# Latest **URL:** https://discuss.elastic.co/latest.md?page=1942 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1943 --- ## [Aggregate every field](https://discuss.elastic.co/t/aggregate-every-field/258467)
**Author:** [@5minutes](https://discuss.elastic.co/u/5minutes)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 6:14am UTC](https://discuss.elastic.co/t/aggregate-every-field/258467 "2020-12-12T06:14:39Z")
hi, lets consider we have 2 records: { "@timestamp": "2020-12-11T11:13:00", "time": { "a": 200, "b": 2 } } { "@timestamp": "2020-12-11T12:13:00", "time": { … --- ## [Mappings conflict after rollover](https://discuss.elastic.co/t/mappings-conflict-after-rollover/258476)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [December 12, 2020, 2:43pm UTC](https://discuss.elastic.co/t/mappings-conflict-after-rollover/258476 "2020-12-12T14:43:07Z")
I have an index with name X-001 with this mapping: { "time": { "type": "date" } } after linking index to ilm, and rollover action: elastic creates index X-002 but in mapping i see this : { "time": { … --- ## [Reconciler error when trying to deploy an elasticsearch](https://discuss.elastic.co/t/reconciler-error-when-trying-to-deploy-an-elasticsearch/218628)
**Author:** [@FlorianT](https://discuss.elastic.co/u/FlorianT)\ **Replies:** 7\ **Last updated:** [December 12, 2020, 11:58am UTC](https://discuss.elastic.co/t/reconciler-error-when-trying-to-deploy-an-elasticsearch/218628 "2020-12-12T11:58:29Z")
Hello, I've got an issue with the the ECK operator on Openshift when I'm trying to deploy an elasticsearch, when I deploy the elasticsearch object, I've got the following errors on the operator logs: {"level":"info","@… --- ## [Dec 12th, 2020: \[EN\] Mapping your infrastructure](https://discuss.elastic.co/t/dec-12th-2020-en-mapping-your-infrastructure/257864)
**Author:** [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-12th-2020-en-mapping-your-infrastructure/257864 "2020-12-12T08:00:04Z")
Also available in Spanish tl;dr; This post shows how you can use the Elastic Stack to map IoT, Security or Observability data. The data that is collected in these use-cases often do not explicitly contain a latitude o… --- ## [Dec 12th, 2020: \[ES\] Tu infraestructura en un mapa](https://discuss.elastic.co/t/dec-12th-2020-es-tu-infraestructura-en-un-mapa/257971)
**Author:** [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-12th-2020-es-tu-infraestructura-en-un-mapa/257971 "2020-12-12T08:00:04Z")
Este artículo es una traducción de Mapping your infrastructure escrito por Thomas Neirynck. tl;dr; Esta entrada elabora cómo puedes usar el stack de Elastic para representar datos geoespaciales relativos a IoT, Seguri… --- ## [Index deleted and create weird new index](https://discuss.elastic.co/t/index-deleted-and-create-weird-new-index/258362)
**Author:** [@Junedi\_Rajagukguk](https://discuss.elastic.co/u/Junedi_Rajagukguk)\ **Replies:** 4\ **Last updated:** [December 12, 2020, 6:45am UTC](https://discuss.elastic.co/t/index-deleted-and-create-weird-new-index/258362 "2020-12-12T06:45:16Z")
hi i dont know what is hapening to my indicies, they suddenly got deleted. i lost the data, and so many weird indicies created. please help --- ## [Filebeat folder structured not correct for version 7.10](https://discuss.elastic.co/t/filebeat-folder-structured-not-correct-for-version-7-10/257927)
**Author:** [@kbirhan](https://discuss.elastic.co/u/kbirhan)\ **Replies:** 5\ **Last updated:** [December 12, 2020, 6:18am UTC](https://discuss.elastic.co/t/filebeat-folder-structured-not-correct-for-version-7-10/257927 "2020-12-12T06:18:57Z")
filebeat bin file location in the service file declared might be in the wrong location for debian platform. after moving the filebeat bin file (located in /usr/ share/filebeat/) to /usr/share/filebeat/bin/ folder everyt… --- ## [Deploy Logstash with persistent queue on Docker Swarm](https://discuss.elastic.co/t/deploy-logstash-with-persistent-queue-on-docker-swarm/258465)
