# Latest **URL:** https://discuss.elastic.co/latest.md?page=1947 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1948 --- ## [No handler for type \[flattened\] declared on field \[host\]"](https://discuss.elastic.co/t/no-handler-for-type-flattened-declared-on-field-host/258177)
**Author:** [@voipas](https://discuss.elastic.co/u/voipas)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 6:05am UTC](https://discuss.elastic.co/t/no-handler-for-type-flattened-declared-on-field-host/258177 "2020-12-10T06:05:17Z")
Hello, I'm taking some trainings on Elasticsearch, and I I receive an error if I try use flattened: ../bin/curl -XPUT "http://elastic.192.168.0.1.nip.io/demo-flattened/\_mapping" -d ' { "prope… --- ## [IOException when trying to create snapshot Unexpected end-of-input in VALUE\_STRING](https://discuss.elastic.co/t/ioexception-when-trying-to-create-snapshot-unexpected-end-of-input-in-value-string/258220)
**Author:** [@jbbasson](https://discuss.elastic.co/u/jbbasson)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 5:56am UTC](https://discuss.elastic.co/t/ioexception-when-trying-to-create-snapshot-unexpected-end-of-input-in-value-string/258220 "2020-12-10T05:56:53Z")
We've a 6.8 elastisearch cluster using the gcp plugin to store snapshots running on a cron. We've been running a cron to periodically create snapshots of our elasticseearch 6.8 cluster using: http://...../\_snapshot/ind… --- ## [CircuitBreakingException\[\[parent\] Data too large on upgrading to elasticsearch 7.7 from 5.16](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-on-upgrading-to-elasticsearch-7-7-from-5-16/258170)
**Author:** [@Rajesh99](https://discuss.elastic.co/u/Rajesh99)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:19am UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-on-upgrading-to-elasticsearch-7-7-from-5-16/258170 "2020-12-10T05:19:13Z")
We have a 3 node elasticsearch cluster (with 16 cores, 64GB RAM) running on 7.7.1 version. Each elasticsearch instance was given heap memory of 4.6GB. We were indexing documents using bulk API. We are encountering the fo… --- ## [Can I combine a single fields search results and get a hash?](https://discuss.elastic.co/t/can-i-combine-a-single-fields-search-results-and-get-a-hash/258212)
**Author:** [@ChristoKiwi](https://discuss.elastic.co/u/ChristoKiwi)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:06am UTC](https://discuss.elastic.co/t/can-i-combine-a-single-fields-search-results-and-get-a-hash/258212 "2020-12-10T05:06:59Z")
I have a large ES index (7.7) that has a couple of million rows. I want to be able to pull a days worth of data and using their UUID id values generate a hash (MD5 or SHA1 ideally). I can do this easily using SQL: SEL… --- ## [Snapshots are not auto created](https://discuss.elastic.co/t/snapshots-are-not-auto-created/257786)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 10\ **Last updated:** [December 10, 2020, 5:05am UTC](https://discuss.elastic.co/t/snapshots-are-not-auto-created/257786 "2020-12-10T05:05:36Z")
Hello I have configured SLM. it worked fine for a couple of months. I have updated the policy and made some changes to the cluster, resource-wise (disks, CPU, memory). Now the automatic snapshots are not working anymor… --- ## [ISM policy for the AWS ES domain](https://discuss.elastic.co/t/ism-policy-for-the-aws-es-domain/257263)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 4:25am UTC](https://discuss.elastic.co/t/ism-policy-for-the-aws-es-domain/257263 "2020-12-10T04:25:11Z")
Hi Team, I am using AWS ES domain of version 7.7. would like to create and apply a index management policy to delete the logs older than 30 days. so, for this i have created a policy and then applied the existing indic… --- ## [Configuring Kibana - Existing Elasticsearch Remote Server](https://discuss.elastic.co/t/configuring-kibana-existing-elasticsearch-remote-server/257778)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 7\ **Last updated:** [December 10, 2020, 4:23am UTC](https://discuss.elastic.co/t/configuring-kibana-existing-elasticsearch-remote-server/257778 "2020-12-10T04:23:58Z")
Hi All, So in my company, we always used elasticsearch head plugin, connecting to an existing elasticsearch server to do our operations. Recently, we are explroing the usage of Kibana and I am trying to configure Kiban… --- ## [Painless Script for Comparing Nested Objects](https://discuss.elastic.co/t/painless-script-for-comparing-nested-objects/255608)
