# Latest **URL:** https://discuss.elastic.co/latest.md?page=1949 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1950 --- ## [CCR follower for large index fails](https://discuss.elastic.co/t/ccr-follower-for-large-index-fails/258043)
**Author:** [@toryohanson](https://discuss.elastic.co/u/toryohanson)\ **Replies:** 0\ **Last updated:** [December 8, 2020, 7:40pm UTC](https://discuss.elastic.co/t/ccr-follower-for-large-index-fails/258043 "2020-12-08T19:40:11Z")
Hello! I'w trying to configure Elasticsearch CCR using manuals at elastic.co Everything works fine for small indexes. But, when it comes to indexes large then 2 GB, something strange happens - index following is pause… --- ## [Value got nulled when ingesting to ES from Hadoop using Spark](https://discuss.elastic.co/t/value-got-nulled-when-ingesting-to-es-from-hadoop-using-spark/258135)
**Author:** [@anung](https://discuss.elastic.co/u/anung)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:53pm UTC](https://discuss.elastic.co/t/value-got-nulled-when-ingesting-to-es-from-hadoop-using-spark/258135 "2020-12-09T13:53:22Z")
my env: cloudera hadoop 6.3 es 7.10 spark 2.4.0 elasticsearch-spark-20\_2.11-7.10.0.jar my code very simple: import org.elasticsearch.spark.rdd.api.java.JavaEsSpark; JavaEsSpark.saveToEs(rdd\_tJava\_1, "nyc\_yellow\_taxi… --- ## [Index attributes from a multiline json string](https://discuss.elastic.co/t/index-attributes-from-a-multiline-json-string/258132)
**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:43pm UTC](https://discuss.elastic.co/t/index-attributes-from-a-multiline-json-string/258132 "2020-12-09T13:43:12Z")
Hi All, I need some advice here, I don't want to reinvent the wheel. With Filebeat 6.7.0 I'm picking up logs in typical docker format, , i.e. json strings with "log", "stream" and "time" attributes. In the logs, each … --- ## [Applying APM transaction labels to child spans](https://discuss.elastic.co/t/applying-apm-transaction-labels-to-child-spans/258054)
**Author:** [@Jaybee](https://discuss.elastic.co/u/Jaybee)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 1:39pm UTC](https://discuss.elastic.co/t/applying-apm-transaction-labels-to-child-spans/258054 "2020-12-09T13:39:26Z")
I'm currently setting transaction labels (e.g. user id and other transaction specific data) in my spring-boot based microservice, but that information doesn't get copied across to any subsequent child spans. Which means … --- ## [How to index json attributes on ES from a json multiline log](https://discuss.elastic.co/t/how-to-index-json-attributes-on-es-from-a-json-multiline-log/258130)
**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:38pm UTC](https://discuss.elastic.co/t/how-to-index-json-attributes-on-es-from-a-json-multiline-log/258130 "2020-12-09T13:38:53Z")
Hi All, I need some advice here, I don't want to reinvent the wheel. With Filebeat 6.7.0 I'm picking up logs in typical docker format, , i.e. json strings with "log", "stream" and "time" attributes. In the logs, each … --- ## [Only partial data getting deciphered using cipher filter](https://discuss.elastic.co/t/only-partial-data-getting-deciphered-using-cipher-filter/258129)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:38pm UTC](https://discuss.elastic.co/t/only-partial-data-getting-deciphered-using-cipher-filter/258129 "2020-12-09T13:38:06Z")
Hi Team, I want to decipher a cipher text using logstash. My client is using AES128 encryption. So in logstash I am using cipher filter to decipher the ciphertext. They have also provided me the key , but unfortunately… --- ## [Dashboard - show only last distinct values](https://discuss.elastic.co/t/dashboard-show-only-last-distinct-values/257035)
**Author:** [@Vita\_Rosenberg](https://discuss.elastic.co/u/Vita_Rosenberg)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 1:34pm UTC](https://discuss.elastic.co/t/dashboard-show-only-last-distinct-values/257035 "2020-12-09T13:34:58Z")
I want to show only the last distinct values. Hence without the records with yellow color. Is it possible? --- ## [Kibana settings API](https://discuss.elastic.co/t/kibana-settings-api/258100)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 1:08pm UTC](https://discuss.elastic.co/t/kibana-settings-api/258100 "2020-12-09T13:08:10Z")