**Author:** [@Hung\_Phan\_Huy](https://discuss.elastic.co/u/Hung_Phan_Huy)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 4:30am UTC](https://discuss.elastic.co/t/deploy-logstash-with-persistent-queue-on-docker-swarm/258465 "2020-12-12T04:30:16Z")
Hi, I'm planning to deploy my Logstash on Docker Swarm. My concern is about the persistent queue feature. Should I use persistent queue? Some documents I read show that they might have a great impact on the performanc… --- ## [How to avoid syntax errors when writing DSL statements](https://discuss.elastic.co/t/how-to-avoid-syntax-errors-when-writing-dsl-statements/258463)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 3:46am UTC](https://discuss.elastic.co/t/how-to-avoid-syntax-errors-when-writing-dsl-statements/258463 "2020-12-12T03:46:23Z")
GET index/\_search { "query": { "range": { "@timestamp": { "gte": "now-1d/d", "lt": "now/d" } }, "query\_string": { "query": "\*" } } } { "error" : { "… --- ## [Questions de Newbie](https://discuss.elastic.co/t/questions-de-newbie/258452)
**Author:** [@dballester](https://discuss.elastic.co/u/dballester)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 10:38pm UTC](https://discuss.elastic.co/t/questions-de-newbie/258452 "2020-12-11T22:38:28Z")
Bonjour, 100% novice dans le monde ELK, j'ai quelques questions très basiques (je crois) que j'ai du mal à répondre. Je cherche pas la réponse "toute mâchée" mais des avis ou conseils pour m'orienter vers l'information… --- ## [Dec 11th, 2020: \[EN\] This holiday season, learn new Elastic skills for free](https://discuss.elastic.co/t/dec-11th-2020-en-this-holiday-season-learn-new-elastic-skills-for-free/257072)
**Author:** [@pmusa](https://discuss.elastic.co/u/pmusa)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 10:09pm UTC](https://discuss.elastic.co/t/dec-11th-2020-en-this-holiday-season-learn-new-elastic-skills-for-free/257072 "2020-12-11T22:09:09Z")
Elastic has a lot of different products across multiple solutions. We make it as easy as possible for our users to benefit from our solutions, but it is still hard to master so many topics. To address that, Elastic inves… --- ## [Logstash does not index event to elastic due to issue on host field](https://discuss.elastic.co/t/logstash-does-not-index-event-to-elastic-due-to-issue-on-host-field/258171)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 5\ **Last updated:** [December 11, 2020, 9:46pm UTC](https://discuss.elastic.co/t/logstash-does-not-index-event-to-elastic-due-to-issue-on-host-field/258171 "2020-12-11T21:46:31Z")
Hi all, i'm having an issue with my logstash. I updated my infrastructure from elk 5.6 to elk 6.8 and now from elk 6.8 to elk 7.8. We are updating filebeats but logstash is reporting this error on metrics coming from th… --- ## [Grok Pattern against stdout](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195)
**Author:** [@willis](https://discuss.elastic.co/u/willis)\ **Replies:** 4\ **Last updated:** [December 11, 2020, 9:21pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195 "2020-12-11T21:21:48Z")
I have a custom log format that is being sent to stdout. Filebeat is correctly capturing this output. I would like to apply a grok pattern against these lines and have them parsed/indexed. Is a pipeline, a processor, or … --- ## [Logstash/ Elastic index date and time match error](https://discuss.elastic.co/t/logstash-elastic-index-date-and-time-match-error/258448)
**Author:** [@Gambit22](https://discuss.elastic.co/u/Gambit22)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 8:45pm UTC](https://discuss.elastic.co/t/logstash-elastic-index-date-and-time-match-error/258448 "2020-12-11T20:45:48Z")
Hello Everyone, this is my first post here so I'll try to provide good specifics. First off, I'm trying to make an ELK stack with Filebeat all hosted on the same VM. It's just a lab environment. Kibana, Elastic, Logsta… --- ## [Restore snapshot with different index name](https://discuss.elastic.co/t/restore-snapshot-with-different-index-name/258450)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 8:26pm UTC](https://discuss.elastic.co/t/restore-snapshot-with-different-index-name/258450 "2020-12-11T20:26:38Z")
I have a snapshot and name of the index is my\_index1 I did copy whole tar ball and transfer to new cluster here I put this snpshot. Now I can see that when I do GET status I am trying to restore this index here with n… --- ## [Матчасть, отказоустойчивость](https://discuss.elastic.co/t/topic/258162)