**Author:** [@edbautista](https://discuss.elastic.co/u/edbautista)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 2:53am UTC](https://discuss.elastic.co/t/painless-script-for-comparing-nested-objects/255608 "2020-12-10T02:53:57Z")
Hi, We have a use case where we need to compare two dates that are inside a nested field and show the result to another field. Generally, if time1 \> time2, it would show 'Incorrect', and 'Correct' otherwise. Here is my … --- ## [Xpack.security.enabled: true Enable Kibana Security Features (Elasticsearch 7.10)](https://discuss.elastic.co/t/xpack-security-enabled-true-enable-kibana-security-features-elasticsearch-7-10/258202)
**Author:** [@danker00](https://discuss.elastic.co/u/danker00)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 2:34am UTC](https://discuss.elastic.co/t/xpack-security-enabled-true-enable-kibana-security-features-elasticsearch-7-10/258202 "2020-12-10T02:34:04Z")
Hi Everyone! I am making my way through the install of Elasticsearch/Kibana/Auditbeat and I am running into an issue. When I open up the Security/Detections I have an error "Detection Engine permissions required" I also… --- ## [Jan 1, reindex, implement ILM on 2020 data, move forward into 2021](https://discuss.elastic.co/t/jan-1-reindex-implement-ilm-on-2020-data-move-forward-into-2021/258206)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 1:21am UTC](https://discuss.elastic.co/t/jan-1-reindex-implement-ilm-on-2020-data-move-forward-into-2021/258206 "2020-12-10T01:21:21Z")
hi, i'm very new to ES.. i've been using it for about a year.. but have ALOT to learn. i have built a "system" (i use that term loosely) that sends a large amount of log data via filebeat to logstash for some enrichment… --- ## [Winlogbeat ssl to elasticsearch](https://discuss.elastic.co/t/winlogbeat-ssl-to-elasticsearch/258039)
**Author:** [@ChrisDaniels](https://discuss.elastic.co/u/ChrisDaniels)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 12:59am UTC](https://discuss.elastic.co/t/winlogbeat-ssl-to-elasticsearch/258039 "2020-12-10T00:59:48Z")
Followed the encrypting communications between nodes in a cluster and elasticsearch is running but now elasticsearch is not accepting connections from winlogbeat. When I run winlogbeat.exe test config-c winlogbeat.yml I… --- ## [Span\_near with a wildcard not finding an index](https://discuss.elastic.co/t/span-near-with-a-wildcard-not-finding-an-index/258204)
**Author:** [@Rvs](https://discuss.elastic.co/u/Rvs)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 12:54am UTC](https://discuss.elastic.co/t/span-near-with-a-wildcard-not-finding-an-index/258204 "2020-12-10T00:54:48Z")
I am trying to search for a phrase where the one of the term i need to search using a wildcard. This is the index { "id": 2, "name": "Some Other Pizzaeria"} This is the query { "query": { "span\_near" : { … --- ## [How to extract field name which has space in them using xpath](https://discuss.elastic.co/t/how-to-extract-field-name-which-has-space-in-them-using-xpath/258201)
**Author:** [@kamalbeg](https://discuss.elastic.co/u/kamalbeg)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 12:53am UTC](https://discuss.elastic.co/t/how-to-extract-field-name-which-has-space-in-them-using-xpath/258201 "2020-12-10T00:53:51Z")
I have following xml code xml { source =\> "message" store\_xml =\> "false" remove\_namespaces =\> "true" xpath =\> \[ '/E2ETraceEvent/System/Computer/text()', "\[grc\]\[System\]\[Computer\]", … --- ## [How to apply if condition on the field of json log](https://discuss.elastic.co/t/how-to-apply-if-condition-on-the-field-of-json-log/257931)
**Author:** [@dharanesh](https://discuss.elastic.co/u/dharanesh)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 12:45am UTC](https://discuss.elastic.co/t/how-to-apply-if-condition-on-the-field-of-json-log/257931 "2020-12-10T00:45:49Z")
I have a log which contains json, i want to apply if condition if log line contains "hai" i need to push data to elasticsearch @REQ.WS: {"message":"hai","Id":"123"} --- ## [How would I build a OR query for field exists](https://discuss.elastic.co/t/how-would-i-build-a-or-query-for-field-exists/258065)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 12:18am UTC](https://discuss.elastic.co/t/how-would-i-build-a-or-query-for-field-exists/258065 "2020-12-10T00:18:57Z")
