# Latest **URL:** https://discuss.elastic.co/latest.md?page=1891 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1892 --- ## [Filebeat not sending logs in real time](https://discuss.elastic.co/t/filebeat-not-sending-logs-in-real-time/260305)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-in-real-time/260305 "2021-01-15T13:02:20Z")
Hello Team, We have upgraded our ELK stack from 6.4 to 6.8 but we are using beats 6.4. Before upgradation all the logs were reaching on kiabna in real time. But we upgraded our ELK from 6.4 to 6.8 and now filebeat is n… --- ## [Java RestHighLevelClient: Offset stripped from query for Datehistogram in Composite aggregation](https://discuss.elastic.co/t/java-resthighlevelclient-offset-stripped-from-query-for-datehistogram-in-composite-aggregation/261259)
**Author:** [@jselberg](https://discuss.elastic.co/u/jselberg)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 12:51pm UTC](https://discuss.elastic.co/t/java-resthighlevelclient-offset-stripped-from-query-for-datehistogram-in-composite-aggregation/261259 "2021-01-15T12:51:25Z")
Hi, We're trying to aggregate some data on a weekly basis, but we would like to adjust the calculation of weeks so that the weeks starts on Sundays instead. We've tried using the offset() operation from the DateHistogr… --- ## [How to create a watcher script to match one field with other field in same document](https://discuss.elastic.co/t/how-to-create-a-watcher-script-to-match-one-field-with-other-field-in-same-document/260424)
**Author:** [@sangatamilan](https://discuss.elastic.co/u/sangatamilan)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 9:13am UTC](https://discuss.elastic.co/t/how-to-create-a-watcher-script-to-match-one-field-with-other-field-in-same-document/260424 "2021-01-07T09:13:48Z")
Hi , Can anyone please help me on this scenario to create an alert I am having a log events like the following \<#\> 20200806 17:04:23.261 280018000 EV.WRN \[ MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEB… --- ## [Java Rest API does not allow ForceMergeAction for hot phase in LifeCyclePolicy](https://discuss.elastic.co/t/java-rest-api-does-not-allow-forcemergeaction-for-hot-phase-in-lifecyclepolicy/261258)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 12:41pm UTC](https://discuss.elastic.co/t/java-rest-api-does-not-allow-forcemergeaction-for-hot-phase-in-lifecyclepolicy/261258 "2021-01-15T12:41:55Z")
While Elasticsearch REST API allows defining forcemerge action for hot phase, Java Rest API (v7.10.2) does not. This is allowed: PUT \_ilm/policy/custom-ilm-policy { "policy": { "phases": { "hot": { … --- ## [Getting error while fetching Array field using elasticsearch-sql-cli](https://discuss.elastic.co/t/getting-error-while-fetching-array-field-using-elasticsearch-sql-cli/260943)
**Author:** [@MaheshMali](https://discuss.elastic.co/u/MaheshMali)\ **Replies:** 2\ **Last updated:** [January 15, 2021, 11:42am UTC](https://discuss.elastic.co/t/getting-error-while-fetching-array-field-using-elasticsearch-sql-cli/260943 "2021-01-15T11:42:18Z")
Hi Team, I am using elasticsearch-sql-cli to fetch host.ip field value from an index called "filebeattest". The value of host.ip is shown as "10.1.10.24, 2603:301b:1080:e000:250:56ff:fe87:4, fe80::250:56ff:fe87:4" in K… --- ## [There are no external requests known to support wildcards that don't support replacing their indices](https://discuss.elastic.co/t/there-are-no-external-requests-known-to-support-wildcards-that-dont-support-replacing-their-indices/261207)
**Author:** [@tianhao](https://discuss.elastic.co/u/tianhao)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 11:31am UTC](https://discuss.elastic.co/t/there-are-no-external-requests-known-to-support-wildcards-that-dont-support-replacing-their-indices/261207 "2021-01-15T11:31:10Z")
Hello, I perform the following operations, and prompt There are no external requests known to support wildcards that don't support replacing their indices elasticsearch version: 7.8.1 POST /\*:.monitoring-es-7-\*,.monit… --- ## [Elastic-agent (manual mode) + beats specific configurations](https://discuss.elastic.co/t/elastic-agent-manual-mode-beats-specific-configurations/261253)
