# Latest **URL:** https://discuss.elastic.co/latest.md?page=1897 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1898 --- ## [Aggregation time complexity](https://discuss.elastic.co/t/aggregation-time-complexity/260925)
**Author:** [@isbee](https://discuss.elastic.co/u/isbee)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 3:02am UTC](https://discuss.elastic.co/t/aggregation-time-complexity/260925 "2021-01-13T03:02:32Z")
I want to aggregate N(= 10 million) data by percentile\_rank. And I want to call this query lively (more than 100 times per second). As far as I know, Elasticsearch uses t-digest algorithm on percentile. So total time co… --- ## [Insert multi fields data](https://discuss.elastic.co/t/insert-multi-fields-data/260606)
**Author:** [@mojtaba\_safavi](https://discuss.elastic.co/u/mojtaba_safavi)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 1:04am UTC](https://discuss.elastic.co/t/insert-multi-fields-data/260606 "2021-01-13T01:04:48Z")
hi, I am looking for a solution that inserts translated data into multi fields for multi-language --- ## [How can I change the default size of the returned aggregations (10)?](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10/260909)
**Author:** [@Catalin](https://discuss.elastic.co/u/Catalin)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 11:52pm UTC](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10/260909 "2021-01-12T23:52:36Z")
Is there an index setting in order to change default size of aggregations returned, which seems to be set at 10 ? --- ## [Data from Metricbeat AWS module](https://discuss.elastic.co/t/data-from-metricbeat-aws-module/260725)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 1:13pm UTC](https://discuss.elastic.co/t/data-from-metricbeat-aws-module/260725 "2021-01-11T13:13:36Z")
metricbeat version 7.10.0 (amd64), libbeat 7.10.0 elasticsearch version: 7.10.0 kibana version: 7.10.0 Good day, I'm still trying to collect and display the AWS metrics, especially EC2-metrics and billing information… --- ## [Can the Logstash csv plug-in write to a remote server via sFTP?](https://discuss.elastic.co/t/can-the-logstash-csv-plug-in-write-to-a-remote-server-via-sftp/260815)
**Author:** [@Manuel\_Wong](https://discuss.elastic.co/u/Manuel_Wong)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 11:48pm UTC](https://discuss.elastic.co/t/can-the-logstash-csv-plug-in-write-to-a-remote-server-via-sftp/260815 "2021-01-12T23:48:17Z")
Hello, wish you all an excellent new year! I'd like to ask if the Logstash csv plug-in can write to a remove server via sFTP. I plan to setup the logstash in a container within a K8s cluster but the location where the c… --- ## [org.elasticsearch.action.search.SearchPhaseExecutionException - collector failed to collect data](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-collector-failed-to-collect-data/260766)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 11:32pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-collector-failed-to-collect-data/260766 "2021-01-12T23:32:11Z")
Hi all, We have a deployment in Elastic Cloud, and since yesterday my JVM is with a very high usage (about 85-90% of heap memory) and giving a few errors. Any help would be appreciated. I got this log through the consol… --- ## [("Enabled": false) does it work in index templates or only in mapping directly?](https://discuss.elastic.co/t/enabled-false-does-it-work-in-index-templates-or-only-in-mapping-directly/260898)
**Author:** [@marcosvitali](https://discuss.elastic.co/u/marcosvitali)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 11:29pm UTC](https://discuss.elastic.co/t/enabled-false-does-it-work-in-index-templates-or-only-in-mapping-directly/260898 "2021-01-12T23:29:00Z")
Hi, Im using filebeat with templates and 1 index per day pattern. Id like to disable object in a field but it doenst work in templates (works only in mapping directly) "Enabled": false does it work in index templates … --- ## [Filebeat Fortinet Module does't parse message fields when using tcp protocol](https://discuss.elastic.co/t/filebeat-fortinet-module-doest-parse-message-fields-when-using-tcp-protocol/260913)