Hey all, I've managed to create a query that searches for two fields, but both must exist. I'd like to build a query that requires field1 OR field2 to exist. Any pointers? I can't find anything in the docs related to t… --- ## [How to get start offset and end offset of a search string in search result in elasticsearch](https://discuss.elastic.co/t/how-to-get-start-offset-and-end-offset-of-a-search-string-in-search-result-in-elasticsearch/256879)
**Author:** [@Sreejith\_Pk](https://discuss.elastic.co/u/Sreejith_Pk)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 12:08am UTC](https://discuss.elastic.co/t/how-to-get-start-offset-and-end-offset-of-a-search-string-in-search-result-in-elasticsearch/256879 "2020-12-10T00:08:41Z")
Hi team, I have a requirement to find the start and end position of a particular word in a text. --- ## [Kibana Dashbaird shows "No results found"](https://discuss.elastic.co/t/kibana-dashbaird-shows-no-results-found/258081)
**Author:** [@ramoba](https://discuss.elastic.co/u/ramoba)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 11:57pm UTC](https://discuss.elastic.co/t/kibana-dashbaird-shows-no-results-found/258081 "2020-12-09T23:57:05Z")
I installed Suricata 6.0.0 and using filebeat to ship events \>logstash\>elasticseacrh I can see Suricata events when checking Discovery in Kibana. However , when trying to run Suricata Events dashboards ,I get "No suture… --- ## [Enrich coordination queue at capacity](https://discuss.elastic.co/t/enrich-coordination-queue-at-capacity/258048)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 14\ **Last updated:** [December 9, 2020, 11:48pm UTC](https://discuss.elastic.co/t/enrich-coordination-queue-at-capacity/258048 "2020-12-09T23:48:16Z")
I'm currently using the enrich processors to enrich my data coming in. It's been working great however more recently when I increase the indexing rate, I start to get the below error: \[16:47:15\] \[ELASTIC\] Row Error { ty… --- ## [Best practice for monitoring ECK and Elastic stack on Kubernetes](https://discuss.elastic.co/t/best-practice-for-monitoring-eck-and-elastic-stack-on-kubernetes/258181)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 11:27pm UTC](https://discuss.elastic.co/t/best-practice-for-monitoring-eck-and-elastic-stack-on-kubernetes/258181 "2020-12-09T23:27:48Z")
I have just installed ECK on our on prem Kubernetes cluster. Currently with Elastic stack consisting of Elasticsearch and Enterprise Search (both v7.10.0). My question is what would be the preferred way of monitoring th… --- ## [Can I add title to each visualization in my dashboard?](https://discuss.elastic.co/t/can-i-add-title-to-each-visualization-in-my-dashboard/258199)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 11:20pm UTC](https://discuss.elastic.co/t/can-i-add-title-to-each-visualization-in-my-dashboard/258199 "2020-12-09T23:20:27Z")
Hi, I am wondering if I can add title to my visualization in dashboard. In my example, I have a name for the visualization "Upload\_Stack\_Post\_Proc\_Vertical\_Bar". Instead of changing this, I would like to add title in th… --- ## [Passing parameters to Java filter plugin during runtime](https://discuss.elastic.co/t/passing-parameters-to-java-filter-plugin-during-runtime/258062)
**Author:** [@lakechat](https://discuss.elastic.co/u/lakechat)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 10:53pm UTC](https://discuss.elastic.co/t/passing-parameters-to-java-filter-plugin-during-runtime/258062 "2020-12-09T22:53:34Z")
The Java filter plugin example (https://www.elastic.co/guide/en/logstash/current/java-filter-plugin.html) was called without any inputs because everything is fixed during compilation time. This makes the plugin less gene… --- ## [New to ELK Stack, Logstash Will Not Start - Please Help](https://discuss.elastic.co/t/new-to-elk-stack-logstash-will-not-start-please-help/258172)
**Author:** [@NJMitchell](https://discuss.elastic.co/u/NJMitchell)\ **Replies:** 11\ **Last updated:** [December 9, 2020, 10:52pm UTC](https://discuss.elastic.co/t/new-to-elk-stack-logstash-will-not-start-please-help/258172 "2020-12-09T22:52:47Z")
Hello elastic community, I'm very new to the ELK stack and am working on getting a production environment up and running. So far I have a four node Elasticsearch cluster running with Kibana. Everything there is working … --- ## [Problem with a watcher run api ack when the clock runs](https://discuss.elastic.co/t/problem-with-a-watcher-run-api-ack-when-the-clock-runs/258196)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 10:37pm UTC](https://discuss.elastic.co/t/problem-with-a-watcher-run-api-ack-when-the-clock-runs/258196 "2020-12-09T22:37:04Z")