**Author:** [@Gigazo1d](https://discuss.elastic.co/u/Gigazo1d)\ **Replies:** 5\ **Last updated:** [December 11, 2020, 7:46pm UTC](https://discuss.elastic.co/t/topic/258162 "2020-12-11T19:46:20Z")
Доброго времени суток! Хотелось бы задать пару вопросов по Logstash. Из англоязычной документации не так отчетливо, как хотелось бы, понял разницы между: pipeline (конвейером); потоком (thread); процессом (хотя проце… --- ## [Kibana dont collect app logs after 0:00 in some days on 2 from 3 spaces](https://discuss.elastic.co/t/kibana-dont-collect-app-logs-after-0-00-in-some-days-on-2-from-3-spaces/258446)
**Author:** [@111419](https://discuss.elastic.co/u/111419)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 7:29pm UTC](https://discuss.elastic.co/t/kibana-dont-collect-app-logs-after-0-00-in-some-days-on-2-from-3-spaces/258446 "2020-12-11T19:29:44Z")
I Have 3 spaces. in one i dont have app logs from 0:00 10th dec, in second from 0:00 11th dec, kibana recieved logs from filebeat only php-fpm access.log, all other web app logs in json format not recieved from 10 and 1… --- ## [How to create multiple pipelines with logstash helm chart so they have private data](https://discuss.elastic.co/t/how-to-create-multiple-pipelines-with-logstash-helm-chart-so-they-have-private-data/258444)
**Author:** [@jknott](https://discuss.elastic.co/u/jknott)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 7:16pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-pipelines-with-logstash-helm-chart-so-they-have-private-data/258444 "2020-12-11T19:16:38Z")
I have created a helm chart with multiple pipelines but when I add a field per pipeline for example service\_name, the service name from each pipeline gets added to the field. So instead of one field being added with one … --- ## [My ruby filter doesn't work](https://discuss.elastic.co/t/my-ruby-filter-doesnt-work/258439)
**Author:** [@olegans](https://discuss.elastic.co/u/olegans)\ **Replies:** 6\ **Last updated:** [December 11, 2020, 7:01pm UTC](https://discuss.elastic.co/t/my-ruby-filter-doesnt-work/258439 "2020-12-11T19:01:01Z")
I am trying to use a ruby ​​filter to process incoming json that I receive in the logs. At the beginning, using a grok filter, I receive json, then I try to process it in a ruby ​​filter grok { match =\> { "l… --- ## [Use of field aliases in app search](https://discuss.elastic.co/t/use-of-field-aliases-in-app-search/258377)
**Author:** [@ndosa](https://discuss.elastic.co/u/ndosa)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 6:54pm UTC](https://discuss.elastic.co/t/use-of-field-aliases-in-app-search/258377 "2020-12-11T18:54:29Z")
Apologies if this has been covered previously, but is it possible to use field aliases or a display names for fields in app search ? --- ## [Stockage donnée elastic](https://discuss.elastic.co/t/stockage-donnee-elastic/258393)
**Author:** [@f.boer](https://discuss.elastic.co/u/f.boer)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 6:50pm UTC](https://discuss.elastic.co/t/stockage-donnee-elastic/258393 "2020-12-11T18:50:41Z")
bonjour ma question va peut être vous paraitre idiote, mais est il possible de stocker les données d'elasticsearch ailleurs que sur le serveur d'installation. Mon installation fonctionne parfaitement maintenant (merci … --- ## [Multi Search Elastic](https://discuss.elastic.co/t/multi-search-elastic/257196)
**Author:** [@daviddavid](https://discuss.elastic.co/u/daviddavid)\ **Replies:** 10\ **Last updated:** [December 11, 2020, 6:45pm UTC](https://discuss.elastic.co/t/multi-search-elastic/257196 "2020-12-11T18:45:29Z")
Hi, Is there any way to bring common result from two different indices with search on different fields distributed on these two indices and the fields are different and not linked to each other. --- ## [Index lifecycle error: security\_exception: action \[indices:monitor/stats\] is unauthorized for user \[template\_manager\]](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-action-indices-monitor-stats-is-unauthorized-for-user-template-manager/258334)
**Author:** [@prolbrakels](https://discuss.elastic.co/u/prolbrakels)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 6:06pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-action-indices-monitor-stats-is-unauthorized-for-user-template-manager/258334 "2020-12-11T18:06:07Z")
According to Kibana, the wait-for-shard-history-leases step failed when trying to delete an index due to ILM policy. The template\_manager user/role is one I recently created for the purpose of automating updates to the t… --- ## [Running two clusters in a single node](https://discuss.elastic.co/t/running-two-clusters-in-a-single-node/258301)