**Author:** [@mscc](https://discuss.elastic.co/u/mscc)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 11:12am UTC](https://discuss.elastic.co/t/elastic-agent-manual-mode-beats-specific-configurations/261253 "2021-01-15T11:12:32Z")
I'm using elastic-agent (dockerized) in manual mode. Earlier I used the same setup, just a dockerized filebeat instead of dockerized elastic-agent. To avoid shipping duplicate logs after container restart, we persistet … --- ## [Filter for entry which begins wich specific term](https://discuss.elastic.co/t/filter-for-entry-which-begins-wich-specific-term/261247)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 11:07am UTC](https://discuss.elastic.co/t/filter-for-entry-which-begins-wich-specific-term/261247 "2021-01-15T11:07:09Z")
Hi, I have a field case. The entries of that field are for example "test/dev/bla1", "test/smth/bla", "dev/smth/..." . Is it possible in Explore Tab to query for the entries which begin with "test/..." or "dev/..." ? I… --- ## [Kibana 8.0.0 can't render visualization for Percentile query results](https://discuss.elastic.co/t/kibana-8-0-0-cant-render-visualization-for-percentile-query-results/261212)
**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\ **Replies:** 2\ **Last updated:** [January 15, 2021, 11:02am UTC](https://discuss.elastic.co/t/kibana-8-0-0-cant-render-visualization-for-percentile-query-results/261212 "2021-01-15T11:02:44Z")
The search works and the results are visible from the inspect window. But the visualization complains no data as the screenshot. --- ## [Taking a snapshot](https://discuss.elastic.co/t/taking-a-snapshot/261237)
**Author:** [@Jambo80](https://discuss.elastic.co/u/Jambo80)\ **Replies:** 1\ **Last updated:** [January 15, 2021, 10:39am UTC](https://discuss.elastic.co/t/taking-a-snapshot/261237 "2021-01-15T10:39:52Z")
Hi I'm trying to take a snapshot of my 7 node 6.8.13 cluster. Is it the case that I must have some sort of network share such as NFS to achieve this, or is there a method which does not require a network share? Thanks --- ## [Aggregate 7 fields and get the sum of another field](https://discuss.elastic.co/t/aggregate-7-fields-and-get-the-sum-of-another-field/261211)
**Author:** [@vands](https://discuss.elastic.co/u/vands)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 10:14am UTC](https://discuss.elastic.co/t/aggregate-7-fields-and-get-the-sum-of-another-field/261211 "2021-01-15T10:14:25Z")
Hi All, I have a scenario , where I would need to aggregate 7 fields and get the sum of other field with each unique set . Any suggestions which would solve my issue. --- ## [Time filter not getting persisted across dashboard navigation](https://discuss.elastic.co/t/time-filter-not-getting-persisted-across-dashboard-navigation/261220)
**Author:** [@Bhavya\_Bansal](https://discuss.elastic.co/u/Bhavya_Bansal)\ **Replies:** 7\ **Last updated:** [January 15, 2021, 9:49am UTC](https://discuss.elastic.co/t/time-filter-not-getting-persisted-across-dashboard-navigation/261220 "2021-01-15T09:49:01Z")
Hi, I am using markdown viz in Kibana to link my dashboards. I would expect that the time range selected in the first dashboard will get passed down to the next one. But this isn't happening. Everytime I click on a link… --- ## [ILM is not working as per parameter](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077)
**Author:** [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 9:22am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077 "2021-01-15T09:22:08Z")
HI, here is my policy and template and attached conf file, 4100+ documents ingested successfully but it is not rolled over on 1000 doc check please help me out why it is not rolling over Here is my conf content input { … --- ## [Date histogram does not work properly with unique count value](https://discuss.elastic.co/t/date-histogram-does-not-work-properly-with-unique-count-value/261223)
**Author:** [@Abdul\_Rahman](https://discuss.elastic.co/u/Abdul_Rahman)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 8:29am UTC](https://discuss.elastic.co/t/date-histogram-does-not-work-properly-with-unique-count-value/261223 "2021-01-15T08:29:28Z")
Hello, I am using ELK 7.3 bar chart in kibana and did create unique count chart of value with date histogram but the when I use interval of monthly basis it skips one record in few months , Any idea guys how to resolv… --- ## [Unable to Upload File](https://discuss.elastic.co/t/unable-to-upload-file/261162)