Hello, ELK 7.10.0 / Kibana Is there any way to change Kibana options Stack Managament / Advanced Settings / "dateFormat" + "dateFormat:tz" + etc. through an API? I haven't found any info about that in the documentatio… --- ## [Feature request geo location distance sorting](https://discuss.elastic.co/t/feature-request-geo-location-distance-sorting/258109)
**Author:** [@bskade](https://discuss.elastic.co/u/bskade)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 1:07pm UTC](https://discuss.elastic.co/t/feature-request-geo-location-distance-sorting/258109 "2020-12-09T13:07:35Z")
Hi, are there any plans to implement sorting by distance in the near future? Without this feature app search would be no candidate for us. --- ## [Kibana Discover order by field](https://discuss.elastic.co/t/kibana-discover-order-by-field/258102)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 1:03pm UTC](https://discuss.elastic.co/t/kibana-discover-order-by-field/258102 "2020-12-09T13:03:49Z")
I want to order documents in Discover by a date field using KQL or Lucene. Can you guide me please? --- ## [Filebeat Processors drop\_event](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856)
**Author:** [@erezhazan1](https://discuss.elastic.co/u/erezhazan1)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856 "2020-12-09T12:50:54Z")
Hey all! I need your help with the following, I'm trying to get this condition to work: If not (message: '^.dstintf="aaaa".' OR message: '^.dstintf="bbb".') AND NOT (message: '^.action="ccc".' AND message: '^.action=… --- ## [Memory issue in elasticsearch](https://discuss.elastic.co/t/memory-issue-in-elasticsearch/258027)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 11\ **Last updated:** [December 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/memory-issue-in-elasticsearch/258027 "2020-12-09T12:50:11Z")
Hi Team, I deployed multi-node cluster few days back and it was working fine. Today I saw elasticsearch service went down due to less memory availability. It is running fine on other two elasticsearch nodes. System ha… --- ## [docFreq for multi\_match with type cross\_fields](https://discuss.elastic.co/t/docfreq-for-multi-match-with-type-cross-fields/258121)
**Author:** [@Lea\_Lacoste](https://discuss.elastic.co/u/Lea_Lacoste)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 12:48pm UTC](https://discuss.elastic.co/t/docfreq-for-multi-match-with-type-cross-fields/258121 "2020-12-09T12:48:49Z")
I am having problems understanding the docFreq for multi\_match queries when using the type cross\_fields. I created a one shard test index, onto which I pushed 4 documents: { "random0": "banana", "random1": "banana", "r… --- ## [Performance Issues during data-ingestion](https://discuss.elastic.co/t/performance-issues-during-data-ingestion/258092)
**Author:** [@M-O](https://discuss.elastic.co/u/M-O)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 12:42pm UTC](https://discuss.elastic.co/t/performance-issues-during-data-ingestion/258092 "2020-12-09T12:42:10Z")
Hi everyone, i am currently testing the elastic stack for observerability use-cases in my company. For testing purposes we build a small elasticsearch cluster (3 nodes) and ingesting http-logs with filebeat. Our PoC-se… --- ## [How to use \<\> these brackets for search in kibana](https://discuss.elastic.co/t/how-to-use-these-brackets-for-search-in-kibana/258075)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 12:24pm UTC](https://discuss.elastic.co/t/how-to-use-these-brackets-for-search-in-kibana/258075 "2020-12-09T12:24:26Z")
Enables the \<\> operators. You can use \<\> to match a numeric range. For example: foo\<1-100\> # matches 'foo1', 'foo2' ... 'foo99', 'foo100' foo\<01-100\> # matches 'foo01', 'foo02' ... 'foo99', 'foo100' How to wr… --- ## [Elasticsearch - error while trying to start service on OpenShift](https://discuss.elastic.co/t/elasticsearch-error-while-trying-to-start-service-on-openshift/258088)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 7\ **Last updated:** [December 9, 2020, 11:27am UTC](https://discuss.elastic.co/t/elasticsearch-error-while-trying-to-start-service-on-openshift/258088 "2020-12-09T11:27:38Z")