hello, i have a problem with a watcher, it gives me an error when it runs, what i need is the following using the api ack so that a clock runs once and then, this in the state acked, but for it touches manually every tim… --- ## [Need help understanding index templates](https://discuss.elastic.co/t/need-help-understanding-index-templates/258127)
**Author:** [@madhan0618](https://discuss.elastic.co/u/madhan0618)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 10:31pm UTC](https://discuss.elastic.co/t/need-help-understanding-index-templates/258127 "2020-12-09T22:31:35Z")
I have metricbeat installed/set up. I wanted my own index name so i put the below in metricbeat.yml file index: "adm\_jkafka" this gave me an error stating that when i want to use my own index, i need to mention the … --- ## [Elastic Parsing](https://discuss.elastic.co/t/elastic-parsing/258192)
**Author:** [@gcsrellis](https://discuss.elastic.co/u/gcsrellis)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 9:59pm UTC](https://discuss.elastic.co/t/elastic-parsing/258192 "2020-12-09T21:59:25Z")
I'm using Security Onion 2 and it uses logstash to ingest logs and sends them to elasticsearch. Their documents say elastic parses the logs and the parsers are located under elasticsearch/ingest/. In that directory the… --- ## [Elasticsearch Audt logs are getting filled within 5-10 mins](https://discuss.elastic.co/t/elasticsearch-audt-logs-are-getting-filled-within-5-10-mins/258166)
**Author:** [@lnitin](https://discuss.elastic.co/u/lnitin)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 5:14pm UTC](https://discuss.elastic.co/t/elasticsearch-audt-logs-are-getting-filled-within-5-10-mins/258166 "2020-12-09T17:14:48Z")
Elasticsearch Audit logs are getting filled up very quickly and it is getting filled up to 6-8GB within 5-10 minutes. I'm unable to keep any logrotate confifuration around this log. Is there any way we can tune this bett… --- ## [Metricbeat: Error 1054: Unknown column 'quantile\_95' in 'field list'](https://discuss.elastic.co/t/metricbeat-error-1054-unknown-column-quantile-95-in-field-list/258190)
**Author:** [@gnumoksha](https://discuss.elastic.co/u/gnumoksha)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 9:32pm UTC](https://discuss.elastic.co/t/metricbeat-error-1054-unknown-column-quantile-95-in-field-list/258190 "2020-12-09T21:32:50Z")
Version: metricbeat 7.10.0 Operating System: Linux agent01.monitoring.tflux.local 4.19.0-13-cloud-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86\_64 GNU/Linux Steps to Reproduce: /etc/metricbeat/modules.d/mysql.yml … --- ## [Any work arounds for this? - issue 21232](https://discuss.elastic.co/t/any-work-arounds-for-this-issue-21232/258173)
**Author:** [@madhan0618](https://discuss.elastic.co/u/madhan0618)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 6:38pm UTC](https://discuss.elastic.co/t/any-work-arounds-for-this-issue-21232/258173 "2020-12-09T18:38:21Z")
I am running into this issue, I create custom indexes and when trying to import metricbeat dashboards for kafka, it is not working correctly. i have tried to edit the JSON and edit every reference of metricbeat-\* with… --- ## [ELK and S3 input](https://discuss.elastic.co/t/elk-and-s3-input/257943)
**Author:** [@pavan45](https://discuss.elastic.co/u/pavan45)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 9:20pm UTC](https://discuss.elastic.co/t/elk-and-s3-input/257943 "2020-12-09T21:20:14Z")
Hi, We have our application logs sent to AWS S3 in csv and text files. Looking to implement ELK with custom S3 plugins to create search and index patterns. --- ## [Not getting indices log data from Elasticsearch/Filebeat in Kibana](https://discuss.elastic.co/t/not-getting-indices-log-data-from-elasticsearch-filebeat-in-kibana/258057)
**Author:** [@FREDDIE2020](https://discuss.elastic.co/u/FREDDIE2020)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 9:17pm UTC](https://discuss.elastic.co/t/not-getting-indices-log-data-from-elasticsearch-filebeat-in-kibana/258057 "2020-12-09T21:17:32Z")
Hello, I am Not getting indices log data from Elasticsearch/Filebeat in Kibana to create my indexes any longer. How can I rectify this issue or what do I need to look at to try and find out the issues? Filebeat is dep… [Previous page](https://discuss.elastic.co/latest.md?page=1946) [Next page](https://discuss.elastic.co/latest.md?page=1948)