**Author:** [@xenon-xenon](https://discuss.elastic.co/u/xenon-xenon)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 8:16am UTC](https://discuss.elastic.co/t/unable-to-upload-file/261162 "2021-01-15T08:16:03Z")
I run kibana 7.10.1 on windows and have ES 7.10.1 on my linux machine , I configured ES IP on kibana.yml to connect and when i run the kibana there are some errors but I can open kibana on my browser and see sample data … --- ## [Java APM Agent causes CPU spikes](https://discuss.elastic.co/t/java-apm-agent-causes-cpu-spikes/261215)
**Author:** [@bbking](https://discuss.elastic.co/u/bbking)\ **Replies:** 1\ **Last updated:** [January 15, 2021, 8:10am UTC](https://discuss.elastic.co/t/java-apm-agent-causes-cpu-spikes/261215 "2021-01-15T08:10:23Z")
Hi, I set up a java APM agent with Tomcat in production, but the agent caused CPU spikes and during that time, memory usage was normal but GC almost dropped to zero. We didn't have a heap dump but the gc log shows that d… --- ## [Logstash exporter installed for multiple services](https://discuss.elastic.co/t/logstash-exporter-installed-for-multiple-services/261219)
**Author:** [@Robin\_Antony](https://discuss.elastic.co/u/Robin_Antony)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 7:44am UTC](https://discuss.elastic.co/t/logstash-exporter-installed-for-multiple-services/261219 "2021-01-15T07:44:40Z")
I have logstash exporter used for multiple service pipelines. Some pipelines are working and some suddenly stopped giving below error which: no java in (/sbin:/bin:/usr/sbin:/usr/bin) could not find java; set JAVA\_HOME… --- ## [Need help ELK Gurus?](https://discuss.elastic.co/t/need-help-elk-gurus/260716)
**Author:** [@Ganesh\_Sharma](https://discuss.elastic.co/u/Ganesh_Sharma)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 7:41am UTC](https://discuss.elastic.co/t/need-help-elk-gurus/260716 "2021-01-15T07:41:19Z")
How do we design the size of elastic database? Is there a way to control the data being stored by elastic database? How to see the types of logs (stdout, stderr) being stored in elastic database? How to control the lo… --- ## [While taking snapshot of elastic index it takes data of which shards like primary or replica?](https://discuss.elastic.co/t/while-taking-snapshot-of-elastic-index-it-takes-data-of-which-shards-like-primary-or-replica/260953)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 7\ **Last updated:** [January 15, 2021, 7:18am UTC](https://discuss.elastic.co/t/while-taking-snapshot-of-elastic-index-it-takes-data-of-which-shards-like-primary-or-replica/260953 "2021-01-15T07:18:19Z")
Hi, I have a setup of ELK 7.10.0v. I am taking backup of elasticsearch index using snapshot API. I have a doubt while taking backup with sanpshot which shards backup does it takes like primary or replica or it takes ba… --- ## [Logstash s3 output plugin folder structure](https://discuss.elastic.co/t/logstash-s3-output-plugin-folder-structure/261152)
**Author:** [@Ohad\_Elias](https://discuss.elastic.co/u/Ohad_Elias)\ **Replies:** 2\ **Last updated:** [January 14, 2021, 4:43pm UTC](https://discuss.elastic.co/t/logstash-s3-output-plugin-folder-structure/261152 "2021-01-14T16:43:47Z")
Our DevOps engineers have been using Logstash S3 plugin which simply puts all data in a S3 bucket location. Since we have configured files to be created in every hour on S3, the number of files in the S3 location touched… --- ## [Convert field data type from text to Date](https://discuss.elastic.co/t/convert-field-data-type-from-text-to-date/260781)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 10\ **Last updated:** [January 15, 2021, 6:08am UTC](https://discuss.elastic.co/t/convert-field-data-type-from-text-to-date/260781 "2021-01-15T06:08:30Z")
Hi All, We have created an index that consists of text data type for all fields, but we need to convert timestamp field from text to date (format "2021-01-12 09:19:25.890") but unable to do. I have tried creating a new… --- ## [FIlebeat 7.10.1 logging.metrics.enabled: false appears to have no effect](https://discuss.elastic.co/t/filebeat-7-10-1-logging-metrics-enabled-false-appears-to-have-no-effect/261202)
**Author:** [@ernestr](https://discuss.elastic.co/u/ernestr)\ **Replies:** 1\ **Last updated:** [January 15, 2021, 5:53am UTC](https://discuss.elastic.co/t/filebeat-7-10-1-logging-metrics-enabled-false-appears-to-have-no-effect/261202 "2021-01-15T05:53:40Z")
Hi, I am running the Filebeat deb package on Ubuntu Server 20.04. I noticed that when I set logging.metrics.enabled: false Filebeat still writes monitoring messages to syslog and then forwards them when I have the syste… --- ## [GROK filter with KV](https://discuss.elastic.co/t/grok-filter-with-kv/261209)