Hi, I got following error in Elasticsearch. Elasticsearch is installed on Openshift. Elasticsearch version - 6.4.3. OSS Elasticsearch logs: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated i… --- ## [Nodes constantly turn off and on again](https://discuss.elastic.co/t/nodes-constantly-turn-off-and-on-again/257808)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 6\ **Last updated:** [December 9, 2020, 11:24am UTC](https://discuss.elastic.co/t/nodes-constantly-turn-off-and-on-again/257808 "2020-12-09T11:24:04Z")
Hi guys, I have a 14 nodes of cluster (11 data, 3 master).I am using Elasticsearch and kibana version 7.4.2. When everything is going well, suddenly the nodes started to shut down and the kibana status turns red or yello… --- ## [London Information Retrieval Meetup December](https://discuss.elastic.co/t/london-information-retrieval-meetup-december/258032)
**Author:** [@lizbiella](https://discuss.elastic.co/u/lizbiella)\ **Replies:** 0\ **Last updated:** [December 8, 2020, 5:49pm UTC](https://discuss.elastic.co/t/london-information-retrieval-meetup-december/258032 "2020-12-08T17:49:57Z")
The London Information Retrieval Meetup has moved online! It is a free evening meetup aimed at Information Retrieval passionates and professionals who are curious to explore and discuss the latest trends in the field. … --- ## [Querying in Kibana Discover Timesout](https://discuss.elastic.co/t/querying-in-kibana-discover-timesout/256817)
**Author:** [@Ganesh\_Sharma](https://discuss.elastic.co/u/Ganesh_Sharma)\ **Replies:** 14\ **Last updated:** [December 9, 2020, 11:07am UTC](https://discuss.elastic.co/t/querying-in-kibana-discover-timesout/256817 "2020-12-09T11:07:48Z")
Guys I have been trying to deploy ELK cluster using ELK Operator method for Azure AKS from here. However after I deploy ELK and access Kibana and add Filebeat index creation I am unable to query anything in the Discover… --- ## [Pick latest data](https://discuss.elastic.co/t/pick-latest-data/256361)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 7\ **Last updated:** [December 9, 2020, 11:06am UTC](https://discuss.elastic.co/t/pick-latest-data/256361 "2020-12-09T11:06:09Z")
Hi, I am bulk inserting my data into an index multiple times in a day. I want to get all data with last timestamp(with last timestamp I inserted.). --- ## [Netflow summarization of duplicate events](https://discuss.elastic.co/t/netflow-summarization-of-duplicate-events/258112)
**Author:** [@Srikanth\_Suresh](https://discuss.elastic.co/u/Srikanth_Suresh)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 11:04am UTC](https://discuss.elastic.co/t/netflow-summarization-of-duplicate-events/258112 "2020-12-09T11:04:07Z")
Hello all! I am currently using Filebeat to send Netflow events into Elasticsearch. At certain time stamps I can observe 100,000 to 3 million events per second. Several of these events have the same data fields such a… --- ## [Scoring plugin, unexpected behavior](https://discuss.elastic.co/t/scoring-plugin-unexpected-behavior/258105)
**Author:** [@iva3682](https://discuss.elastic.co/u/iva3682)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 10:21am UTC](https://discuss.elastic.co/t/scoring-plugin-unexpected-behavior/258105 "2020-12-09T10:21:16Z")
Hey. I am writing a plugin for calculating the distance of the EMD vector for Elastic 7.10.0. I took the repository as an example https://github.com/elastic/elasticsearch/tree/master/plugins/examples/script-expert-scorin… --- ## [Please help with elapsed plugin and timestap difference](https://discuss.elastic.co/t/please-help-with-elapsed-plugin-and-timestap-difference/257628)
**Author:** [@fabryx87](https://discuss.elastic.co/u/fabryx87)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 10:28am UTC](https://discuss.elastic.co/t/please-help-with-elapsed-plugin-and-timestap-difference/257628 "2020-12-09T10:28:03Z")
Hello everyone and thanks for this great Forum! I would need a hand with elastic, I have to make a difference between 2 timestamps that have the logonid in common, but different event.action. unfortunately I don't even… --- ## [Elasticsearch mapping ES2.3 -\> ES 7.8](https://discuss.elastic.co/t/elasticsearch-mapping-es2-3-es-7-8/258078)