**Author:** [@luigius](https://discuss.elastic.co/u/luigius)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 10:01pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-doest-parse-message-fields-when-using-tcp-protocol/260913 "2021-01-12T22:01:29Z")
Hi everyone, I have filebeat with Fortinet module working fine if I use UDP, but when I switch to TCP stops to parse the records as Fortinet log adds at the beginning the priority (usually \<189\> or \<190\>) Any idea on ho… --- ## [Feedback on tuning Data Streams for my use case](https://discuss.elastic.co/t/feedback-on-tuning-data-streams-for-my-use-case/260848)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 3:21pm UTC](https://discuss.elastic.co/t/feedback-on-tuning-data-streams-for-my-use-case/260848 "2021-01-12T15:21:37Z")
I'm working on a use where we need to copy messages from 2 Kafka topics to Elasticsearch, in order to search and visualize data in Web App. I have setup Elastic Cloud on Kubernetes with Elasticsearch and Kibana, and per… --- ## [Elastic Stack architecture recommandation in production](https://discuss.elastic.co/t/elastic-stack-architecture-recommandation-in-production/260915)
**Author:** [@abdallah](https://discuss.elastic.co/u/abdallah)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 10:53pm UTC](https://discuss.elastic.co/t/elastic-stack-architecture-recommandation-in-production/260915 "2021-01-12T22:53:00Z")
Hi, we have an ELK cluster with 3 ES data, 2 ES master. We have also 2 Logstash and 1 kibana. Is it recommended to have a load balancer between logstash and ES nodes? Thank you --- ## [Delete document from elasticsearch](https://discuss.elastic.co/t/delete-document-from-elasticsearch/260910)
**Author:** [@mac1](https://discuss.elastic.co/u/mac1)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 10:01pm UTC](https://discuss.elastic.co/t/delete-document-from-elasticsearch/260910 "2021-01-12T22:01:26Z")
hi, delete\_by\_query is safe to delete huge volume of data (in gbs) in one go. Will it create any performance issues in ES. Will it free the space automatically ? --- ## [Export a csv from ElasticSearch 6.8 kibana](https://discuss.elastic.co/t/export-a-csv-from-elasticsearch-6-8-kibana/260873)
**Author:** [@Biran\_Redlinger](https://discuss.elastic.co/u/Biran_Redlinger)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 9:50pm UTC](https://discuss.elastic.co/t/export-a-csv-from-elasticsearch-6-8-kibana/260873 "2021-01-12T21:50:33Z")
I'm trying to export csv file from kibana es (6.8) But this is what I see: How can I import to csv file? Thanks! --- ## [Problem on kibana](https://discuss.elastic.co/t/problem-on-kibana/260905)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 12\ **Last updated:** [January 12, 2021, 9:46pm UTC](https://discuss.elastic.co/t/problem-on-kibana/260905 "2021-01-12T21:46:59Z")
Kibana is having trouble loading. I have the following capture: Do I have to delete any indexes? Are there other solutions? --- ## [Update Documents with new Field](https://discuss.elastic.co/t/update-documents-with-new-field/260906)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 9:40pm UTC](https://discuss.elastic.co/t/update-documents-with-new-field/260906 "2021-01-12T21:40:22Z")
I have a set of data wherein generic identifiers exist. This is partially due to another index which also uses these generic identifiers and our use of Timelion to display dashboards with a combination of data from both… --- ## [Hi, I am trying to create time count in mins since the link is up in heartbeat from the time it was down using TSVP Graph](https://discuss.elastic.co/t/hi-i-am-trying-to-create-time-count-in-mins-since-the-link-is-up-in-heartbeat-from-the-time-it-was-down-using-tsvp-graph/260453)
**Author:** [@Gaurav2](https://discuss.elastic.co/u/Gaurav2)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 9:38pm UTC](https://discuss.elastic.co/t/hi-i-am-trying-to-create-time-count-in-mins-since-the-link-is-up-in-heartbeat-from-the-time-it-was-down-using-tsvp-graph/260453 "2021-01-12T21:38:00Z")
I tried it by calculating the count of summary.up and summary.down and with some logic in painless script. but not luck --- ## [Defining fields for metricsets](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720)