**Author:** [@Ondescone](https://discuss.elastic.co/u/Ondescone)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 6:05pm UTC](https://discuss.elastic.co/t/running-two-clusters-in-a-single-node/258301 "2020-12-11T18:05:36Z")
Greetings, I'm trying to set up the Cross Cluster Replication locally in a single node. I have been using one elasticsearch/kibana instance running as a service (version 7.9.3) with default settings and everything works… --- ## [Filter by multiple fields in one document (one field more than other field)](https://discuss.elastic.co/t/filter-by-multiple-fields-in-one-document-one-field-more-than-other-field/258427)
**Author:** [@Delagardi1](https://discuss.elastic.co/u/Delagardi1)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 5:11pm UTC](https://discuss.elastic.co/t/filter-by-multiple-fields-in-one-document-one-field-more-than-other-field/258427 "2020-12-11T17:11:10Z")
Hi! I am pretty new to elasticsearch. Is there is a way to filter my search results by comparing two values in one document? I have two fields in my document: inStock, inOtherStock and 3 filter values like: show me all… --- ## [Cluster\_block\_exception blocks all ingestion](https://discuss.elastic.co/t/cluster-block-exception-blocks-all-ingestion/258338)
**Author:** [@elk\_follower](https://discuss.elastic.co/u/elk_follower)\ **Replies:** 6\ **Last updated:** [December 11, 2020, 5:14pm UTC](https://discuss.elastic.co/t/cluster-block-exception-blocks-all-ingestion/258338 "2020-12-11T17:14:41Z")
Hello, We have a ELK 7.3.2 cluster with 3 nodes and almost 3 TB disk free. Also have Index lifecycle policy which force merge all indices older than 7 days Free Disk: ILP: We deployed filebeat to ingest some ol… --- ## [Elasticsearch-oss-7.10.1-1.x86\_64: installation: startup issue](https://discuss.elastic.co/t/elasticsearch-oss-7-10-1-1-x86-64-installation-startup-issue/258436)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 5\ **Last updated:** [December 11, 2020, 5:07pm UTC](https://discuss.elastic.co/t/elasticsearch-oss-7-10-1-1-x86-64-installation-startup-issue/258436 "2020-12-11T17:07:40Z")
When elastic instance start is attempted, I see exception as - \[2020-12-11T10:12:32,933\]\[WARN \]\[o.e.i.m.MapperService \] \[fully-qualified-host-name\] \[.kibana\_1\] \[\[.kibana\_1/9r8cU43FQlWzDMRvN-dxHA\]\] failed to apply map… --- ## [Taming ElasticSearch Field Explosion](https://discuss.elastic.co/t/taming-elasticsearch-field-explosion/258433)
**Author:** [@tjohnell](https://discuss.elastic.co/u/tjohnell)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 4:41pm UTC](https://discuss.elastic.co/t/taming-elasticsearch-field-explosion/258433 "2020-12-11T16:41:39Z")
Hello all, I recently created a post on how my company, Handy, reduced the number of fields within our main ES index, and I wanted to share with the ES community. Any feedback is appreciated! Best, Tom --- ## [JDBC Input Error after upgrading to 7.10.0 on Windows](https://discuss.elastic.co/t/jdbc-input-error-after-upgrading-to-7-10-0-on-windows/256902)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 4:41pm UTC](https://discuss.elastic.co/t/jdbc-input-error-after-upgrading-to-7-10-0-on-windows/256902 "2020-12-11T16:41:19Z")
Hi All, I updated my Windows DEV environment to 7.10.0 from 7.9.2 earlier today. When I try to run my existing Logstash configurations in 7.10.0 (which worked fine under 7.9.2) I see the following error: \[2020-11-27T12… --- ## [Intermittent Error Which breaks Entreprise Search UI](https://discuss.elastic.co/t/intermittent-error-which-breaks-entreprise-search-ui/258351)
**Author:** [@Philippe\_Trounev](https://discuss.elastic.co/u/Philippe_Trounev)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 4:09pm UTC](https://discuss.elastic.co/t/intermittent-error-which-breaks-entreprise-search-ui/258351 "2020-12-11T16:09:32Z")
So we are facing an error that breaks entire app-search UI. We've been facing it for 6 month and the only way to fix it is to delete all the indexes and rebuild everything from scratch. Which is not ideal and causes loss… [Previous page](https://discuss.elastic.co/latest.md?page=1941) [Next page](https://discuss.elastic.co/latest.md?page=1943)