**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-es2-3-es-7-8/258078 "2020-12-09T10:13:50Z")
Assume that the defined mapping in ES2.3 has this format. "properties": { "accountId": { "type": "string", "index": "not\_analyzed" } } Is it equivalent to this in ES 7.8 version? "properties": { … --- ## [Timestamp search from file](https://discuss.elastic.co/t/timestamp-search-from-file/257853)
**Author:** [@mihai.radulescu](https://discuss.elastic.co/u/mihai.radulescu)\ **Replies:** 4\ **Last updated:** [December 9, 2020, 9:42am UTC](https://discuss.elastic.co/t/timestamp-search-from-file/257853 "2020-12-09T09:42:41Z")
Hello, I have no experience with Elasticsearch, however I wish to setup an environment to be able to search through some large csv files. The import with logstash works, however I have two issues: timestamp scale is u… --- ## [Timefilter in Canvas does not visually refresh with the newly searched criteria](https://discuss.elastic.co/t/timefilter-in-canvas-does-not-visually-refresh-with-the-newly-searched-criteria/258091)
**Author:** [@faisal.parwani](https://discuss.elastic.co/u/faisal.parwani)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 8:24am UTC](https://discuss.elastic.co/t/timefilter-in-canvas-does-not-visually-refresh-with-the-newly-searched-criteria/258091 "2020-12-09T08:24:09Z")
Hi i have a Canvas with Markdowns, for each markdown have certain query which is used to fetch and show the result (some number) as the content in the markdown. i added a timeFilter with default to 'Last 24 Hours' a… --- ## [I am unable to Start Auditbeat service](https://discuss.elastic.co/t/i-am-unable-to-start-auditbeat-service/257814)
**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\ **Replies:** 19\ **Last updated:** [December 9, 2020, 9:37am UTC](https://discuss.elastic.co/t/i-am-unable-to-start-auditbeat-service/257814 "2020-12-09T09:37:33Z")
HI Team, I am unable to install Auditbeat In my Linux version. I am getting this error: Exiting: 2 errors: 1 error: failed to create audit client: failed to get audit status: operation not permitted; 1 error: unable t… --- ## [Transforms -how to add common fields (i.e. geoip-fields) to the transform output?](https://discuss.elastic.co/t/transforms-how-to-add-common-fields-i-e-geoip-fields-to-the-transform-output/257915)
**Author:** [@hevi](https://discuss.elastic.co/u/hevi)\ **Replies:** 6\ **Last updated:** [December 9, 2020, 9:30am UTC](https://discuss.elastic.co/t/transforms-how-to-add-common-fields-i-e-geoip-fields-to-the-transform-output/257915 "2020-12-09T09:30:56Z")
Basically I have thousands of embedded devices that periodically upload logfiles to a backend we've created and after some preprocessing the log files are ingested into elasticserach using the geoip igestion pipeline. At… --- ## [ES 7.x : Setting threshold for document size and collecting metrics exceeding the same](https://discuss.elastic.co/t/es-7-x-setting-threshold-for-document-size-and-collecting-metrics-exceeding-the-same/258077)
**Author:** [@dinesh\_gnanasamy](https://discuss.elastic.co/u/dinesh_gnanasamy)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 9:29am UTC](https://discuss.elastic.co/t/es-7-x-setting-threshold-for-document-size-and-collecting-metrics-exceeding-the-same/258077 "2020-12-09T09:29:59Z")
Hi, Is there any way of setting a global parameter across indices in ES to the effect of defining the limit of size of each document and if the document size in any index exceeding this limit (either as result of indexi… --- ## [Algorithmic complexity of bool queries](https://discuss.elastic.co/t/algorithmic-complexity-of-bool-queries/258084)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 8:46am UTC](https://discuss.elastic.co/t/algorithmic-complexity-of-bool-queries/258084 "2020-12-09T08:46:15Z")
I've been searching all over the net to get an understanding of the algorithmic complexity / rough big-O of bool queries for Elasticsearch, but I have come up dry so I'm asking here. (Note: this is not a question about c… [Previous page](https://discuss.elastic.co/latest.md?page=1948) [Next page](https://discuss.elastic.co/latest.md?page=1950)