**Author:** [@efftee](https://discuss.elastic.co/u/efftee)\ **Replies:** 8\ **Last updated:** [January 12, 2021, 9:31pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720 "2021-01-12T21:31:29Z")
Hi there, Using a single metricbeat agent to finetune settings before a larger deployment to 3000+ hosts, and trying to contain the number of fields to only those required, I seem to hit a wall at the "metricsets" level… --- ## [Network I/O](https://discuss.elastic.co/t/network-i-o/260902)
**Author:** [@Srikanth\_Kesireddy](https://discuss.elastic.co/u/Srikanth_Kesireddy)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 9:01pm UTC](https://discuss.elastic.co/t/network-i-o/260902 "2021-01-12T21:01:10Z")
How to Monitor Network I/O in my VM and Which beat is suitable for that? --- ## [Should I store ES GC logs in my stack? And is there a way to condense them?](https://discuss.elastic.co/t/should-i-store-es-gc-logs-in-my-stack-and-is-there-a-way-to-condense-them/260887)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 8:48pm UTC](https://discuss.elastic.co/t/should-i-store-es-gc-logs-in-my-stack-and-is-there-a-way-to-condense-them/260887 "2021-01-12T20:48:24Z")
While poking around looking for ways to save space, I noticed that Elasticsearch .gc logs were 80% of my Filebeat logs. I turned them off yesterday afternoon. This morning I did a comparison of how many hits I got yeste… --- ## [I want to split the existing index to daily index](https://discuss.elastic.co/t/i-want-to-split-the-existing-index-to-daily-index/260501)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 6\ **Last updated:** [January 12, 2021, 8:08pm UTC](https://discuss.elastic.co/t/i-want-to-split-the-existing-index-to-daily-index/260501 "2021-01-12T20:08:55Z")
Hello, I want to split the existing index of size 200gb into daily index, That index has data of 1 month. I have setup of 8 core cpu and 16gb ram. what query should I write on dev tools or is there any other way to ex… --- ## [Need assistance on combined processors within metricbeat module](https://discuss.elastic.co/t/need-assistance-on-combined-processors-within-metricbeat-module/260416)
**Author:** [@J\_Weeda](https://discuss.elastic.co/u/J_Weeda)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 7:41pm UTC](https://discuss.elastic.co/t/need-assistance-on-combined-processors-within-metricbeat-module/260416 "2021-01-12T19:41:27Z")
Hello, I need assistance on getting a combined processor up and running. Situation: I'm running metricbeat 7.9.1. I would like to set up the metricbeat to monitor windows services when: windows.service.display\_name … --- ## [Functionbeat deploy fails, citing issue with s3 bucket](https://discuss.elastic.co/t/functionbeat-deploy-fails-citing-issue-with-s3-bucket/260767)
**Author:** [@Jonathan\_Detert](https://discuss.elastic.co/u/Jonathan_Detert)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 7:36pm UTC](https://discuss.elastic.co/t/functionbeat-deploy-fails-citing-issue-with-s3-bucket/260767 "2021-01-12T19:36:59Z")
I'm trying to use functionbeat for my first time, with a single function, of type kinesis, using functionbeat v6.8.13. When I run 'functionbeat deploy kinesis' (where 'kinesis' is the name i chose for the function name)… --- ## [StatsD: metricset 'statsd/server' is not registered, module not found](https://discuss.elastic.co/t/statsd-metricset-statsd-server-is-not-registered-module-not-found/260641)
**Author:** [@shugydw](https://discuss.elastic.co/u/shugydw)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 7:20pm UTC](https://discuss.elastic.co/t/statsd-metricset-statsd-server-is-not-registered-module-not-found/260641 "2021-01-12T19:20:54Z")
Hello. I am encountering an error with StatsD module. Please help! Exiting: 1 error: 1 error: metricset 'statsd/server' is not registered, module not found Here is the confirguration module: statsd period: 10s met… --- ## [Questions re elksiem](https://discuss.elastic.co/t/questions-re-elksiem/260561)
