian_k)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 11:29am UTC](https://discuss.elastic.co/t/metric-background-colour-based-on-query/262636 "2021-02-01T11:29:54Z")
Hello, I've been reading some similar posts and solutions here, but I can't get them to work. I'd like to change the colour of the background of a metric based upon the number of items returned by a query, but I'm very … --- ## [Payload score for block-max WAND](https://discuss.elastic.co/t/payload-score-for-block-max-wand/262790)
**Author:** [@robert-007](https://discuss.elastic.co/u/robert-007)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 6:34am UTC](https://discuss.elastic.co/t/payload-score-for-block-max-wand/262790 "2021-02-01T06:34:07Z")
As I read the papper "\[Optimizing Top-k Document Retrieval Strategies for Block-Max Indexes\](http://engineering.nyu.edu/~suel/papers/bmm.pdf)", i see that each block of posting list stores one max score using to skip th… --- ## [Kibana 7.10 : handling cookie on server side custom plugin](https://discuss.elastic.co/t/kibana-7-10-handling-cookie-on-server-side-custom-plugin/262770)
**Author:** [@Prathibha\_Y](https://discuss.elastic.co/u/Prathibha_Y)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 11:08am UTC](https://discuss.elastic.co/t/kibana-7-10-handling-cookie-on-server-side-custom-plugin/262770 "2021-02-01T11:08:07Z")
Hi , I am trying to add server side cookie for my custom plugin, this is the code but I am not able to get the server object from http\_server, I get this module not found error when i try to import HttpServiceSetup im… --- ## [Find all documents with a missing field (“index”: false, “store”: true)](https://discuss.elastic.co/t/find-all-documents-with-a-missing-field-index-false-store-true/262626)
**Author:** [@tworogue](https://discuss.elastic.co/u/tworogue)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 11:04am UTC](https://discuss.elastic.co/t/find-all-documents-with-a-missing-field-index-false-store-true/262626 "2021-02-01T11:04:33Z")
ElasticSearch version: 6.8.2 Index metadata fragment: { "my\_index": { "mappings": { "type": { "properties": { "my\_field": { "typ… --- ## [Is it possible to use the APM graphs on my own dashboard?](https://discuss.elastic.co/t/is-it-possible-to-use-the-apm-graphs-on-my-own-dashboard/262821)
**Author:** [@eype69](https://discuss.elastic.co/u/eype69)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 10:51am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-the-apm-graphs-on-my-own-dashboard/262821 "2021-02-01T10:51:05Z")
Is it possible to use the APM graphs on my own dashboard? I would like to have graphs of JVM Heap Memory usage for all of my nodes all on one page. At the moment I have to click in and out of different nodes to see these… --- ## [Most Recent Trend, Most Searchable keyword with ElasticSearch API](https://discuss.elastic.co/t/most-recent-trend-most-searchable-keyword-with-elasticsearch-api/262783)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 10:41am UTC](https://discuss.elastic.co/t/most-recent-trend-most-searchable-keyword-with-elasticsearch-api/262783 "2021-02-01T10:41:16Z")
Hi Team, Does Elasticsearch provide an API that gives the Most searched words, new search words, and so on? For example like google, top 10 recently searched items, top 10 most searched items? Can we achieve something… --- ## [Elasticsearch security warning when i connect to cluster from outside](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768)
**Author:** [@first100](https://discuss.elastic.co/u/first100)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 10:32am UTC](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768 "2021-02-01T10:32:50Z")
Hello, i was able to secure my elastic cluster with certificates generated from elasticsearch-certutil command, but i f try to open my node : https://elk-001:9200 from outside , receive warning from browser, about the c… --- ## [If-in statement does not work if array has one object \[SOLVED\]](https://discuss.elastic.co/t/if-in-statement-does-not-work-if-array-has-one-object-solved/262818)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 10:30am UTC](https://discuss.elastic.co/t/if-in-statement-does-not-work-if-array-has-one-object-solved/262818 "2021-02-01T10:30:16Z")
Hi, I prepare this question and also find solution after few hours, so I decide to upload question and answer, maybe it will help somebody: QUESTION: I have Filebeat in k8s that sends logs to Logstash. I have namespace… --- ## [Elasticapm.transport：flushing due to time since last flush](https://discuss.elastic.co/t/elasticapm-transport-flushing-due-to-time-since-last-flush/262805)
**Author:** [@111395](https://discuss.elastic.co/u/111395)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 10:25am UTC](https://discuss.elastic.co/t/elasticapm-transport-flushing-due-to-time-since-last-flush/262805 "2021-02-01T10:25:29Z")
I see some logs on my client: elasticapm.metrics: collecting metrics elasticapm.transport: flushing due to time since last flush 10.858s \> max\_flush\_time 10.857s urlllib3.connectionpool: http://xxx:8200 POST /intake/v2… --- ## [Logstash not reading log file but reads text file](https://discuss.elastic.co/t/logstash-not-reading-log-file-but-reads-text-file/262817)
**Author:** [@vighnesh\_mahadik](https://discuss.elastic.co/u/vighnesh_mahadik)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 10:11am UTC](https://discuss.elastic.co/t/logstash-not-reading-log-file-but-reads-text-file/262817 "2021-02-01T10:11:22Z")
The contents of my log file is same but it does not read the file in .log extension but is able to read it in .txt extension. reads .txt file and shows on console as well as kibana Config for reading .txt file :- input… [Previous page](https://discuss.elastic.co/latest.md?page=1863) [Next page](https://discuss.elastic.co/latest.md?page=1865)