**Author:** [@jerin](https://discuss.elastic.co/u/jerin)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 5:44am UTC](https://discuss.elastic.co/t/grok-filter-with-kv/261209 "2021-01-15T05:44:25Z")
Hello Everyone and Badger , I am trying to do a GROK of KV.. attached the snapshot of what I am trying to do .. Expected results : Tstamp : date and time Loglevel : WARN But I am getting LogLevel: ""level\\ .. as yo… --- ## [Does adding data nodes increase write throughput](https://discuss.elastic.co/t/does-adding-data-nodes-increase-write-throughput/261205)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 4:50am UTC](https://discuss.elastic.co/t/does-adding-data-nodes-increase-write-throughput/261205 "2021-01-15T04:50:46Z")
Question is, all other things equal, and assuming even distribution of shards, does adding data nodes increase write throughput? My assumption is yes, I'd imagine the new data nodes could take on the burden of dealing w… --- ## [K8s metricbeat data volume](https://discuss.elastic.co/t/k8s-metricbeat-data-volume/261201)
**Author:** [@tim11](https://discuss.elastic.co/u/tim11)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 3:34am UTC](https://discuss.elastic.co/t/k8s-metricbeat-data-volume/261201 "2021-01-15T03:34:40Z")
I am following link: https://www.elastic.co/guide/en/beats/metricbeat/6.8/running-on-kubernetes.html I find in the metricbeat-kubernetes.yaml, I am wondering whether I shall mount external volume in? or the data fold… --- ## [Time parsing in logstash](https://discuss.elastic.co/t/time-parsing-in-logstash/261199)
**Author:** [@525125](https://discuss.elastic.co/u/525125)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 2:48am UTC](https://discuss.elastic.co/t/time-parsing-in-logstash/261199 "2021-01-15T02:48:29Z")
I need tp parse below log line and extract the time into @apptimestamp . It throughing date parse failure. We need use the filed in kibana. We need to get whole timestamp with timezone and AM/PM log line: /start/scrip… --- ## [Most efficient way to limit search result to List of Ids](https://discuss.elastic.co/t/most-efficient-way-to-limit-search-result-to-list-of-ids/261082)
**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 6:57am UTC](https://discuss.elastic.co/t/most-efficient-way-to-limit-search-result-to-list-of-ids/261082 "2021-01-14T06:57:31Z")
I am working on an e-commerce website. I have an index called AdDocument which is the products that are synched to Elasticsearch. Each product belongs to a category. Now I want to write a query to get all products which… --- ## [Mapping document indexing with NEST](https://discuss.elastic.co/t/mapping-document-indexing-with-nest/261156)
**Author:** [@Izzy](https://discuss.elastic.co/u/Izzy)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 5:06pm UTC](https://discuss.elastic.co/t/mapping-document-indexing-with-nest/261156 "2021-01-14T17:06:45Z")
I'm using .NET Core application with NEST client. My goal is to index a model with few modifications in its properties, for example, this model contains list of objects, and I would like to document list of the Ids of t… --- ## [Which is the best option for upload photo images and search?](https://discuss.elastic.co/t/which-is-the-best-option-for-upload-photo-images-and-search/261194)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 11:50pm UTC](https://discuss.elastic.co/t/which-is-the-best-option-for-upload-photo-images-and-search/261194 "2021-01-14T23:50:26Z")
which is the best option for upload person profile photo images and search ? Three options of Implementation are put image base64 (fig green circle) string data in dynamodb table as new field of type Map list for … --- ## [iS their a better way than this fuzzy search for multi-match?](https://discuss.elastic.co/t/is-their-a-better-way-than-this-fuzzy-search-for-multi-match/261193)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 11:41pm UTC](https://discuss.elastic.co/t/is-their-a-better-way-than-this-fuzzy-search-for-multi-match/261193 "2021-01-14T23:41:47Z")
{ "query": { "multi\_match": { "fields": \[ "text", "title" \], "query": "king”, "fuzziness": "AUTO", "type": "best\_fields" } } }’ The fuzziness parameter can be specified as: • 0… [Previous page](https://discuss.elastic.co/latest.md?page=1890) [Next page](https://discuss.elastic.co/latest.md?page=1892)