**Author:** [@rconroy](https://discuss.elastic.co/u/rconroy)\ **Replies:** 33\ **Last updated:** [January 12, 2021, 7:19pm UTC](https://discuss.elastic.co/t/questions-re-elksiem/260561 "2021-01-12T19:19:14Z")
OK, so first off, the auditbeats install, one reference had me use the downloaded files ./auditbeat setup method, whereas the other had me install using yum. The yum method didnt appear to install any dashboards and the… --- ## [XDELETE is not working - Doesn't delete data from all the Data nodes for ES](https://discuss.elastic.co/t/xdelete-is-not-working-doesnt-delete-data-from-all-the-data-nodes-for-es/260876)
**Author:** [@ajayvembu](https://discuss.elastic.co/u/ajayvembu)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 6:34pm UTC](https://discuss.elastic.co/t/xdelete-is-not-working-doesnt-delete-data-from-all-the-data-nodes-for-es/260876 "2021-01-12T18:34:22Z")
Currently we are using Elastic Search 2.3.1 and trying to issue XDELETE command on the indices. I understand it's pretty old version & has attained EOL but I assume the underlying working mechanism of XDELETE wouldn't ch… --- ## [Removing the Observability App in Kibana 7.9.3](https://discuss.elastic.co/t/removing-the-observability-app-in-kibana-7-9-3/260846)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 5\ **Last updated:** [January 12, 2021, 6:32pm UTC](https://discuss.elastic.co/t/removing-the-observability-app-in-kibana-7-9-3/260846 "2021-01-12T18:32:08Z")
Hi, I am trying to remove Observability from the navigation menu. There does not appear to be an option in the Edit space settings. --- ## [Google Cloud discovery not working](https://discuss.elastic.co/t/google-cloud-discovery-not-working/260871)
**Author:** [@Mark\_Pevec](https://discuss.elastic.co/u/Mark_Pevec)\ **Replies:** 8\ **Last updated:** [January 12, 2021, 6:06pm UTC](https://discuss.elastic.co/t/google-cloud-discovery-not-working/260871 "2021-01-12T18:06:03Z")
Has anyone ever successfully used the Google Cloud discovery plugin successfully? After testing and debugging for a week I can't get it working. I am using the latest 7.x release (installed on debian-10 following all th… --- ## [Visualize buckets by using text fields](https://discuss.elastic.co/t/visualize-buckets-by-using-text-fields/260646)
**Author:** [@imaneg](https://discuss.elastic.co/u/imaneg)\ **Replies:** 4\ **Last updated:** [January 12, 2021, 6:01pm UTC](https://discuss.elastic.co/t/visualize-buckets-by-using-text-fields/260646 "2021-01-12T18:01:59Z")
Hello, I would like to visualize buckets by using text fields rather than keywords. For doing this I enabled fielddata on the targeted text field. I am able to see the results when I am running the aggregation from dev … --- ## [Kibana](https://discuss.elastic.co/t/kibana/260868)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 5:18pm UTC](https://discuss.elastic.co/t/kibana/260868 "2021-01-12T17:18:11Z")
Hi, I set up 3 node elastic cluster with kibana on docker. And it was working. But I after restart it again by docker-compose.yml everything is showing running but kibana is now not opening in browser but in docker side… --- ## [How to Query for length with elasticsearch (KQL)](https://discuss.elastic.co/t/how-to-query-for-length-with-elasticsearch-kql/259815)
**Author:** [@Elasticnewbie1](https://discuss.elastic.co/u/Elasticnewbie1)\ **Replies:** 15\ **Last updated:** [January 12, 2021, 4:53pm UTC](https://discuss.elastic.co/t/how-to-query-for-length-with-elasticsearch-kql/259815 "2021-01-12T16:53:44Z")
Hey there, im new to this elk world and im currently working on a threat hunting project with ELK/Zeek. My problem is, that i want for example to query for DNS.Length \> 75 within zeek data. I know that its easy to do i… --- ## [\[BUG?\] date\_histogram hard\_bounds returns unknown\_field](https://discuss.elastic.co/t/bug-date-histogram-hard-bounds-returns-unknown-field/260825)
**Author:** [@demasie](https://discuss.elastic.co/u/demasie)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 4:45pm UTC](https://discuss.elastic.co/t/bug-date-histogram-hard-bounds-returns-unknown-field/260825 "2021-01-12T16:45:09Z")
The following snippet returns error reason \[date\_histogram\] unknown field \[hard\_bounds\] did you mean \[extended\_bounds\]? { date\_histogram: { field: 'date', calendar\_interval: 'day', hard\_bounds: { min: '2020-11… [Previous page](https://discuss.elastic.co/latest.md?page=1896) [Next page](https://discuss.elastic.co/latest.md?page=1898)